WireGuard is a VPN protocol with an efficient, DH-based handshake. Prior attempts at making it PQ heavily relied on Classic McEliece, which has deployment complications. We revisit …
I presented a Formal Analysis Triage Team report on Extended Key Usage (EKU) in the TLS working group session.
Key exchange in TLS is now mostly PQ! But what about authentication? In this talk, I discussed some of the ongoing work to make the costs of PQ certificates acceptable so that …
The Signal protocol relies on a special handshake protocol, formerly X3DH and now PQXDH, to set up secure conversations. One of its privacy properties, of value to Signal, is …
The Signal protocol relies on a handshake protocol, formerly X3DH and now PQXDH, to set up secure conversations. One of its privacy properties, of value to Signal, is deniability, …
The Signal protocol relies on a special handshake protocol, formerly X3DH and now PQXDH, to set up secure conversations. Prior analysis of these protocols (or proposals for …
Conference talk presenting a unified framework for deniability analysis of Signal handshake protocols, including a deniable ring signature from Falcon/MAYO.
Conference talk presenting the BAKE framework for Signal's handshake protocols, covering X3DH, PQXDH, and the fully post-quantum RingXKEM.
I presented a status update on our IETF draft on stateful HBS state management, now adopted as a PQUIP working group document.
Invited talk for Comcast Research's Monthly Research Presentation Series on the costs and challenges of post-quantum authentication.