The Curious Engineer

All blogs / Security

Filippo Valsorda

words.filippo.io

SecurityGoEngineering blogs

’15’20’25
Posts
135 from 10 Nov 2013 to 16 Oct 2026
Posting
monthly (13 in the last year)
Kind
personal blog
Feed
https://words.filippo.io/rss/

2026 10

  1. The NIST Elliptic Curves Seeds Bounty Has Been Claimed
  2. (Post-Quantum) Cryptographic Right Answers
  3. Production ML-DSA Verification in 350 Lines of Python
  4. Opaque, Interoperable Passkey Records (and a Go API)
  5. Vulnerability Reports Are Not Special Anymore
  6. Quantum Computers Are Not a Threat to 128-bit Symmetric Keys
  7. A Cryptography Engineer’s Perspective on Quantum Computing Timelines
  8. Turn Dependabot Off
  9. Inspecting the Source of Go Modules
  10. go.sum Is Not a Lockfile

2025 10

  1. Building a Transparent Keyserver
  2. The 2025 Go Cryptography State of the Union
  3. Claude Code Can Debug Low-level Cryptography
  4. The Geomys Standard of Care
  5. A Retrospective Survey of 2024/2025 Open Source Supply Chain Compromises
  6. Maintainers of Last Resort
  7. Cross-Site Request Forgery
  8. Go Assembly Mutation Testing
  9. Encrypting Files with Passkeys and age
  10. You Should Run a Certificate Transparency Log

2024 11

  1. Benchmarking RSA Key Generation
  2. frood, an Alpine initramfs NAS
  3. Accumulated Test Vectors
  4. The FIPS Compliance of HKDF
  5. Let’s All Agree to Use Seeds as ML-KEM Keys
  6. age Plugins
  7. Geomys, a blueprint for a sustainable open source maintenance firm
  8. XAES-256-GCM
  9. My Maintenance Policy
  10. PINs for Cryptography with Hardware Secure Elements
  11. Post-quantum Cryptography for the Go Ecosystem

2023 10

  1. Enough Polynomials and Linear Algebra to Implement Kyber
  2. Why We Don’t Generate Elliptic Curves Every Day
  3. Announcing the $12k NIST Elliptic Curves Seeds Bounty
  4. I want XAES-256-GCM/11
  5. A Cryptographic Near Miss
  6. Planning Go 1.21 Cryptography Work
  7. Avoid The Randomness From The Sky
  8. I’m Now a Full-Time Professional Open Source Maintainer
  9. ssh whoami.filippo.io
  10. Go 1.20 Cryptography

2022 9

  1. My age+YubiKeys Password Management Solution
  2. A GC-Friendly Go Interning Cache
  3. Why Did the OpenSSL Punycode Vulnerability Happen
  4. The Reciprocal Value of Access to Maintainers
  5. age and Authenticated Encryption
  6. Planning Go 1.20 Cryptography Work
  7. A Wide Reduction Trick
  8. KEMs and Post-Quantum age
  9. How to pay professional maintainers

2021 3

  1. Professional maintainers: a wake-up call
  2. From the Go Blog: Automatic Cipher Suite Ordering in crypto/tls
  3. The Most Backdoor-Looking Bug I’ve Ever Seen

2020 12

  1. Re-Deriving the edwards25519 Decoding Formulas
  2. Reconstruct Instead of Validating
  3. NaCl Is Not a High-Level API
  4. Registries Considered Harmful
  5. Replace PGP With an HTTPS Form
  6. DSA Is Past Its Prime
  7. Is X25519 Associative? Sometimes!
  8. OpenSSH 8.2 Just Works with U2F/FIDO2 Security Keys
  9. Hacking together a USB-C charger for a cheap Chromebook
  10. Install Go tools from modules with brew-gomod
  11. New Crypto in Go 1.14
  12. The Linux CSPRNG Is Now Good!

2019 5

  1. Efficient Go APIs with the mid-stack inliner
  2. Hello World, and OpenPGP Is Broken
  3. Using Ed25519 signing keys for encryption
  4. A Go implementation of Poly1305 that makes sense
  5. mkcert: valid HTTPS certificates for localhost

2018 3

  1. Touch-to-operate password-store with YubiKey 4
  2. Making a Gmail bot with Apps Script and TypeScript
  3. Easy Windows and Linux cross-compilers for macOS

2017 15

  1. Live streaming Cryptopals
  2. The scrypt parameters
  3. We need to talk about Session Tickets
  4. A secure captive portal browser with automatic DNS detection
  5. Playing with kernel TLS in Linux 4.13 and Go
  6. restic cryptography
  7. rustgo: calling Rust from Go with near-zero overhead
  8. Cleaning up my GOPATH with Homebrew
  9. Reproducing Go binaries byte-by-byte
  10. Setting a custom FileVault (macOS FDE) passphrase
  11. Finding Ticketbleed
  12. Go Time #32 - Hellogopher, whosthere?
  13. TLS 1.3 at 33c3
  14. How to protect yourself from the WebEx extension
  15. So you want to expose Go on the Internet

2016 18

  1. I'm giving up on PGP
  2. TLS nonce-nse
  3. An overview of TLS 1.3
  4. So I lost my OpenBSD FDE password
  5. The complete guide to Go net/http timeouts
  6. Securing a travel iPhone
  7. Analyzing Go Vendoring with BigQuery
  8. git fixup: --amend for older commits
  9. Stale GOROOT and gorebuild
  10. Untrusting an intermediate CA on OS X
  11. vendorcheck: the simplest Go static analysis tool
  12. Self-host analytics for better privacy and accuracy
  13. "LuckyMinus20": Yet Another Padding Oracle in OpenSSL CBC Cipher Suites
  14. Shrink your Go binaries with this one weird trick
  15. Understanding Metrics in the Age of the TSDB
  16. Technical notes: mixing speaker and slides recording with FFmpeg
  17. Coverage for end-to-end tests of Go programs
  18. Bleichenbacher'06 signature forgery in python-rsa

2015 20

  1. Most Go tools now work with GO15VENDOREXPERIMENT
  2. SSLv2 redux: patching Go crypto/tls to work with IE6
  3. "Automated Testing with go-fuzz" @ GothamGo
  4. Creative foot-shooting with Go RWMutex
  5. Building Python modules with Go 1.5
  6. DNS parser, meet Go fuzzer
  7. ssh whoami.filippo.io
  8. A deep look at CVE-2015-5477
  9. Quick and dirty annotations for Go stack traces
  10. Technical notes: convert a partition image to a bootable disk image
  11. Setting Go variables at compile time
  12. Go has a debugger—and it's awesome!
  13. How Plex is doing HTTPS for all its users
  14. Logjam explained
  15. The unofficial Chrome SHA1 deprecation FAQ
  16. The sad state of SMTP encryption
  17. Make your own Superfish infected VM
  18. Komodia/Superfish SSL Validation is broken
  19. So I lost my NAS password
  20. scrypt all the things!

2014 7

  1. PSA: enable automatic updates. Please.
  2. "The Heartbleed Test" @ OWASP / NYU Poly
  3. Salt & Pepper, please: a note on password storage
  4. On Keybase.io and encrypted private key uploading
  5. Why Go is elegant and makes my code elegant
  6. My remote shell session setup
  7. Native scrolling and iTerm2

2013 2

  1. How the new Gmail image proxy works and what this means for you
  2. The ECB Penguin