Filippo Valsorda
Filippo Valsorda — Cryptographer, Go security team, founder of Geomys
Go security team member writing about cryptography and open source maintenance.
words.filippo.ioOne of the most respected voices in applied cryptography and Go security. Filippo maintains critical Go cryptographic libraries, founded Geomys (a firm dedicated to open-source maintenance), and writes about the deep technical details that most security blogs gloss over — post-quantum algorithms, TLS implementation, key management, and the economics of sustaining open-source infrastructure. His posts are the kind that other cryptographers cite.
Written by Filippo Valsorda.
Regular
Publishes weekly or bi-weekly
8
Independent Blog
English
How this blog's content is accessed through Blogs Are Back.
Full Content
RSS feed includes complete post content for reading in-app
Proxy Required
Feed is fetched through our proxy for browser compatibility
Proxy Post Links
Post pages are loaded through our proxy for compatibility
Embeddable
Posts can be displayed inline in the reader view
This blog appears in the following curated collections.
Recent posts from Filippo Valsorda's RSS feed.
Production ML-DSA Verification in 350 Lines of Python
I don’t do a lot of Python, at least not in my most recent life.1 However, I happen to have just written a production ML-DSA verifier in pure Python. It’s 350 lines of code (plus many more of tests), it supports all parameter sets, and I am pretty satisfied with it. You can fetch it as mldsa from PyPI, thanks to William Woodruff, or you can copy-paste it: it’s a single file without dependencies and it’s dual-licensed CC0 and 0BSD. It works with Python 3.8 and later. The API is modeled after the...
Opaque, Interoperable Passkey Records (and a Go API)
Passkeys are the most important thing happening in information security right now because they are the only principled solution to the overwhelming effectiveness of phishing attacks. Just like memory safety is the only principled solution to memory corruption attacks. Unfortunately, implementing them on the server side can appear more complex than using password hashes. Part of this is unavoidable because passkeys require interaction with the browser to get their phishing resistance properties....
Vulnerability Reports Are Not Special Anymore
A requirement for staying sane while working in public as an open source maintainer is realizing that every issue, PR, and piece of feedback is a present, not an obligation. You can accept it, ignore it, and use it partially or not at all. Except… For years, as lead of the Go Security team at the time,1 I’ve told new team members that it doesn’t apply to vulnerability reports. No, vulnerability reports are special. Security researchers are doing us a favor by reporting things confidentiall...
Quantum Computers Are Not a Threat to 128-bit Symmetric Keys
The advancing threat of cryptographically-relevant quantum computers has made it urgent to replace currently-deployed asymmetric cryptography primitives—key exchange (ECDH) and digital signatures (RSA, ECDSA, EdDSA)—which are vulnerable to Shor’s quantum algorithm. It does not, however, impact existing symmetric cryptography algorithms (AES, SHA-2, SHA-3) or their key sizes. There’s a common misconception that quantum computers will “halve” the security of symmetric keys, requiring 256-bit keys...
A Cryptography Engineer’s Perspective on Quantum Computing Timelines
My position on the urgency of rolling out quantum-resistant cryptography has changed compared to just a few months ago. You might have heard this privately from me in the past weeks, but it’s time to signal and justify this change of mind publicly. There had been rumors for a while of expected and unexpected progress towards cryptographically-relevant quantum computers, but over the last week we got two public instances of it. First, Google published a paper revising down dramatically the estima...
If you enjoy Filippo Valsorda, you might also like these blogs.
Andrew Nesbitt
nesbitt.ioPackage management and open source metadata expert. Building Ecosyste.ms, open datasets and tools for critical open source infrastructure.
Seth Larson
sethmlarson.devPython security and open source infrastructure, plus retro gaming preservation and emulation.
Troy Hunt
troyhunt.comSecurity researcher and creator of Have I Been Pwned. Expert analysis on data breaches and web security.
the website of jyn
jyn.devTechnical blog on build systems, Rust, developer tools, and the human side of software engineering.
Follow Filippo Valsorda
If you care about how cryptography actually works in production — or how to make open-source maintenance sustainable — Filippo writes with a depth and candor that's rare in the field.