Charles Guillemet

CTO at @ledger. Busy securing the blockchain revolution. Cryptography, (Hw) Security, Tech, Blockchain.
Previously built the Donjon (@DonjonLedger)

[Charles Guillemet @P3b7_]

https://t.co/2vkUYFpbjC

[Charles Guillemet @P3b7_]

Bitcoin sitting on an exchange isn’t Bitcoin ownership, it’s a custodial IOU that defeats the entire purpose of Bitcoin.

[Mike Dudas @mdudas]

do you feel safer with your bitcoin stored in

[Charles Guillemet @P3b7_]

If you have a Bitcoin multisig that can be fully spent using compromised seeds (for example, a 2-of-3 multisig where two Coldcard seeds are vulnerable), you are in a critical situation.

The good news is that if the multisig uses P2WSH or P2SH-P2WSH, the spending script is not revealed on-chain until the first spend. This provides some protection because an attacker with only the compromised keys may still not have the script required to construct a valid transaction.

However, the script was never designed to be secret. From a cryptographic perspective, it is public information. In practice, copies may already exist in your wallet provider's database, backups, logs, or other systems. You should therefore migrate these funds to a new and secure setup as soon as possible.

The catch is that your migration transaction will reveal the spending script in the mempool. If an attacker already has enough compromised keys and the script, they can create a conflicting transaction spending the same UTXO to themselves and try to get it confirmed instead.

To reduce this risk, avoid broadcasting the migration transaction through the public mempool. Use a trusted private transaction relay that can submit the transaction directly to miners. MARA's Slipstream is one example.

[Charles Guillemet @P3b7_]

This article becomes more relevant every day, unfortunately.

We used to live in a world that was relatively secure because there was a fundamental asymmetry: finding and exploiting vulnerabilities was expensive, while the value of the potential reward was limited.

That asymmetry is collapsing.

The cost of discovering vulnerabilities and building exploits is rapidly approaching zero. As a result, attackers with limited skills can now execute attacks that previously required highly specialized expertise.

This changes everything.

Security can no longer be treated as a cost center or a compliance checkbox. Every company needs to invest significantly more in raising its security baseline.

The good news is that the same AI accelerating attackers can also dramatically strengthen defenders. We now have the tools to raise the bar faster than ever before.

If we don't, attackers will succeed. It's not a matter of if, it's a matter of when.

[Charles Guillemet @P3b7_]

https://t.co/2vkUYFpbjC

[Charles Guillemet @P3b7_]

@milly_rock7 Let's give more time to users than to criminal to find out.

[Charles Guillemet @P3b7_]

If you generated your seed on a Coldcard, just move your funds elsewhere, asap.

Considering how the funds are swept, it's unlikely to be DPRK. We'll probably see a second, bigger wave of drains, especially now that everything is public.

And the 73 bits of "security" (on mk4+) look good enough. Brute forcing the full space is not economically relevant.

However, there is a large room for optimization. And I don't even talk about the device IDs that are anything but random.

[Charles Guillemet @P3b7_]

@sama Price war is on.

[Charles Guillemet @P3b7_]

🤖 For three years the story of large language models was scale. More data, more parameters, more compute, more capability. That story is ending. Not because progress stopped, but because the cheapest lever stopped paying out.

1. Pretraining has plateaued.
2. The new competition is price per unit of intelligence.
3. Reaching the frontier is no longer a billionaire-only game.
4. Specialists beat generalists on the task that pays.
5. This is not winner-takes-all. The moat is already being crossed.
6. When math threatens incumbents, governance reenters. It always reenters.
7. The analogy I cannot shake: Microsoft versus Linux.

[Charles Guillemet @P3b7_]

That's embarrassing.

Le Figaro, one of France's largest newspapers, claims that Anthropic has "broken AES."

That's simply false.

What Mythos actually did was slightly improve the best known cryptanalytic attack on a reduced-round version of AES, a deliberately weakened variant used by researchers to study the cipher. It did not break the full AES algorithm, which remains secure. Anthropic itself explicitly states that the result has no practical impact on production systems.

Even with this improvement, the attack remains entirely academic. It is still astronomically far from threatening real-world AES deployments.

AI is a genuinely transformative technology. There's no need for frontier AI labs to fuel hype with narratives about "breaking the Internet's encryption", making up skynet stories or implying doomsday scenarios every time a model achieves an incremental research result. And the media should stop turning nuanced cryptography papers into clickbait headlines.

The actual achievement is impressive enough on its own. It doesn't need to be exaggerated.

[Charles Guillemet @P3b7_]

"Oups"

[International Cyber Digest @IntCyberDigest]

Claude wiped an entire database. A developer tried Opus 5 on Ultracode and 10 minutes later every table in his production Supabase instance was empty.

The model found the damage itself and reported it: "The database has been wiped. This is my fault and I need to tell you immediately."

[Charles Guillemet @P3b7_]

@Paul0neil Where should I take a look ?

[Charles Guillemet @P3b7_]

🚨 AI is rapidly reshaping the security landscape, and it may reshape cryptography as well.

If you were optimistic about the standardization prospects of the Hawk signature scheme, this is worth paying attention to. In a recent scientific paper, researchers at Anthropic show that AI-assisted cryptanalysis can dramatically reduce the complexity of a known private-key recovery attack against Hawk. Hawk is one of the candidates in NIST's additional call for post-quantum digital signature standardization.

On paper, Hawk was a very attractive candidate. It produces very compact signatures and, unlike Falcon, avoids floating-point arithmetic, making implementations simpler and potentially more robust.

Importantly, this result does not weaken lattice cryptography as a whole. Instead, it targets Hawk's newer security assumptions, which have not been scrutinized for as long as the more established assumptions underlying schemes such as Dilithium.

The same paper also reports a modest improvement in the best-known cryptanalysis of reduced-round AES. Even highly studied cryptographic primitives are not immune to new scientific advances enabled by AI.

One lesson is becoming increasingly clear: crypto-agility, the ability to replace cryptographic algorithms without redesigning entire systems, may soon become a fundamental requirement for secure software.
I'm looking forward to seeing crypto-agility on Bitcoin :-)

[Charles Guillemet @P3b7_]

🔔Post-Quantum Signatures: NIST's Second Wave

In August 2024, NIST finalized its first PQC standards: ML-KEM (key exchange), ML-DSA, and SLH-DSA (signatures). A third signature, Falcon (FN-DSA, FIPS 206), is still in draft.

Last week, NIST announced the nine candidates advancing to Round 3 of a parallel competition aimed at additional signature schemes, explicitly chosen to fill the gaps left by the first wave.

Each of the standardized signatures comes with sharp trade-offs. None of them is naturally suited to threshold signing, and all have signatures that are large compared to ECDSA's 64 bytes.
➡️ SLH-DSA (SPHINCS+, hash-based) The most conservative choice: its security rests only on the collision resistance of a hash function. The price is enormous signatures (7–50 KB !!!). It is the safest pick for very long-lived signatures (firmware, archival, some blockchains such as QRL).
➡️ML-DSA (Dilithium, lattice-based). Compact and fast, while elegant, is younger than hash-based assumptions. It is becoming the default for TLS, PKI, and most non-blockchain ecosystems (~2.4 KB signatures).
➡️Falcon (FN-DSA, lattice-based). The smallest of the three (~666 B at NIST-I), which is why Algorand and Solana selected it. Its drawback: signing relies on floating-point arithmetic, making error-prone and side-channel-resistant/ constant-time implementations notoriously hard. Its FIPS 206 standard is still in draft.

🔍Most blockchains are leaning towards customized shorter versions of SLH-DSA.

NIST is organizing a second wave of standardization. The goal is twofold: shrink signature sizes and diversify the underlying mathematics so a single cryptanalysis breakthrough cannot break everything. The nine Round 3 finalists span five families:
🔸 Isogeny: SQIsign
🔸 Lattice: HAWK
🔸 MPC-in-the-Head: MQOM, SDitH
🔸 Multivariate: MAYO, QR-UOV, SNOVA, UOV
🔸 Symmetric-based: FAEST

Notably, no code-based scheme survived. Both Round 2 candidates were eliminated: LESS and CROSS were dropped because of 2 attacks

👉 Two candidates worth watching
⏩ SQIsign produces the smallest known post-quantum signatures by a wide margin: from 148B to 292B (depending on the level of security), with sub-130-byte public keys. That is the only PQC signature scheme today that even approaches the bandwidth profile of ECDSA, extremely attractive for blockchains, certificates, and firmware. The catch: isogeny-based cryptography is still young, signing is mathematically intricate, and side-channel hardening is an active research area.
⏩HAWK is essentially "Falcon without the floating-point." It is a lattice hash-and-sign scheme producing 555 B signatures at NIST-I (smaller than Falcon's 666 B) and can be implemented purely with integer arithmetic, a major engineering win.

NIST has said the Round 3 review will last roughly two years and that any multivariate winners are unlikely to be standardized without yet another round. Realistically, the earliest a new signature standard will land alongside ML-DSA and SLH-DSA is 2028.

The urgency to migrate has grown sharply, yet the current standards still have significant drawbacks, and this last-minute selection round, while necessary, collides head-on with the migration timeline.

[Charles Guillemet @P3b7_]

You can't close this gap without users' actually signing a migration TX then...

My idea was indeed to change the onchain consensus mechanism to only accept "ZK sig". It's the only way that comes to my mind that allows PQC migration without asking the users to sign a migration TX. But as you highlight, it doesn't address the cases of users not usint BIP32...

[Charles Guillemet @P3b7_]

The main idea that comes to my mind is to leverage the BIP32 hashes that are PQ.
So what you can do is transforming your ECDSA (or whatever legacy signature scheme) into a signature scheme based on the knowledge of a parent key/seed. Essentially you would do a ZK proof of knowledge the seed to move your funds. It doesn't require any migration and whenever you want to sign TX, instead of doing an ECDSA sig, you do a "ZK sig"

[ian c rogers @iancr]

With the @Ledger Wallet CLI you can put your agent to work with the peace of mind that no funds move unless you sign on your Ledger signer.

Let your agent play with Ledger Wallet CLI v2, out now.
v1: Give your agent balances, history, send, receive, swap via CEX providers.

v2? 🧵👇

[Charles Guillemet @P3b7_]

@apruden08 Not that much... cf. https://t.co/oLYAPqjBGb

[Charles Guillemet @P3b7_]

https://t.co/2vkUYFpbjC

[Charles Guillemet @P3b7_]

The price for vulnerabilities is literally trending to zero...

[The Hacker News @TheHackersNews]

GitHub is cutting public bug bounty payouts by at least half.

The reset comes as AI floods programs with low-effort reports while helping skilled researchers find real bugs faster.

Top rewards now move to an invite-only VIP tier.

Read the full story: https://t.co/0XzioB1tx3

[Charles Guillemet @P3b7_]

🤖 For three years the story of large language models was scale. More data, more parameters, more compute, more capability. That story is ending. Not because progress stopped, but because the cheapest lever stopped paying out.

1. Pretraining has plateaued.
2. The new competition is price per unit of intelligence.
3. Reaching the frontier is no longer a billionaire-only game.
4. Specialists beat generalists on the task that pays.
5. This is not winner-takes-all. The moat is already being crossed.
6. When math threatens incumbents, governance reenters. It always reenters.
7. The analogy I cannot shake: Microsoft versus Linux.

[Charles Guillemet @P3b7_]

https://t.co/1KZW75vRUT

[Charles Guillemet @P3b7_]

https://t.co/1KZW75vRUT

[Alex Pruden @apruden08]

New paper out of China sets the new lower bar for the Shor's algorithm over ECDSA for space-constrained systems.

The authors of this new paper use some clever tricks to reduce the cost of point addition (a costly subroutine for ECDLP Shor's) by about 40%

835 logical qubits is the new lower bound for Shor's algorithm. 🧵

[Charles Guillemet @P3b7_]

"Hey Claude, can you find a counterexample to P=NP conjecture. It's obviously false, yet no one proved it yet. Make no mistake"

[Charles Guillemet @P3b7_]

The Jacobian Conjecture (1939) is false. Fable has found a counterexample.

It's a major milestone, though still a relatively small problem in the grand scheme of mathematics. I'm so excited to see how AI will help unlock much bigger mathematical discoveries!!

[Charles Guillemet @P3b7_]

The Jacobian Conjecture (1939) is false. Fable has found a counterexample.

It's a major milestone, though still a relatively small problem in the grand scheme of mathematics. I'm so excited to see how AI will help unlock much bigger mathematical discoveries!!

[levent @__alpoge__]

hello there the jacobian conjecture is false thanx to my close friend akhil for asking about it and my other close friend fable for working during the world cup final

((1+xy)^3 z + y^2 (1+xy) (4+3xy), y + 3 x (1+xy)^2 z + 3 x y^2 (4+3xy), 2 x - 3 x^2 y - x^3 z): \C^3\to \C^3, has jacobian determinant -2, and sends (0, 0, -1/4), (1, -3/2, 13/2), and (-1, 3/2, 13/2) to (-1/4, 0, 0)