Fun fact: I wasn’t supposed to be in this video. I was just walking into work one day, saw Tom Scott in the lobby and asked “Aren’t you Tom Scott from YouTube?” and he interviewed me. The camera is digital, but I grew up in the 80s so I reflexively used the term “videotape” 😅

Thread. I was recently privy to a conversation in which some really smart people in security shared their favorite papers or articles. Security engineering, like other disciplines, has a rich history worth learning from. I'm going to list some of these papers in this thread.

It’s here! 🎉🎉🎉 RFC 8446: TLS 1.3 rfc-editor.org/rfc/rfc8446.t… Also, I wrote a blog post about the topic: blog.cloudflare.com/rfc-8446…

DNS-over-HTTPS will be rolled out by default in Firefox for U.S. users starting at the end of September 2019. Firefox will default to using Cloudflare's 1.1.1.1 at first, but that may change if other resolvers adopt a comparably strong privacy policy. blog.mozilla.org/futurerelea…

Personal news! Today marked a significant milestone for me. Ten years ago yesterday, I embarked on an incredible journey with a scrappy San Francisco startup. Now, @Cloudflare is a global powerhouse, and I am turning the page and announcing my departure. Over the past decade, we have broken new ground in Internet security and privacy. None of this would have been possible without the remarkable team at Cloudflare. I want to extend my deepest thanks to everyone who's been a part of this adventure. Your efforts, talent, and unwavering commitment have made this journey not just successful but truly unforgettable. My colleagues have brought an unmatched level of dedication, ingenuity, and camaraderie to our mission, and I am grateful for the opportunity to have worked alongside you all. Leading Cloudflare Research has been an incredibly enriching experience. Together, we've fostered an open and encouraging environment where seeds of knowledge were planted, and we witnessed them blossom. To the dozens of people who have been a part of it, your contributions have been invaluable and I leave with immense pride for the work we've done together. To the wider tech community, thank you for the engaging dialogues, constructive challenges, and shared passion for building a speedier and more secure Internet. Our collective journey towards this goal is one I've been proud to be a part of. While I am stepping away from my role at Cloudflare, I remain committed to advocating for privacy and security in the digital world. But for now, I'm taking some time to figure out what's next. Thank you, Cloudflare, for an unforgettable 10-year journey. Here's to the next chapter and to the continued journey of helping build a better Internet for everyone. If you’d like to keep in touch, my DMs are open as always.

This is huge! Cloudflare now offers a global NTP service at time.cloudflare.com. It supports NTP and authenticated time via the new Network Time Security (NTS) spec. Authentication keys are established over TLS 1.3 on port 1234. blog.cloudflare.com/secure-t…

Facebook lets you know which advertisers uploaded a contact list with your info. The next time you see an ad, follow this sequence: Why am I seeing this ad-> Manage your ad preferences-> Advertisers-> Advertisers who uploaded a contact list with your info How big is your list?

TLS 1.3 just passed TLS 1.2 as the most common encryption protocol for requests to the Cloudflare network.

DNS Queries over HTTPS (DoH) is now RFC 8484. This is a big step forward for DNS security. rfc-editor.org/rfc/rfc8484.t…

The 1.1.1.1 resolver now supports a new protocol: DNS over Twitter! Just send your queries to @1111Resolver. We’re also working on even more interesting ways to access the DNS. Watch this space. #1dot1dot1dot1

How we generate the 64bits of entropy for the new @CloudFlare Origin CA #lavarand.

Encrypted Client Hello (ECH) is a new proposed standard that improves encryption and metadata protection for connections online that use TLS for security. After years of testing and refinement, it's finally happening. Chrome has been testing ECH for months, and is now enabling it by default in Chrome 117: chromestatus.com/feature/619…. Firefox is not far behind: elevenforum.com/t/encrypted-…. Cloudflare just launched support for ECH for all customers: blog.cloudflare.com/announci…. These changes amount to the removal of the hostname from cleartext for huge chunk of Internet communication. Considering how long the hostname has been in cleartext and how many products were built around that assumption, it's going to be an interesting rollout.

Cloudflare had a bug. A bad one. In the spirit of transparency we've shared all the details. blog.cloudflare.com/incident…

Guess what happened today? TLS 1.3 surpassed TLS 1.0 as the second-most common version of TLS seen by Cloudflare. #tls13

DNS should be fast and private. Cloudflare's new DNS resolver helps make this possible by running DNS-over-HTTPS with TLS 1.3 0-RTT on a massive global network with correctly aligned incentives. "We don't see personal data as an asset; we see it as a toxic asset" #1dot1dot1dot1

Introducing RFCGPT: the virtual assistant that has read the entire RFC series. Ask it anything about internet protocols and standardization! cryptography.consulting/rfcg… This tool is built on OpenAI’s new “My GPT” feature and is available to all ChatGPT Plus customers. Note that this is an experimental launch: it can still hallucinate and give incorrect information, so double-check what it says before using the information provided.

Announcing support for Encrypted SNI. Never leak your browsing history in plaintext to your ISP again. #CryptoWeek #BirthdayWeek Cloudflare Announcement: blog.cloudflare.com/esni/ Technical Details: blog.cloudflare.com/encrypte… IETF Draft: tools.ietf.org/html/draft-ie…

TLS 1.3 was approved by the IESG. The votes landed as follows: Ben - Yes Warren - No Alissa - Yes Benjamin - Yes This means it’s in the hands of the RFC editors to make editorial changes and publish it as an RFC. This process typically takes a few months.

Cloudlflare's 1.1.1.1 DNS Resolver is now available as a Tor hidden service. Really cool project by @Cloudflare crypto team intern @mahrudsay. blog.cloudflare.com/welcome-…

Just open-sourced: the data underlying the submarine cable map of the Internet: github.com/telegeography/www… submarinecablemap.com

This will change web hosting as we know it. Set up a raspberry pi and host your own website, even behind a NAT. #warp blog.cloudflare.com/get-star…

The post-quantum crypto experiments at @Cloudflare have begun. There are now two (hybrid) post-quantum key agreement algorithms supported in TLS 1.3 at Cloudflare's edge: - One based on lattices (NTRU-HRSS: big key, low CPU) - One based on isogenies (SIDH: small key, high CPU)

I left Apple 7 years ago. My code is still running in every iPhone and Mac on the planet. I wish it wasn’t, and that’s partially my fault. When you put code into the world, think about how to write it in a way that it can replaced with something better.

I am very excited for the final publication of RFC 8446, aka TLS 1.3

We deployed two post-quantum (aka quantum-resistant as far as we know) key agreement algorithms in TLS 1.3: one fast with big keys (ostrich) and one slow with smaller keys (turkey) and ran an experiment with Chrome to race them. Here are the results. blog.cloudflare.com/the-tls-…

RFC 8565 is especially brilliant. The HyperText Jeopardy Protocol (HTJP) inverts the request/response semantics of the Hypertext Transfer Protocol (HTTP) [..] Using HTJP, one connects to a server, sends an answer, and expects a correct question.

I wrote a blog post about why TLS 1.3 isn't in browsers yet: blog.cloudflare.com/why-tls-… @Lekensteyn built a tool to help investigate TLS 1.3 failures due to middlebox interference: tls13.mitm.watch Let's make 2018 the year of TLS 1.3

The Cloudflare Crypto team is working on a bunch of assembly-heavy (x86_64/ARM64) cryptography code in Go. This includes high-speed elliptic curves of various flavors (NIST, CFRG, MSFT, Pairing-friendly), post-quantum crypto, hashing. We're soliciting reviewers. DM for details.

It’s hard to overstate how bad this F5 bug is. It’s basically DROWN without needing SSLv2. If you have a vulnerable F5, anyone can sign things with your RSA private key. Bleichenbacher strikes again. support.f5.com/csp/article/K…

New Directions in Cryptography - Whitfield Diffie and Martin Hellman (1976) It's hard to emphasize just how revolutionary the concept of public key cryptography is. This paper started it all, introducing D-H key agreement and digital signatures. ee.stanford.edu/~hellman/pub…

The 1.1.1.1 resolver also implements the latest privacy-enhancing standards such as DNS-over-TLS, DNS-over-HTTPS, QNAME minimization, and it removes the privacy-unfriendly EDNS Client Subnet extension. We’re also working on new standards to fix issues like dnscookie.com

Awesome work at the IETF 102 hackathon by the encrypted SNI team consisting of folks from @Cloudflare @fastly @mozilla and @apple. There are now implementations in BoringSSL, NSS and picotls. Working servers are live at esni.examp1e.net and cloudflare-esni.com.

Understanding How Facebook Disappeared from the Internet by @tstrickx and @celso. blog.cloudflare.com/october-…

Please don't do this when you visit Cloudflare.

If you're going to impress us with factoring RSA public keys, factor one from the RSA Factoring Challenge. If you can factor the original 1991 RSA-2048 modulus by the end of the year, I'll match the original cash prize of $200,000. Show your work. en.wikipedia.org/wiki/RSA_nu…

DNS interception and manipulation is real and pervasive. This paper is a great motivator for the deployment of encrypted DNS and DNSSEC. #usesec18 Who Is Answering My Queries: Understanding and Characterizing Interception of the DNS Resolution Path usenix.org/conference/usenix…

Having encrypted DNS enables so many cool things online. For example, we have a new proposal for encrypting SNI that we'll be talking about at #IETF102. Here's the draft: tools.ietf.org/html/draft-re…

In case you missed it, we built a TypeScript library to do zero-knowledge proofs over ECDSA signatures. ECDSA is ubiquitous, so there are potentially thousands of interesting real-world applications including adding privacy to WebAuthn attestation. github.com/cloudflare/zkp-ec…

Reflections on Trusting Trust - Ken Thompson (1984) This paper succinctly describes the concept that it's not enough to trust software, you also need to trust the software that compiles the software, and the software that compiles the compiler, and so on archive.ece.cmu.edu/~ganger/…

I have an exciting update to share! Starting today, I'm available for 1:1 calls on Intro to help the next generation of startups. Keep reading ⬇️ For those who don’t know me yet, I’m a Computer Security and Cryptography Expert, the founder of Cloudflare Research, and was a senior engineer at Apple who helped build the iTunes Store. Schedule a call if you want advice on: ✔️ Building a successful technology research team within your organization ✔️ How to solve technical problems in security, privacy, cryptography and cloud infrastructure ✔️ How to prepare your organization for quantum computers by transitioning to post-quantum cryptography ✔️ General advice on software engineering best practices and hiring ✔️ & more Want to hop on a 15-min call this week? Book a 1:1 with me here: intro.co/nicksullivan

It's my seven(!) year anniversary at @Cloudflare today. I'm grateful for all the people I've met along the way and all the important work we've been able to do. That said, I feel like I'm just getting started.

This has been really fun to work on. @Cloudflare is now trialing a way to solve CAPTCHAs with a press of a FIDO2 security key (like a Yubikey). blog.cloudflare.com/introduc…

Cloudflare now supports TLS 1.3 for the connection between Cloudflare and the origin server, enabled by default. There were issues with certain load balancers not handling the RFC version of the protocol, but these are mostly fixed. Non-trivial speed boost for dynamic content.

Cloudflare is officially seeing more TLS 1.3 traffic than TLS 1.1 traffic. The first of many exciting TLS 1.3 milestones this week.

Welcome to #CryptoWeek at @Cloudflare! Kicking it off with an introduction by me: blog.cloudflare.com/crypto-w… The Distributed Web Gateway (starring IPFS): blog.cloudflare.com/distribu… IPFS Gateway Validator extension: blog.cloudflare.com/e2e-inte… Stay tuned every day for new announcements!

With the recent SHA-1 news, it’s important to understand why collisions and chosen-prefix attacks have different impacts on security. Luckily I wrote a blog post about this! blog.cloudflare.com/why-its-…

What an interesting few weeks to be working at @Cloudflare, especially on the blog. Well, don’t think we’re letting up. If you live for technical blog posts, block off a few hours and dust off your reading glasses because you’re in for a treat next week.

Dear Ethereum researchers, Cloudflare is very interested in working with you on how to bridge the gap between the traditional and decentralized internet. Here’s a blog post about some of our work from earlier this year: blog.cloudflare.com/crypto-w…

This is why we use one of them for our physical RNG in @Cloudflare London.

Today's my six year anniversary at @Cloudflare. Thank you to everyone who has been a part of this incredible run. There have been too many highlights to count, but if you'd like to stroll down memory lane for a bit, keep reading.

The best explainer I've seen on DNS privacy, from @linclark of @mozilla. DNS over HTTPS + Trusted Recursive Resolver (powered by @1111Resolver). hacks.mozilla.org/2018/05/a-…

I'm happy to share our approach to technology research at Cloudflare in my new capacity as head of research. blog.cloudflare.com/cloudfla…

We’re at an interesting point in history with respect to internet protocols. TLS 1.3, DoH, Wireguard, HTTP/2 CERTIFICATE frame, MLS, and others are changing the game but aren’t widely deployed yet. Support your local e2e encrypted network protocol.

Some people say DNSSEC is useless. Recent events have convinced me otherwise. Since BGP hijacking is prevalent and the deployment of TLS-protected DNS protocols is focused on the user-to-resolver path (rather than resolver to authoritative), DNS poisoning is a real threat.

Don’t you mean

Monsters in the Middleboxes: a new blog post by @gabbifish and @lukevalenta highlighting recent work on the measurement of TLS-inspecting proxies. We also open sourced our code (github.com/cloudflare/mitmen…) and built a dashboard (malcolm.cloudflare.com/). blog.cloudflare.com/monsters…

Privacy has deservedly become a bit of a buzzword online. There are more opportunities to watch, profile, and surveil Internet users than ever. This is a growing concern as our lives and our stuff (there are more net-connected devices than people on earth) move online.

And it looks like they're blocking encrypted SNI outright (according to accounts on the ground). In some ways, this is our fault for not agreeing on a final spec and pushing it out to more clients faster. The politics around network privacy engineering are tricky. Cliffs abound.

This World of Ours - James Mickens (2014) A comedic article that helps emphasize the difference between targeted attacks by well-resourced adversaries and the more pedestrian threats faced by the general populace. usenix.org/system/files/1401…

There’s been a lot of noise around new DNS encryption technologies lately, including DNS-over-TLS (DoT) and DNS-over-HTTPS (DoH). This explainer by @Lekensteyn cuts through the noise with a clear explanation of how these technologies work. blog.cloudflare.com/dns-encr…

We are now in the exciting early adopter phase of the post-quantum cryptography transition. The last year has seen some major developments. In November 2022, Google deployed post-quantum cryptography for internal communications (cloud.google.com/blog/produc…) and then by August 2023, post-quantum cryptography was being rolled out within the Chrome browser (blog.chromium.org/2023/08/pr…), marking a significant milestone in securing web traffic against the quantum threat. Concurrently, Cloudflare, which underpins a significant portion of the web, introduced PQ cryptography compatible with Chrome and announcer today that they use it for internal communications and communication to origin servers (blog.cloudflare.com/post-qua…). This means by the end of this year, a substantial percentage of web traffic could be safeguarded by post-quantum cryptography using proposed standards by NIST (csrc.nist.gov/pubs/fips/203/…)! The transition to post-quantum cryptography is not just a technological shift, but a critical step towards ensuring long-term data safety. As businesses, transitioning both internal and external-facing services to support post-quantum cryptography is imperative. NIST has provided insightful guidance for businesses on how to approach this transition: csrc.nist.gov/pubs/sp/1800/3…

Some of the loudest complaints we hear about Cloudflare from folks on Twitter are about two things: end-to-end integrity and access through Tor. Next week we’ll be announcing two innovative new features to help resolve these issues. #CryptoWeek

This was literally taken from the Cloudflare office and put on display in the Science Museum in London. Amazing!

HTTP is slow, HTTPS is fast. Nice article by @troyhunt. troyhunt.com/i-wanna-go-fast…

Over 5% of HTTPS requests to Cloudflare use TLS 1.3. Getting to 50% of browser requests is possible by the end of the year. We're changing the defaults to get more sites on board. blog.cloudflare.com/you-get-…

It's all coming together for TLS 1.3 Draft 23. We've enabled it on Cloudflare, Chrome and Firefox support is landing imminently, and the working group has declared another Last Call mailarchive.ietf.org/arch/ms…

Having both DoH (DNS-over-HTTPS) and DoT (DNS-over-TLS) is great. DoH is fantastic for browser clients who already implement HTTP/2 and all its multiplexing machinery, and DoT is perfect for the DNS backend. I look forward to more authoritative DNS servers supporting DoT.

Return-Oriented Programming - Solar Designer (1997) A new attack methodology that revolutionized offensive security. seclists.org/bugtraq/1997/Au…

As IETF 101 convenes in London, TLS 1.3 use on the internet soar. We're now seeing 2% of global connections to Cloudflare use TLS 1.3! This is mostly due to Chrome 65 enabling TLS 1.3 by default. #tls13

It’s Crypto Week again at @Cloudflare! We’re very excited to share a week of cryptography-related announcements. As a warm up, I wrote a post outlining why we do Crypto Week and some thoughts on securing the Internet of the future. Enjoy. blog.cloudflare.com/welcome-…

Thread One of the perks of working at @Cloudflare is that technical people are encouraged to share their voice with the public on the company blog. Generous coworkers donate time, energy, and expertise to enable these amazing builders to teach and explain for the benefit of all.

Cloudflare's public time service, time.cloudflare.com, is now serving over 1 million NTP requests per second at peak! It's been less than a year since the service was launched. ⌚️⌚️⌚️

Fans of certificate transparency and internet routing, we created a new CT log for the RPKI. Check it out here: ct.cloudflare.com/logs/cirru…

Improving SSL Warnings: Comprehension and Adherence - Adrienne Porter Felt et al. (2015) A data-driven study of how well/poorly user interfaces express security features to users in web browsers. dl.acm.org/citation.cfm?id=2…

I’ll be tweeting about some post-quantum crypto things as the come up this week in this thread.

Thread. Big announcement from Cloudflare today: we have opened our post-quantum cryptography alpha. We now support Kyber, a post-quantum key agreement in Cloudflare’s reverse proxy product and we want you to help test it with us. blog.cloudflare.com/experime…

Lest We Remember: Cold Boot Attacks on Encryption Keys - J. Alex Halderman et al. (2008) Another security paper that explores the reasons why good encryption software can be insufficient in the face of physical attacks. jhalderm.com/pub/papers/cold…

My coworkers are amazing. You can find this at 6th and Howard in SF. #cryptomeanscryptography

You can now go HTTPS-only with a single click on @Cloudflare. blog.cloudflare.com/how-to-m…

Even modern cryptographic protocols like TLS 1.3 are vulnerable to weak randomness in the underlying system. This risk can be mitigated in a general way using a secret key. Just use “this one weird trick” described by @CasCremers, myself, et al. eprint.iacr.org/2018/1057

"The Security Impact of HTTPS Interception" led by @zakirbpd, with @_aaspring_, @rlbarnes, @pzb, myself and others. zakird.com/papers/https_inte…

Format String Attacks - Tim Newsham (2000) Still one of the most pervasive security issues, format string vulnerabilities demonstrate the dangers of mixing abstractions. forum.ouah.org/FormatString.…

New from the TLS meeting at IETF 117: Encrypted Client Hello (ECH) is enabled for 1% of Chrome stable users. A big step for privacy online! datatracker.ietf.org/doc/dra…

PSA: @Cloudflare’s WARP is *not* a VPN as the term is popularly used. It does not make you anonymous to the sites you are visiting. It does, however, encrypt your traffic so your local network and ISP can’t see it, providing enhanced privacy. Even for unencrypted HTTP and DNS!

It turns out there were printers running a “theorized” NSA backdoor into RSA’s TLS library, and this was discovered because people were searching for TLS 1.3-incompatible implementations and there just happens to be a namespace collision.

An under-the-radar new feature from @Cloudflare for sites with custom domains on shared hosting (such as Github pages or Heroku). You can now enable certificate validation (Strict mode) and Cloudflare will use the CNAME target to validate the cert. support.cloudflare.com/hc/en…

Technical writing at @Cloudflare wouldn't be what it is without @jgrahamc, who always brings great perspective to even the most in-the-weeds technical topic.

I just presented a new HTTP header at #IETF102 developed with @Akamai and @Fastly to prevent CDN looping attacks like icir.org/vern/papers/cdn-loo…. We’re looking for other reverse proxies/CDNs to collaborate. Let’s work together to fix common problems! tools.ietf.org/html/draft-cd…

Day 4 of #CryptoWeek: Cloudflare launches its own Onion service on Tor for customers. This is a huge deal: it reduces friction for people using Tor while still allowing Cloudflare to block bots. Powered by alt-svc: no .onion certificate required! blog.cloudflare.com/cloudfla…

If Zoom announces their own half-baked crypto protocol for group key agreement instead of announcing a plan to dedicate resources to help MLS be the best it can be, I consider this a failure. We need *one* open and well-vetted standard with solid libraries, not another me-too.

That’s right. DNS over SMS. Text +1-833-672-1001 to get your DNS fix.

To emphasize the need for secure time for HTTPS, I worked with researchers to measure the reliability of certificate revocation (OCSP) servers: the results were mixed. We need short-lived credentials. crypto.dance/projects/695265… (To be published at ACM IMC 2018) #CryptoWeek

Exported Authenticators is now RFC 9261. Thanks to everyone who contributed! rfc-editor.org/rfc/rfc9261.h…

Programming Satan’s Computer - Ross Anderson and Roger Needham (1995) An exploration of the adversarial models needed to build secure software. cl.cam.ac.uk/~rja14/Papers/s…

An exploit is not a weapon, it is a proof.

SAD DNS, the new DNS cache poisoning attack from CCS 2020 explained by @vavrusam and me blog.cloudflare.com/sad-dns-…

You can now access the Ethereum network through @Cloudflare via HTTP using the Distributed Web Gateway at cf-eth.com. You can also create your own gateways using any hostname of your choosing. #CryptoWeek blog.cloudflare.com/cloudfla…

It's official, SSL is dead: rfc-editor.org/rfc/rfc7568.t…

Thread Real World Crypto 2020 is upon us. RWC is the marquee applied cryptography conference, bringing together academia and industry (51% of attendees have no academic affiliation). It's the largest RWC ever with 642 attendees. Talk summaries to follow. #realworldcrypto

I was chatting with a friend of mine who hires engineers who told me that in their company's hiring process they have an explicit focus on assessing the candidate's "grit" during the interview process.