Lukas

Cryptography Engineering & Rust

Currently @hoprnet

[slash1s @slash1sol]

A NOBEL WINNING PHYSICIST ARGUED THAT NO AI, NO MATTER HOW POWERFUL, WILL EVER TRULY UNDERSTAND A SINGLE THING IT SAYS. HIS REASON IS NOT COMPUTE OR DATA -- IT IS A MATH THEOREM FROM THE 1930s THAT SAYS SOME TRUTHS CAN BE SEEN BUT NEVER COMPUTED

81 minutes with Roger Penrose -- the Oxford physicist who won a Nobel for his work on black holes and general relativity.

-> His claim: whatever consciousness is, it is not a computation. A machine following rules can imitate understanding, but never actually have it.

He builds it on Gödel: a human can just "see" that certain statements are true, even though no algorithm can ever prove them. That seeing, he argues, is non-computational.

If he is right, understanding is not something you scale into. You can stack a trillion parameters and still have zero awareness underneath.

Which cuts straight through the AI moment. Everyone assumes bigger models will eventually "wake up". Penrose says that is a category error -- more computation is still just computation.

You thought intelligence and understanding were the same thing. This is the conversation that pulls them apart.

Save this. It is the sharpest case against the hype ↓

[Trail of Bits @trailofbits]

RSA private keys biased toward 0 bits can be factored by swapping a hard math problem for an easy one: integer factorization becomes polynomial factorization.

We found hundreds of real-world keys vulnerable to this. Many traced to a type mismatch in CompleteFTP (now patched): each 32-bit limb got only 8 bits of randomness. We recovered 603 RSA and 74 DSA private keys. https://t.co/C2jcxVW9WG

[Alain Meier @alain]

The US is the least privacy-safe country to use iCloud Private Relay in the world (!!!). Italy's Relay users get ~7x more hidden/shared traffic per IP than US users. Back of the envelope:

45k 🇺🇸 IPv4s shared among ~31M iCloud+ users = 683 users per IP

Most ➜ least private:

🇮🇹 4,697 users per IP
🇳🇱 4,115 users per IP
🇫🇷 3,929 users per IP
🇯🇵 3,647 users per IP
🇬🇧 2,965 users per IP
🇮🇳 2,629 users per IP
🇩🇪 2,623 users per IP
🇧🇷 2,169 users per IP
🇨🇦 1,485 users per IP
🇸🇬 1,051 users per IP
🇫🇮 967 users per IP
🇺🇸 683 users per IP

When you narrow it down to time-of-day traffic it can get a lot more specific than that, too. All estimates, though.

[Dan Guido @dguido]

.@trailofbits holds the world record for breaking elliptic curve crypto with the fewest quantum qubits. Woooo 🤘

[Daniel J. Bernstein @hashbreaker]

Posted new paper "Exploiting ML-DSA bugs" and demo scripts: https://t.co/zoazTjsFcM The current panic to roll out new ML-DSA code in place of ECC signatures will give away tons of keys to attackers through the predictable flood of efficiently exploitable software vulnerabilities.

[JP Aumasson @veorq]

Gentle as in 'only 182 pages': https://t.co/130H1OJ7Ww
via @jedisct1

[Dave W Plummer @davepl1968]

Here are at least 5 things that you should know about print(), but probably don't!

[Lukasz Olejnik @lukOlejnik]

DO NOT use Telegram in sensitive applications. Telegram does not need to have its message encryption broken for users to be tracked at the network layer. Telegram sends MTProto over unencrypted TCP, exposing auth_key_id - a long-lived identifier tied to the client’s authorisation key. An ISP, hotel WiFi operator, mobile carrier, transit provider, or surveillance system on the network path can see that identifier if they can observe the traffic. It can remain stable across app restarts, IP changes, VPN use, network switches, and location changes. Secret Chats protect message content, but this leak is below that layer. That makes the attack passive. The risk is in retroactive correlation. Think a journalist using Telegram from different networks for months, then joining hotel or corporate WiFi under a real name. That one identity anchor could make old logs searchable for the same auth_key_id. The fix is simple - mandatory transport encryption for all MTProto connections, with no unencrypted fallback. Telegram chose not to do this. Source: @kaepora https://t.co/TJALYAwaOs

[Crypto_Marina @Crypto_marina]

Was a pleasure to share the stage with @lunardragon420 , @luc_numberfour & @TMIYChao at @EthPrague today on "The Case Against the Browser" panel.

The verdict: it's a surveillance surface dressed as a universal interface.
→ 30+ fingerprinting vectors in Chrome
→ 12.7% of top sites already canvas-fingerprint you
→ Privacy Sandbox quietly buried in April 2025

We decentralized the ledger and recentralized everything in front of it.

@Logos_network shipped Basecamp for this exact moment: a sovereign launcher, not a tab. Your machine as a peer, not a client.

The post-browser internet is being built — by people who got tired of waiting 🛠️

[Daniel J. Bernstein @hashbreaker]

Why add a PQ layer? To try to reduce the damage caused by quantum computers. Why also keep the existing (low-cost) ECC layer? To try to reduce the damage from further PQ security failures. For some reason this suddenly seems difficult for U.S. military contractors to understand.

[Algorand Foundation @AlgoFoundation]

Today is World Quantum Day!

A great reminder that quantum's impact on cryptography isn't theoretical, it's only a matter of time.

To mark the occasion, CEO @StaciW_DC sat down with world-renowned post-quantum cryptographer and Algorand CSO @ChrisPeikert to discuss the quantum threat to blockchain.

Since 2022, @Algorand has been leading in blockchain quantum resilience by securing its entire chain history with Falcon-signed State Proofs.

In 2025, we took it further: the first quantum-resistant transaction protecting real digital assets was executed on mainnet.

With Google now targeting 2029 for its own post-quantum migration, the urgency is clear.

Algorand isn't waiting, we're already building for that future.

Watch now! 👇

[armagan.gwei @epochzer0]

In this strange industry, @SCBuergel is one of the rare people worth listening to when he speaks. I'm so glad we work together at @gnosis_ and I'm insanely happy that we'll have @Gnosis_VPN.

📸 from @dappcon '24

[Frank @jedisct1]

I already told you about it, but the paper is out! VROOM: Accelerating (Almost All) Number-Theoretic Cryptography Using Vectorization and the Residue Number System https://t.co/eeDOfTfoxn

[JP Aumasson @veorq]

overdue, feels like "we forgot you all these years sry" https://t.co/3qKaLDTnJJ

[Dave W Plummer @davepl1968]

It's the same for mechanical engineering. If you want to build a locomotive, don't sweat the metallurgy and the thermodynamics, just prompt, baby... prompt!

If you're a fast learner, or a good gamer, or grew up near train tracks, that's ALL you need. In fact, not knowing that locomotives use wheels could be an advantage.

You're just a boiler explosion away from revealing your "true grit", which is the measure that software engineers have traditionally rated each other with.

[Gnosis @gnosis_]

📢 New X Space

Join @SCBuergel on 5 March at 1 PM UTC to discuss: Framework for the Future.

We'll talk about long-term vision and how to balance credible neutrality with user protection.

Join the conversation ⬇️
https://t.co/B6eN73o3wL

[Nick Sullivan @grittygrease]

Encrypted Client Hello is now RFC 9849

This RFC defines an extension to Transport Layer Security that improves privacy for web users to a significant degree. Huge team effort by more than just the listed authors here, and a win for the internet at large. Now to get deployment up...

I wrote about this pending draft a few months ago and hinted at some of the challenges to come: https://t.co/Qk2EYX0SLN

[Sarah Cecchetti @Sarah_Cecc]

If someone told me a semiconductor shipment was late because it was the wrong phase of the moon, I would not have believed them before reading this paragraph!

[Sebastian Bürgel @SCBuergel]

I just contributed to the Bordel crowd loan - pls consider joining me!

TLDR:
- they need a loan of $180k to buy a hack space in Prague
- you contribute to the loan in USDC, secured by the team's weETH (75% of value)
- they pay you 2.5% APY on your loan, basically like rent
- they are still 77k USD short with less than 3d to go
- team is gud and has been around forever but this still has all sorts of risks (including technical), so only contribute what you can loose

ape in: https://t.co/QHjraW3zpL

[Arika @Arikalabs]

https://t.co/8FzeJk6SPD