Bas Westerbaan

Split? I'm cleaning up both. blog.cloudflare.com/emudhra-cert...

I am an incredibly minor public figure. One thing that, even at my incredibly narrow status, I learned, is to not speculate on main, when you have absolutely zero evidence to back up any of your speculation. Unfortunately not everyone in this position has learned that lesson. In case you've […]

I still haven't found the perfect GIF to express my feelings shoving ML-DSA-44 into DNSSEC. blog.cloudflare.com/post-quantum...

Don't like what I'm posting? Become my boss and tell me to cut it out! Or just become my boss and be cool, that's also possible and encouraged. https://www.linkedin.com/jobs/view/4453027170/

Woohoo, the TLS key exchange algorithm Chrome, Firefox, and friends have been using for the last two years is now an actual standard! https://datatracker.ietf.org/doc/html/rfc10024

New blog post about cryptanalysis and AI https://bughunters.google.com/blog/more-cryptanalysis-makes-us-all-safer

We support post-quantum authentication now to your origin. First place we deploy PQ certs: many more to come. blog.cloudflare.com/post-quantum...

On the HAWK break: setting aside the LLM part of the narrative, this fits very well into my priors. I only had started looking at HAWK fairly recently and have not devoted much time to it, but when then I was not really convinced by the security argument. My main concern is that HAWK's public […]

I'm seeing folks draw the wrong conclusion (in good faith or not) from the HAWK attack. HAWK is a scheme that 1. cryptographers were suspicious of and 2. was still in the assessment process. A break is GOOD. It means the process is useful, and it INCREASES confidence in the selected algorithms.

I updated PQSpy, a @firefox.com extension that shows you in a little icon whether the page you're visiting is post-quantum encrypted ⚛️, or not ❌, or partially in a kinda pie chart. Click the icon to get more the deets as shown in the screenshot. Get it here addons.mozilla.org/en-GB/firefo...

You can now download the spec for ML-KEM over a connection secured with ML-KEM. An honor it shares with I guess SP 800 38D, and, if you change ClientHello, P256. And also RFC 7748, if you want to extend it further. https://csrc.nist.gov/pubs/fips/203/final

How to interpret a base64 encoded ML-DSA signature: first kilobyte: the exhausting part Second to last bytes: AAAAAAAAAAAA the eternal scream after being done with the exhausting part The last few bytes: the death rattle

Every year we write about the exciting developments in post-quantum signatures. Last year didn't disappoint. But it's too late. As ekr wrote in 2024 "You go to war with the algorithms you have, not the ones you wish you had." ML-DSA will have to do for now. blog.cloudflare.com/ml-dsa-will-...

Bas Westerbaan is a cryptography engineer at @cloudflare.social. He joins @kball.llc to discuss preparing for Q Day, post quantum cryptography, quantum threats, migration timelines, and readiness. @bwesterb.bsky.social softwareengineeringdaily.com/2026/06/16/p...

Overdue quantum landscape update: sam-jaques.appspot.com/quantum_land... A 2d chart can only say so much. tl;dr new results are still overhyped, but definitely worth taking seriously. This chart is based on surface codes and a big question now is whether new codes can be practical (=>useless chart)

There are no technical or compliance reasons to double the size of symmetric keys in response to the threat of quantum computers. This common misunderstanding of Grover's algorithm risks wasting limited resources that should go towards deploying actually urgent post-quantum algorithms.

I post links about the quantum thing. That is my life now, I guess. Anyways, here is Cloudflare following suit and setting 2029 as target date, and Scott slowing losing his mind over people being dumb on the internet. https://blog.cloudflare.com/post-quantum-roadmap/ […]

No one likes it if deadlines are pulled forward. I thought I had a decade at least for PQC. But when things change, you gotta adapt. blog.cloudflare.com/post-quantum...

A very nice explainer why "if you're so worried about quantum computers, why haven't they factored 21 yet?" isn't a very convincing argument. Look at the labels of the graph, and how extremely close the various lines are for factoring 21 and 2048 bit numbers. Polynomial scaling remains […]

from @bwesterb.bsky.social: bas.westerbaan.name/notes/2026/0...

Last year, I thought we still had time to design PQ auth systems. Now, based on the pace of progress and on statements like Google's, I believe 1. we need to finish rolling out PQ kex yesterday 2. we need to start rolling out PQ auth now 3. it's too late to ship any new non-PQ design or system

While I was attending APS March Meeting, I appeared in the 632nm podcast. The recording is available on youtube: www.youtube.com/watch?v=lnHg... Never been on a podcast before, and no doubt that shows, but it was fun.

I would bet against Q day by 2030, but I wouldn't bet against it at 10:1 odds. ~10% risk is unacceptably high here, so I'm very in favor of transitioning to quantum-safe cryptography by 2029: blog.google/innovation-a... Yes this means I 90% expect to be made fun of in 2030. Oh well.

"Lack of scalability is enough for us to disqualify QKD outright: if a technology can’t bring security to the whole Internet, we’re not going to spend much time on it." Quantum Key Distribution (as opposed to post-quantum cryptography) has many problems, but this succinctly captures the core issue.