Cryspen

Contact us

Sat, 04 Jul 2026 00:00:00 +0000

You can also find us here:

Announcing CE Labs

Thu, 25 Jun 2026 00:00:00 +0000

Today, we are announcing the launch of CE Labs, a Cryspen spin-off dedicated to Cryptographic Engineering, under the leadership of Franziskus Kiefer. Learn more about CE Labs here.

Going forward, Cryspen will be led by Karthik Bhargavan and will focus on building usable formal verification tools, helping users apply them on real-world software, and working towards a new product funded by an EIC Transition Grant called Spectrum.

Cryspen and CE Labs are continuing their close collaboration at the intersection of formal verification and cryptography. This partnership allows CE Labs to build high-assurance software using Cryspen’s tools, while Cryspen uses CE Labs’ production code to refine and optimize its verification suite.

EIC Transition: Spectrum

Thu, 25 Jun 2026 00:00:00 +0000

We are excited to have been awarded a Transition Grant from the European Innovation Council to build a specification and verification toolkit that developers can use to build and deploy provably-secure software. The project is called Spectrum and it builds on our hax open-source framework.

In the coming months, we will describe how we and our customers use the Spectrum tools on a daily basis to design and implement security-critical systems. If you would like to know how Spectrum can help you, get in touch.

Spectrum

Thu, 25 Jun 2026 00:00:00 +0000

Does your team use AI coding agents to write your software? How confident are you that the agent built what you actually intended, and that it didn’t introduce security vulnerabilities along the way? How can you check that the generated code complies with your security and privacy policies?

More and more developer teams now use AI agents to build complex software at scale and at speed. The bottleneck is specification and review, which requires domain expertise and is error-prone, allowing correctness bugs and security flaws to slip into the codebase. As frontier AI models get better at finding and exploiting vulnerabilities, there is a pressing need for methodologies to develop software systems that are secure-by-design and secure-by-default.

Software Verification in Lean

Wed, 22 Apr 2026 00:00:00 +0000

This week in Paris, Cryspen is delighted to be co-hosting Software Verification in Lean 2026, a workshop and associated hackathon organized by the Beneficial AI Foundation and the Lean FRO.

SVIL 2026 brings together leading researchers and practitioners working on using the Lean proof assistant to formalize and verify real-world software. On Monday, I gave a talk on the challenges of verifying cryptographic applications, and the opportunities that are being opened up by the rapid innovations in Lean and by the emergence of AI-assisted formal proofs.

The strengths and limits of formal verification

Thu, 12 Feb 2026 00:00:00 +0000

I have learned that it is important to be precise when documenting the guarantees offered by formally verified code, and to resist the temptation of simplifying things too much in trying to reach a larger audience. In my talks, to my students, and to our users and customers, we always clearly describe our coding, testing, and verification methodologies, explain what we verify and against what specifications, elaborate our trust assumptions, and detail the limitations of our approach.

PSQ: Post-Quantum Shared Secrets Made Easy

Mon, 02 Feb 2026 00:00:00 +0000

We’re pleased to announce the PSQ protocol for establishing a hybrid post-quantum shared secret between two parties.

Cryptographic protocols, which exclusively rely on classical public key cryptography for establishing shared secrets, may be vulnerable to harvest-now-decrypt-later (HNDL) quantum attacks. However, many protocols in widespread use today allow injecting a previously established pre-shared key (PSK) into the computation of the shared secret. If we can establish this pre-shared key in a way that is secure against HNDL attackers, we can provide an easy way of protecting many applications without having to touch their internals.

Cryspen Welcomes Alex

Mon, 10 Nov 2025 00:00:00 +0000

This month, we welcome Alexander Bentkamp (Alex) as the newest member of our team.

Alex joins us with a strong background in automated and interactive theorem proving, where his passion for formal proofs has driven a series of influential contributions. He completed his PhD at the Vrije Universiteit Amsterdam under the supervision of Jasmin Blanchette, Uwe Waldmann, and Wan Fokkink, developing a novel proof automation method for higher-order logic. The prover he co-developed based on this method went on to win the annual CASC competition multiple times and is now integrated into the Isabelle/HOL proof assistant.

Formally Specifying and Testing the Rust Standard Library

Tue, 28 Oct 2025 00:00:00 +0000

Modern programming languages typically come with a large standard library that implements essential language features like machine arithmetic and I/O, offers efficient data structures, provides interfaces to system libraries, etc. Although it is often overlooked, this standard library should be considered as much part of the trusted computing base (TCB) as the language compiler. Indeed, any bug in the standard library is likely to break applications and could result in security vulnerabilities.

Helping Secure Signal's Post-Quantum Transition

Thu, 02 Oct 2025 00:00:00 +0000

Signal just announced the deployment of their new post-quantum ratcheting protocol, called the Sparse Post-Quantum Ratchet (SPQR), and Cryspen is proud to have contributed to the formal analysis of the design and implementation of this new Signal feature.

The seeds of our collaboration with Signal reach back to 2023, when Signal first published PQXDH, the post-quantum key establishment protocol that marked the beginning of Signal’s post-quantum transition. We helped Signal to formally analyze and improve PQXDH, resulting in a paper at Usenix Security. This time, Cryspen and Signal agreed to collaborate from the very beginning of the design process for SPQR all the way through to its implementation.

PQC Support for JZLint

Mon, 11 Aug 2025 00:00:00 +0000

We joined forces with MTG AG, a leader in public key infrastructures, to release JZLint 2.0 with support for analyzing post-quantum (PQC) certificates and their public keys.

JZLint 2.0 is a certificate linter that plays a crucial role in the issuance of digital certificates. Linting involves checking certificates for errors and ensuring their conformance to relevant specifications. This vital step is performed by public certificate authorities (CAs) to ensure compliance with technical standards and security requirements before the certificates are issued. Tools like JZLint play an essential role in the transition to post-quantum secure cryptography.

Research

Mon, 14 Jul 2025 00:00:00 +0000

We work with our colleagues in academia and industry to extend the state-of-the-art in software verification and security analysis. We regularly publish and present our research in peer-reviewed conferences and workshops.

Presentations

Real World Crypto 2025: Using Formally Verified Post-Quantum Algorithms at Scale. Lucas Franceschino with Andres Erbsen. (Slides, Video)
VSTTE 2024: High Assurance Post Quantum Cryptography (Invited Talk). Karthikeyan Bhargavan. (Slides)
CRYPTO 2024: Formal Methods for Cryptography: protocols, standards, implementations (Invited Talk). Karthikeyan Bhargavan. (Slides, Video)
Real World Crypto 2024: An Analysis of Signal’s PQXDH. Karthikeyan Bhargavan with Rolfe Schmidt. (Slides, Video)
NIST Workshop on Formal Methods within Certification Programs 2024: Formal Specifications for Certifiable Cryptography. Karthikeyan Bhargavan. (Slides)
RustVerify 2024: Enabling High Assurance Cryptographic Software. Jonas Schneider-Bensch. (Slides)
Real World Post Quantum Cryptography 2024: Verified ML-KEM in Rust and C using hax. Franziskus Kiefer. (Slides
Open Source Crypto Workshop 2024: Cryptography with Formal Guarantees using hax. Franziskus Kiefer. (Slides, Video)
MatchPoints 2024: High Assurance Post Quantum Cryptography. Karthikeyan Bhargavan. (Slides)

Papers

2026

Project Everest: Perspectives from Developing Industrial-Grade High-Assurance Software. Danel Ahman, Karthikeyan Bhargavan, Barry Bond, Jay Bosamiya, Christopher Brzuska, Antoine Delignat-Lavaud, Cédric Fournet, Aymeric Fromherz, Sydney Gibson, Chris Hawblitzel, Cătălin Hrițcu, Markulf Kohlweiss, Guido Martínez, Haobin Ni, Bryan Parno, Jonathan Protzenko, Tahina Ramananandro, Aseem Rastogi, Exequiel Rivas, Nikhil Swamy and Santiago Zanella-Béguelin. ACM Transactions on Programming Languages and SystemsVolume 48, Issue 2. June 2026.

2025

Functional Verification of Cryptographic Protocol Implementations in Rust. Karthikeyan Bhargavan, Lasse Letager Hansen, Franziskus Kiefer, Jonas Schneider-Bensch, Bas Spitters. ACM SIGSAC Conference on Computer and Communications Security (CCS) 2025 (Paper)
A Mechanically Verified Garbage Collector for OCaml. Sheera Shamsu, Dipesh Kafle, Dhruv Maroo, Kartik Nagar, Karthikeyan Bhargavan, K. C. Sivaramakrishnan. Journal of Automated Reasoning. 69(2): 11 (2025). (Paper)
KyberSlash: Exploiting secret-dependent division timings in Kyber implementations.
Daniel J. Bernstein, Karthikeyan Bhargavan, Shivam Bhasin, Anupam Chattopadhyay, Tee Kiah Chia, Matthias J. Kannwischer, Franziskus Kiefer, Thales B. Paiva, Prasanna Ravi, Goutam Tamvada. IACR Transactions on Cryptographic Hardware and Embedded Systems. 2025(2): 209-234 (2025) (Paper)
TreeKEM: A Modular Machine-Checked Symbolic Security Analysis of Group Key Agreement in Messaging Layer Security. Theophile Wallez, Jonathan Protzenko, Karthikeyan Bhargavan. Symposium on Security and Privacy: 4375-4390 (2025) (Paper)
Public Key Linting for ML-KEM and ML-DSA. Evangelos Karatsiolis, Franziskus Kiefer, Juliane Krämer, Mirjam Loiero, Christian Tobias, Maximiliane Weishäupl. Workshop on Secure Protocol Implementations in the Quantum Era (2025) (Paper)

2024

hax: Verifying Security-Critical Rust Software Using Multiple Provers. Karthikeyan Bhargavan, Maxime Buyse, Lucas Franceschino, Lasse Letager Hansen, Franziskus Kiefer, Jonas Schneider-Bensch, Bas Spitters. Verified Software. Theories, Tools and Experiments (VSTTE) 2024: 96-119. (Paper)
Formal verification of the PQXDH Post-Quantum key agreement protocol for end-to-end secure messaging. Karthikeyan Bhargavan, Charlie Jacomme, Franziskus Kiefer, Rolfe Schmidt: USENIX Security Symposium 2024 (Paper)

2023

Comparse: Provably Secure Formats for Cryptographic Protocols. Theophile Wallez, Jonathan Protzenko, Karthikeyan Bhargavan. ACM SIGSAC Conference on Computer and Communications Security (CCS) 2023: 564-578. (Paper)
Layered Symbolic Security Analysis in DY* Karthikeyan Bhargavan, Abhishek Bichhawat, Pedram Hosseyni, Ralf Kuesters, Klaas Pruiksma, Guido Schmitz, Clara Waldmann, Tim Wuertele. ESORICS (3) 2023: 3-21 (Paper)
From Dragondoom to Dragonstar: Side-channel Attacks and Formally Verified Implementation of WPA3 Dragonfly Handshake. Daniel De Almeida Braga, Natalia Kulatova, Mohamed Sabt, Pierre-Alain Fouque, Karthikeyan Bhargavan. IEEE European Symposium on Security and Privacy (EuroS&P) 2023: 707-723. (Paper)
TreeSync: Authenticated Group Management for Messaging Layer Security. Jonathan Protzenko, Benjamin Beurdouche, Karthikeyan Bhargavan. USENIX Security Symposium 2023: 1217-1233. Awarded the Internet Defense Prize and a Distinguished Paper Award. (Paper)

2022

A Symbolic Analysis of Privacy for TLS 1.3 with Encrypted Client Hello. Karthikeyan Bhargavan, Vincent Cheval, Christopher A. Wood. ACM SIGSAC Conference on Computer and Communications Security (CCS) 2022: 365-379. (Paper)
Hybrid Public Key Encryption. Richard L. Barnes, Karthikeyan Bhargavan, Benjamin Lipp, Christopher A. Wood. IETF RFC 9180: 1-107 (2022) (Standard)
Noise*: A Library of Verified High-Performance Secure Channel Protocol Implementations. Son Ho, Jonathan Protzenko, Abhishek Bichhawat, Karthikeyan Bhargavan. IEEE Symposium on Security and Privacy (S&P) 2022: 107-124. (Paper)

Get in touch

Tooling for Automated Benchmarking and Visualization

Tue, 08 Jul 2025 00:00:00 +0000

Maintaining peak software performance is a critical aspect of our development process, and early regression detection is non-negotiable. At Cryspen, we’ve addressed this by implementing an automated, multi-platform benchmarking system. This post will detail the enhancements we’ve made to our workflows, allowing us to preemptively identify performance issues. Besides focusing on algorithm benchmarks, we utilize a tracing strategy for our protocol code. This method allows us to measure performance on live code. In addition, we will explore the tools and methods designed for creating comprehensive, informative visualizations of benchmark data, applicable to our wide range of projects and repositories.

Cryspen Welcomes Clement

Tue, 13 May 2025 00:00:00 +0000

The team here at Cryspen is thrilled to welcome to our newest member, Clement!

Clement joins us fresh from his impressive journey as a PhD student at Inria Paris, where he was part of the Cambium team. His doctoral work focused on the formalization of the powerful but intricate typing system of OCaml modules. Under the supervision of Didier Rémy and Gabriel Radanne, Clement delved deep into the theoretical underpinnings of this masterpiece of language design.

MLS Group State Forks: What, Why, How

Thu, 03 Apr 2025 00:00:00 +0000

Group state forks are faulty states that MLS groups can end up in. This article looks at what they are exactly, how that happens and how to resolve them. We also look at a new OpenMLS feature that makes fork resolutions a little easier.

Over time, an MLS group evolves its group state. Whenever a new member is added, or another is removed, or a group extension is added or someone updates their encryption keys, the state must be changed. The versions that a group evolves throughout its lifetime are called epochs and identified by a counter value.The way this works is that first a number of requested state changes (proposals in MLS terminology) are collected (“Add Dora”, “This is my new key”, …) and then applied in a big update (called commit in MLS). Once a commit is applied, the group state is changed and the group epoch counter is incremented.

Cryspen @ RWC 2025

Thu, 27 Mar 2025 00:00:00 +0000

Real World Crypto 2025 buzzed with energy as the cutting edge of cryptography was presented to and discussed among an audience of leading researchers and developers from academia and industry. Today, on the second day of the conference, Cryspen teamed up with Google to showcase practical, scalable, verified solutions for high-assurance software and post-quantum cryptography.

Verified Post-Quantum Crypto at Scale

Our joint talk with Google described our collaboration on developing an efficient, SIMD-optimized implementation of the ML-KEM standard in Rust and C. This wasn’t just about writing code; it was about proving its correctness through rigorous formal verification. We demonstrated how verified cryptography can be implemented at scale, a critical advancement for securing our digital infrastructure. Our verified implementations are already powering security-critical software projects like OpenSSH, Firefox, and Signal.

Control flow analysis with hax

Wed, 26 Mar 2025 00:00:00 +0000

A difficulty of formal verification is that specifying programs can be hard. Certain kinds of programs can end up having a specification that is as complex as the code itself. In this case it is better to focus on more interesting and understandable properties rather than an equivalence proof with a specification.

For example, showing that before calling one function you always call another function (imagine a validation function). Indeed, forgetting a validation step can lead to severe vulnerabilities (see this example of a vulnerability because of a missing signature check).

Cryspen Welcomes Clara

Mon, 10 Feb 2025 00:00:00 +0000

We’re thrilled to officially welcome Clara to the Cryspen team! Clara brings a fantastic blend of experiences and a passion for open-source that aligns perfectly with our mission. Let’s get to know her a little better.

Clara recently graduated from TU Berlin with a B.Sc. in Computer Science. She’s gained valuable experience porting C code and Linux systems software to Rust, including porting libxkbcommon to safe Rust. She’s also explored game emulator development and low-level programming.

X25519MLKEM768 TLS-Handshake in Bertie

Thu, 19 Dec 2024 00:00:00 +0000

Summer is over for some months on the northern hemisphere, and so is the draft phase of NISTs post-quantum cryptographic standards. Since August 13, 2024, FIPS has standardized Kyber as ML-KEM in FIPS 203 for PQ encryption, Dilithium as ML-DSA and SPHINCS+ as SLH-DSA in FIPS 204 and FIPS 205, respectively, for PQ digital signatures. Read more on how we at Cryspen are building formally verified implementations of these standards, previously on this blog.

In parallel, the IETF has worked on integrating the new standards, in particular ML-KEM into existing Internet standards. Part of that is standardizing hybrid post-quantum key agreements that can be used in the TLS 1.3 handshake.

Cryspen @ VSTTE 2024

Mon, 14 Oct 2024 00:00:00 +0000

Verified Software: Theories, Tools, and Experiments is a conference that aims to advance the state of the art in software verification.

At VSTTE 2024 in Prague, Karthik spoke about how formal verification can be used to speed up software development and clarify the security of real-world cryptography from design to implementation. In particular, he showed how these techniques are crucial for the post-quantum transition, using examples from our analysis of post-quantum protocols like PQXDH and our verified ML-KEM implementation.

Cryspen @ Crypto 2024

Tue, 20 Aug 2024 00:00:00 +0000

Crypto is the top international conference on cryptography and is held every year (since 1981) in Santa Barbara, California. This year, Crypto invited Karthikeyan Bhargavan, our Chief Research Scientist, to give a talk on the use of formal methods in cryptography.

Karthik spoke about the state of the art in formal analysis techniques for crypto, and how we can use them to increase confidence in important protocols like PQXDH, TLS, and MLS. He also spoke about how we at Cryspen use hax to build verified post-quantum cryptographic libraries like libcrux.

Formally Verified Post-Quantum Cryptography

Mon, 19 Aug 2024 00:00:00 +0000

The US National Institute of Standards and Technology (NIST) just released the first three standards for Post-Quantum KEMs (ML-KEM) and Signatures (ML-DSA, SLH-DSA). This first official publication of Post-Quantum Cryptography (PQC) standards represents a significant step forward in securing the Internet, and organizations across the globe, against the future threat of quantum computers.

At Cryspen, we have been developing formally verified open-source implementations of post-quantum cryptographic algorithms in Rust using the hax toolchain. Our implementations are verified to be panic free, functionally correct, and secret independent. Indeed, our verification of Kyber already uncovered vulnerabilities that were found to be present and exploitable in multiple Kyber implementations.

Announcing the hax Playground

Wed, 14 Aug 2024 00:00:00 +0000

We’re proud to announce the hax playground! Inspired by the Rust Playground, the hax playground allows you to play with hax directly in your web browser!

Try it now on https://hax-playground.cryspen.com 🚀

The hax playground provides a first glimpse at Cryspen’s upcoming verification workbench! From the playground, you can:

Run the hax toolchain on your Rust code to see the F*, Coq or ProVerif output
Run the F* typechecker to verify the generated F* code
Inspect Rust internal ASTs interactively
Share snippets with others
Submit issues to the hax repository on GitHub

We believe such a playground can be a great and useful tool, whether it be for newcomers, for people that already use hax, for hax developers, but also for people interested in Rust in general!

Cryspen Welcomes Maxime

Tue, 06 Aug 2024 00:00:00 +0000

We’re thrilled to announce that Maxime Buyse has joined the Cryspen team as a Formal Verification Engineer! 🎉

Maxime is a whiz when it comes to formal methods, software verification, compilers, and functional programming. His expertise will be instrumental in supercharging our tools like hax and making them even easier to use.

We’re excited to have someone of Maxime’s caliber join our team. His passion for building top-notch software aligns perfectly with our mission. With his help, we’re confident in pushing the boundaries of high assurance software.

High Assurance IoT PQC

Mon, 05 Aug 2024 00:00:00 +0000

Together with our sister-company CryptoEng, we extend our libcrux cryptographic library with support for resource constrained IoT devices. Read their announcement here. The libcrux-iot library contains high performance, high assurance implementations of post-quantum, as well as classical, cryptographic primitives.

Reach out if you are interested in licensing the libcrux-iot library to secure your connections with high-performance, high-assurance post-quantum cryptography.

Cryspen @ FMCP 2024

Sun, 28 Jul 2024 00:00:00 +0000

The US National Institute of Standards and Technology (NIST) publishes a number of important cryptographic standards (including upcoming ones for post-quantum cryptography), and runs the cryptographic algorithm and module validation programs that validate and issue certificates to cryptographic libraries.

Last week, at the National CyberSecurity Center of Excellence in Maryland, NIST hosted a workshop on Formal Methods within Certification Programs. The idea behind the workshop was to bring together formal methods researchers and practitioners (like ourselves) with various certification labs and the NIST validation teams, with the goal of investigating how formal methods could be used to improve certification processes.

Unlocking New Possibilities

Fri, 19 Jul 2024 00:00:00 +0000

We have been developing the hax toolchain over the last two years, in collaboration with research teams at Inria and the University of Aarhus. To showcase its capabilities we have successfully applied it to ML-KEM and Bertie. Others are using it to create new ground-breaking research results.

Key benefits of using hax:

Uncover potential bugs and vulnerabilities early: Hax’s rigorous formal analysis can identify potential errors and security flaws before they reach production, saving you time and resources.
Reduce development time and costs: By formally verifying your code, you can reduce the need for manual testing and reduce the risk of regressions.
Gain a competitive edge: Demonstrate the high quality and reliability of your software to your customers and partners.

Today, we’re announcing a collaboration with SandboxAQ to help them verify their software using hax. We are excited to see what new applications we come up with together and how we can evolve hax to be directly usable by software engineers. Read SandboxAQ’s post on the collaboration here.

Post-Quantum TLS in Bertie

Wed, 03 Jul 2024 00:00:00 +0000

The prospect of quantum computers breaking most public key encryption in use today has created the need for new schemes that can resist classical and potential quantum attackers alike. Some of these schemes, such as ML-KEM and ML-DSA, are currently in the final stages of standardizations by NIST. Before fully transitioning to post-quantum secure cryptography, an important first step many organizations are taking is protecting against Harvest Now Decrypt Later (HNDL) attacks, where data is collected and stored today, and later decrypted once cryptanalysis improves. Signal recently introduced PQXDH, which protects against these attacks. Google’s Chrome browser is using the X25519Kyber768Draft00 hybrid KEM cipher suite in TLS, which combines a post-quantum secure KEM with the classical key exchange. Cloudflare, which is serving a big chunk of the internet, supports it as well.

Cryptographic protocol verification with hax

Wed, 05 Jun 2024 00:00:00 +0000

This blog post details an example of how to use our hax toolchain for verifying the security of cryptographic protocol implementations written in Rust.

When building high-assurance software, we use different verification techniques with different goals.

One goal is to prove implementation correctness. In this case the code in question is proven to be free of panics, or that the optimizations that it uses preserve conformance to a higher-level mathematical specification. hax is well-suited to doing this type of verification, by extracting a model of the code in F*. A recent example of this approach is our verified implementation of ML-KEM (Kyber). You can read more details about the verification effort in a separate blog post.

Conference Talks

Tue, 23 Apr 2024 00:00:00 +0000

Cryspen attended a number of conference in April and March. Here is a list of all slides and videos.

We will update links when more resources become available.

RWC

RWC 2024 took place in Toronto, Canada 🇨🇦 on March 25–27, 2024. RWC 2024 was organized by the International Association for Cryptologic Research (IACR).

We presented together with Rolfe from Signal on “An Analysis of Signal’s PQXDH”.

Slides
Video

RWPQC

The Real World PQC (RWPQC) Workshop took place on Sunday, March 24, 2024 in Toronto, Canada 🇨🇦, colocated with RWC 2024 and in cooperation with IACR.

Post-Quantum OpenMLS

Thu, 11 Apr 2024 00:00:00 +0000

OpenMLS now offers security against harvest-now-decrypt-later (HNDL) quantum adversaries.

In #1546 we merged support for the X-Wing KEM draft, which is an early draft for securely combining elliptic-curve-based Diffie-Hellman with ML-KEM. In particular, OpenMLS now supports the ciphersuite MLS_256_XWING_CHACHA20POLY1305_SHA256_Ed25519 with ciphersuite 0x004D. There is no IANA code-point for this ciphersuite yet, such that interoperability may not be guaranteed. We work with other implementers towards interoperability of this ciphersuite.

The implementation uses Cryspen’s formally verified ML-KEM and x25519 implementations from libcrux. The implementations are not only formally verified for correctness, secret independence, and memory safety, but also amongst the fastest implementations. Users should not notice any significant performance differences when using this new ciphersuite. The threat of HNDL attackers requires applications to switch to post-quantum secure mechanisms now, just like Signal and iMessage did already. OpenMLS offers a simple way to achieve security against HNDL attackers and is ready to use.

Post-Quantum Group Messaging

Wed, 10 Apr 2024 00:00:00 +0000

With multiple post-quantum cryptographic algorithms (ML-KEM, ML-DSA) nearing standardization, enterprises, research groups, and standards bodies have started investigating what post-quantum secure protocols should look like and what properties they should satisfy.

In this post, we discuss a few new post-quantum protocol designs being proposed for use in end-to-end encrypted messaging protocols like Signal and MLS.

Secure Two-Party Messaging

At Real World Crypto 2024, Rolfe Schmidt and I presented our work (slides, video, blog post), a collaboration between Cryspen, Inria, and Signal, on analyzing the PQXDH protocol which is currently being deployed in the Signal app. In the same session, Apple presented its own PQ3 protocol which is being deployed in iMessage.

Verifying Libcrux's ML-KEM

Tue, 30 Jan 2024 00:00:00 +0000

In a recent blog post, we described Cryspen’s new Rust implementation of ML-KEM in Rust, and talked about how our high-assurance development methodology helped us find a new timing bug in various other Kyber implementations.

In this post, we will go into some more detail on how we use the hax verification toolchain to formally prove that our code is panic free and functionally correct.

Background on High-Assurance Cryptography

Cryptographic libraries lie at the heart of the trusted computing base of all networked applications and, consequently, programming bugs in these libraries are always treated as security vulnerabilities, sometimes with high-profile acronyms and news articles. In the past decade, a number of companies and research groups have made a concerted attempt to improve confidence in cryptographic libraries by using techniques from formal verification. This research area, called computer-aided cryptography or high-assurance cryptography, is surveyed in this paper and even has a dedicated workshop.

Verified ML-KEM (Kyber) in Rust

Tue, 16 Jan 2024 00:00:00 +0000

ML-KEM, previously known as Kyber, is the first post-quantum secure key-encapsulation mechanism (KEM) to get standardised by NIST in FIPS 203.

Cryspen has built a new high assurance Rust implementation of ML-KEM, using our verification framework hax and F*. Our implementation is among the fastest portable implementations that we know of (see Performance comparison), and helped uncover a timing bug (also called KyberSlash) in various Kyber implementations that would allow an attacker to recover the private key.

Background on Post Quantum Cryptography

The rise of quantum computing poses a significant threat to current cryptographic systems and protocols. In particular, encrypted network traffic may be subjected to store-now-decrypt-later attacks, where encrypted data is collected by the adversary now so that it can be decrypted later, maybe in several years, when quantum computers become powerful enough to break the public key cryptographic schemes we currently use to establish encryption keys.

Welcome Jan & Lucas

Mon, 08 Jan 2024 00:00:00 +0000

📢 Exciting News! Cryspen is thrilled to announce the addition of two exceptional minds to our team: Dr. Lucas Franceschino and Jan Winkelmann.

🎓 Lucas, our new R&D Proof & Tool Engineer, brings a remarkable background in formal verification, dependently typed languages, and abstract interpretation techniques. His expertise in functional programming, evident in his work with languages like Haskell, PureScript, OCaml, Coq, Idris, and F*, is complemented by his proficiency in NixOS and Emacs. Notably, Lucas is the main author of hax, our groundbreaking tool for formally verifying Rust code.

An Analysis of Signal's PQXDH

Fri, 20 Oct 2023 00:00:00 +0000

Signal recently published a new, post-quantum secure, version of their X3DH protocol called PQXDH. As with any new cryptographic protocol, it is important to precisely analyse its security properties, especially for something as important as Signal.

In this blog post we give an overview of PQXDH and describe how we modeled its security using two formal verification tools (ProVerif and CryptoVerif). We detail some issues we found, and how we, a mix of Inria researchers, Cryspen researchers and Signal developers, worked together to improve the PQXDH specification.

Announcing Campus Cyber Circus Project

Wed, 20 Sep 2023 00:00:00 +0000

🎉 We’re excited to announce that Cryspen partnered with Inria on a transfer project to build a new integrated development and verification environment (IDVE). The project is part of the transfer program at Campus Cyber, which brings together France’s top cybersecurity experts.

The goal of this project is to advocate the commercial use of automated reasoning in security critical solutions in software engineering processes. We plan to make the IDVE, based on hax, usable by any developer, even if they don’t have formal verification knowledge. We will apply hax to Bertie, the first formally verified, high-performance, implementation of TLS 1.3.

Specifying Oblivious Pseudonymization

Mon, 18 Sep 2023 00:00:00 +0000

In this blog post we announce an executable specification in the hacspec specification language for the ScrambleDB pseudonymization system, developed by Cryspen as part of the BMBF ATLAS project.

Find the specification at our GitHub repository.

First, we will motivate the need for utility-preserving pseudonymization. Then we will describe how ScrambleDB addresses the issues found with conventional pseudonymization approaches. We conclude with a demo of our executable specification that takes you through a full protocol flow running right here in your browser.

Internet Defense Prize 2023

Mon, 14 Aug 2023 00:00:00 +0000

At the 32nd Usenix Security Symposium in Anaheim CA, a paper on the Messaging Layer Security Protocol, co-authored by our founders Jonathan Protzenko and Karthikeyan Bhargavan, was awarded both the Distinguished Paper Award and the prestigious Internet Defense Prize.

The paper, titled “TreeSync: Authenticated Group Management for Messaging Layer Security”, is authored by Théophile Wallez, Jonathan, Benjamin Beurdouche, and Karthik. It presents a precise, executable, machine-checked formal specification of MLS that shows how MLS can be cleanly decomposed into three components: TreeSync, TreeKEM, and TreeDEM. It then presents a formal security definition for TreeSync and a security proof for this sub-protocol in the Dolev-Yao model.

Prairie and Atlas

Wed, 09 Aug 2023 00:00:00 +0000

With the widespread adoption and deployment of machine learning across enterprises, ever-increasing amounts of data are being collected, stored, communicated, combined, and computed over by sophisticated algorithms. In parallel, new governmental regulations and rising concerns about privacy are giving impetus to new research on how to protect the confidentiality, integrity and privacy of all this data.

At Cryspen, we are engaged in multiple R&D projects around these topics. We help design new encryption standards, such as HPKE, for protecting data at rest; we implement high-assurance cryptographic libraries, such as libcrux; we design and implement new protocols, such as MLS, for communicating sensitive data between a large number of endpoints; and we investigate state-of-the-art constructions, such as multi-party computation, for privacy-preserving analysis over distributed data.

Three (thousand) may keep a secret

Mon, 31 Jul 2023 00:00:00 +0000

“Three may keep a secret, if two of them are dead.” - Benjamin Franklin (1735)

However skeptical we may be of our human ability to keep secrets, we still routinely participate in group conversations that we would like to keep away from prying eyes. We exchange confidential work emails through corporate mail servers, discuss project internals on private Slacks, and exchange deeply personal information with family and friends on WhatsApp groups. The loss of this private data to malicious outsiders can result in public embarrassment, financial loss, and for vulnerable persons like journalists or activists, even threats to life and liberty.

MLS - RFC 9420

Tue, 18 Jul 2023 00:00:00 +0000

✨ We are thrilled to announce the release of the MLS specification as RFC 9420.

RFC 9420 is a comprehensive description of the first standardised, efficient, asynchronous, key establishment protocol with forward secrecy and post-compromise security for groups in size ranging from two to thousands. While Cryspen didn’t exist back when the MLS working group was established, our co-founder Karthik played a pivotal role in designing MLS from the beginning by contributing to the original design of TreeKEM, the basis of MLS today.

Welcome Jonas

Mon, 10 Jul 2023 00:00:00 +0000

📢 Exciting News! 🚀 We are thrilled to welcome Dr. Jonas Schneider-Bensch, to the Cryspen family as our newest R&D Cryptography Engineer!

🎓 Jonas brings a wealth of knowledge and expertise, with a special focus on privacy-preserving technologies. His groundbreaking research and dedication to advancing cryptographic techniques have earned him a prominent reputation in the field.

📚 With a remarkable PhD thesis titled “New Approaches to Privacy Preserving Signatures,” Jonas has demonstrated his deep understanding and innovative thinking in safeguarding privacy in digital transactions. His work has set new benchmarks for ensuring confidentiality and authenticity in cryptographic protocols.

Cryspen @ RWC 2023

Mon, 12 Jun 2023 00:00:00 +0000

At Real World Crypto 2023 in Tokyo, we gave a talk on the hacspec language, the hax tool, and the libcrux crypto library.

Designing and implementing cryptographic software is a perilous endeavor. Experts (like us) will tell you not to “roll your own crypto” and instead rely on standard mechanisms and well-vetted open-source implementations. Or else you take the risk of falling prey to embarrassing attacks, with dedicated logos, backronyms, and long-lived websites listing your design flaws and coding bugs. Of course, published standards and popular crypto libraries are not infallible, but the argument goes that at least you share their vulnerabilities and subsequent patches with a larger community of users.

About us

Sun, 01 Jan 2023 00:00:00 +0000

Cryspen was founded in December 2021 by Karthik Bhargavan, Franziskus Kiefer, and Jonathan Protzenko, with the goal of adapting and extending cutting-edge formal verification tools developed at research labs like Inria and applying them to commercial software development.

In June 2026, Cryspen spun off CE Labs under the leadership of Franziskus to continue our work on Cryptographic Engineering. Cryspen itself pivoted to focus on developing formal verification tools for real-world security-critical software, funded by a new EIC Transition project called Spectrum.

Diversity, Equity, and Inclusion

Sun, 01 Jan 2023 00:00:00 +0000

Cryspen is committed to creating a diverse, equitable, and inclusive workplace where all employees feel valued, respected, and empowered. This policy outlines our commitment to fostering a positive and productive work environment that celebrates differences and promotes equal opportunities for all.

Principles

Diversity: We value and embrace the diverse backgrounds, experiences, perspectives, and identities of our employees.
Equity: We strive to ensure fair treatment and equal opportunities for all employees, regardless of their background or characteristics.
Inclusion: We create a welcoming and inclusive environment where everyone feels valued, respected, and able to contribute their best.

Commitment

Cryspen is committed to:

Impressum

Sun, 01 Jan 2023 00:00:00 +0000

Company Name: Cryspen Sarl

Registered Office: 149 Avenue du Maine, 75014 Paris, France

Email: info@cryspen.com

Managing Director: Franziskus Kiefer

Registration Number: 908 684 848 R.C.S. Paris

Social capital: €1500

VAT Number: FR21908684848

Hosting: Github

Image Credits

Jobs

Sun, 01 Jan 2023 00:00:00 +0000

HACL Packages v0.6

Mon, 07 Nov 2022 00:00:00 +0000

Today, we announce the first release of the HACL Packages libraries. 🎉

This release of HACL packages includes the first release of the HACL C library and a new release of the hacl-star OCaml bindings.

Together with this first release of the C library, we publish a first, work in progress, version of the documentation for the library. The HACL Packages documentation is the main entry point for all information about the HACL Packages.

Please file an issue or open a discussion if you have trouble with anything in this tutorial.

OpenMLS

Wed, 19 Oct 2022 00:00:00 +0000

We have joined forces with our friends from Phoenix R&D to improve OpenMLS.

The MLS protocol draft is in the IETF working group’s last call and is thus on track to become an RFC soon. We want to make sure that OpenMLS is ready for wider adoption by the time the RFC is ready. To achieve this we start by catching up with all the changes to the protocol (up to the current draft-16), improving test coverage of the code, and working towards a more comprehensive test framework for interoperability.

HACL Packages

Tue, 07 Jun 2022 00:00:00 +0000

Earlier this year, Tezos and Nomadic Labs started to work with Cryspen to improve HACL* and ensure that it is a viable long-term solution for Tezos' cryptographic needs. HACL is a set of high assurance cryptographic primitives used by Tezos for most of its cryptography.

The original HACL* has been developed as part of Project Everest and is a collection of high-assurance cryptographic algorithms. Its source is written in F*, which is used to generate C code. It also contains verified assembly code from the Vale project and an agile multiplexed cryptographic provider called EverCrypt.

What is High Assurance Cryptography?

Mon, 02 May 2022 00:00:00 +0000

Cryspen builds high assurance cryptography. But what does this actually mean?

Before focusing on cryptography it is interesting to look at high assurance software in general. How is high assurance software different from other software?

High assurance software is usually seen as being more trustworthy than other software. This is especially interesting in high-risk/high-stakes environments such as financial institutions or governments. There are different ways to achieve better guarantees for software. Today the most commonly used technique to increase trust into software is using certifications like common criteria or FIPS. While these certifications offer a certain level of additional guarantees, only the highest levels require some form of formal verification of the production source code. As such certification usually reaches only up to a certain level of high assurance.

An Executable HPKE Specification

Thu, 24 Feb 2022 00:00:00 +0000

HPKE, published as RFC 9180, describes a scheme for hybrid public key encryption.

📚 Read our TL;DR on HPKE if you need more background on HPKE.

In this post, I describe the first executable HPKE specification using hacspec. It is not only an executable specification of HPKE, it is also an annotated version of the RFC that can be read instead of (or in addition to) the RFC. While the TL;DR on HPKE was intended for consumers or potential users of HPKE, this blog post is aimed at implementators that want to implement HPKE or understand it better.

TL;DR - Hybrid Public Key Encryption

Thu, 24 Feb 2022 00:00:00 +0000

HPKE, defined in RFC 9180, is a CFRG standard that describes a scheme for hybrid public key encryption. It is co-authored by my Cryspen co-founder Karthikeyan Bhargavan and one of his PhD students Benjamin Lipp as part of his research at Inria.

This blog post will give a brief overview of the specification and describes some use cases.

If you want to learn more about the security proofs behind HPKE and the RFC process, Benjamin wrote an excellent blog post about it.

Cryspen ERC PoC Grant

Thu, 10 Feb 2022 00:00:00 +0000

Cryspen co-founder Karthik Bhargavan got awarded an ERC Proof of Concept grant for commercialising the know-how and landmark research results from his Inria research group PROSECCO through Cryspen.

Announcement

Cryptographic mechanisms are crucial to the security of our digital lives but their design and implementation remains notoriously difficult and error-prone. With the help of two ERC Grants, Karthikeyan Bhargavan and the Prosecco team at Inria have developed state-of-the-art formal verification techniques that can be applied to real-world cryptographic software. In particular, they used these techniques to help design and analyze the TLS 1.3 protocol standard, as well to build the HACL* verified cryptographic library, code from which has been incorporated in mainstream software projects including Mozilla Firefox, the Linux Kernel, the Tezos Blockchain, the WireGuard VPN, and the ElectionGuard voting system.