Daniel Hugenroth

lightsquares.devA look at cargo-vet in 2026Cargo-vet requires audits of third-party Rust dependencies before they ship. We analyzed 408 open-source projects to measure adoption, audit workload, exemptions, and audit lag.

18 Aug

Had a look at how cargo-vet is doing (spoiler: growing quickly). I really enjoy it for my projects and was wondering how projects deal with audit burden (especially with many crate updates). Wrote up a little summary here: lightsquares.dev/blog/cargo-v... 🦀

Daniel Hugenroth reposted

martin.kleppmann.comPrediction: AI will make formal verification go mainstream — Martin Kleppmann’s blog

8 Dec 2025

New blog post! ✨ I argue that AI will make formal verification go mainstream. martin.kleppmann.com/2025/12/08/a... Three reasons for this: 1. LLMs are getting increasingly good at writing proofs using proof assistants. This will make formal verification vastly cheaper than it's been to date.

cst.cam.ac.ukFrom research lab to newsroom: deploying secure whistleblower technology in practice | Department of Computer Science and TechnologyIn a functioning democracy, a free press plays a vital role in holding powerful institutions to account. But for journalism to thrive, citizens must be able to contact reporters securely—especially wh...

10 Nov 2025

@arberesford.bsky.social and I are giving a talk on deploying secure whistleblower technology in practice this Wednesday (12th Nov) at the @cst.cam.ac.uk in Cambridge (3pm)—covering the five year journey of CoverDrop. 🙌 Join us online or in-person: www.cst.cam.ac.uk/seminars/lis...

meetup.comMonthly Rust Meetup, Wed, Nov 12, 2025, 6:45 PM | MeetupJoin us for the new and improved monthly Cambridge Rust meetup, hosted at Quantinuum's office on Hill's Road. **Speaker:** **Daniel Hugenroth** **Topic:** In an era where

10 Nov 2025

And if you are interested in more Rust details 🦀, I'll be giving a deep-dive into some more Rust details in the evening (also Wednesday, 12th Nov) at the Cambridge Rust Meetup: www.meetup.com/cambridge-ru...

24 Oct 2025

How to trust that the binaries that we deploy are truthfully built from the correct source code? 🤝 Just back from ACM CCS '25 🌏 where we presented Attestable Builds as a solution to this challenge. It complements Reproducible Builds and uses TEEs as a trust anchor. With @coderlime.bsky.social

24 Oct 2025

The extended paper is available here as open-access: www.cl.cam.ac.uk/techreports/...

theguardian.com‘I lost 25 pounds in 20 days’: what it’s like to be on the frontline of a global cyber-attackThe security chief of SolarWinds reflects on the Russian hack that exposed US government agencies – and the heart attack he suffered in the aftermath

24 Oct 2025

The 2020 SolarWind accident was one of the big cases where a compromised build environment lead to a far-spreading (and hard-to-detect) cyber incident. The Guardian just published a great article with the SolarWind CISO revisiting the events five years later: www.theguardian.com/technology/2...

29 July 2025

One of my favourite CoverDrop details: out-of-band verification of the trusted organization key which signs the entire key hierarchy. Its digest is included in the imprint of every printed Guardian newspaper, removing the need to trust CAs 🔑🗞️ more details: www.coverdrop.org

arxiv.orgAttestable Audits: Verifiable AI Safety Benchmarks Using Trusted Execution Environments

19 July 2025

Audits of AI/ML systems while protecting model IP and keeping the audit data confidential 🤫 @inxoy.bsky.social is at the ICML TAIG workshop today, presenting our work on Attestable Audits: arxiv.org/html/2506.23... with Bill Marino and @arberesford.bsky.social

petsymposium.orgpetsymposium.org

17 July 2025

Super excited that Jenny is presenting our new paper on "Web Authentication and Recovery in the Age of E2EE" at PETS today! 🎉🎉 Tons of interesting insights for a world in which we are moving away from passwords, and E2EE data becomes more long-term and critical. petsymposium.org/popets/2025/...

27 June 2025

CoverDrop involved users from the very beginning—avoiding the “solution looking for problem” trap. Big shout out to @mansoor.bsky.social , Diana, and @arberesford.bsky.social for getting this right from the very beginning by running two very insightful workshops with journalists and engineers.

27 June 2025

There are a lot of insights in both the original PETS paper (petsymposium.org/2022/files/p...) and Diana's PhD thesis (www.repository.cam.ac.uk/items/ec87dd...).

27 June 2025

↩️ Back-link to the launch post: bsky.app/profile/lamb...

20 June 2025

This announcement really should have our lead Rustaceans @itsibitzi.dev and @zekehg.bsky.social on top 🦀! CoverDrop's implementation journey has been demonstrating the immense strengths that lie in Rust's type system and the mature tool chain. Looking forward to all the talk in September!

RustConf@rustconf.com

🎤 #rustconf Session Announcement: Daniel Hugenroth (@lambda.bsky.social), Sam Cutler, & Zeke Hunter-Green “Secure Messaging: Leveraging Rust to Create the Guardian’s Anonymous Whistleblowing System” → rustconf.com/schedule/#1473 #rustlang

coverdrop.orgCoverDrop: Blowing the Whistle Through A News App

20 June 2025

And if you like to learn more about the CoverDrop research behind SecureMessaging: www.coverdrop.org

Daniel Hugenroth reposted

Nieman Lab

@niemanlab.org

niemanlab.orgThe Guardian’s new whistleblower tool buries leaks to journalists within its own readers’ everyday trafficThink "I am Spartacus!" — but for leakers.

The Guardian app’s own data flows make leaks indistinguishable from regular traffic — cutting off one of the easiest ways for a repressive government or a corporate boss to identify a leaker. www.niemanlab.org/2025/06/the-...

Daniel Hugenroth reposted

theguardian.comThe Guardian launches Secure Messaging, a world-first from a media organisation, in collaboration with the University of CambridgeSecure Messaging is a new innovation for confidential story-sharing and source protection, underpinning the Guardian’s commitment to investigative journalism. The Guardian has published the open sourc...

Congratulations @lambda.bsky.social! Today @theguardian.com is launching a new way for whistleblowers to anonymously contact journalists, based on years-long research by Daniel and other colleagues. www.theguardian.com/gnm-press-of...

coverdrop.orgCoverDrop: Blowing the Whistle Through A News App

We launched CoverDrop 🎉 providing sources with a secure and anonymous way to talk to journalists. Having started five years ago as a PhD research project, this now ships within the Guardian app to millions of users—all of which provide cover traffic. Paper, code, and more info: www.coverdrop.org

Our CoverDrop white paper has a lot more technical details and we are immensely grateful to everyone who have provided us with valuable feedback throughout this project: www.cl.cam.ac.uk/techreports/...

cl.cam.ac.ukcl.cam.ac.uk

There’s a lot more to say, and I’ll highlight some aspects that I’m particularly excited about over the next few weeks.

coverdrop.orgCoverDrop: Blowing the Whistle Through A News App

theguardian.comIn a dangerous era for journalism – a powerful new tool to help protect sourcesToday, the Guardian, in collaboration with the University of Cambridge, launches Secure Messaging, a world-first from a media organisation

The launch article by Katharine Viner provides a great overview on how CoverDrop works, our collaboration with The Guardian, and why this system is so important: www.theguardian.com/membership/2...

cam.ac.ukWhistleblowing tech based on Cambridge research launched by the GuardianWhistleblowers can contact journalists more securely thanks to a new confidential and anonymous messaging technology co-developed by University of Cambridge

The university team has prepared a lil’ announcement as well: www.cam.ac.uk/research/new...

28 Apr 2025

Greatly enjoyed talking at JKU Linz about our Sloth 🦥 library which uses Secure Enclaves (SEs) for key stretching and deniable encryption. Importantly, it works around Android/iOS API limitations and, therefore, Sloth is available to regular apps on most smartphones without modifications.

28 Apr 2025

PETS paper here: petsymposium.org/popets/2024/...

28 Apr 2025

GitHub repo here: github.com/lambdapionee...

29 Jan 2025

I am quite excited that our brand-new module "P79: Cryptography and Protocol Engineering" has its first lecture today! @martin.kleppmann.com and I designed the course to bridge the gap between mathematical ideas and the challenge of implementing secure cryptography in the real world. @cst.cam.ac.uk

cl.cam.ac.ukDepartment of Computer Science and Technology – Course pages 2024–25: Cryptography and Protocol Engineering – Course materials

7 Apr 2025

The final slides are online now: bsky.app/profile/lamb...

Daniel Hugenroth@lambda.bsky.social

It's done! The final lecture slides and notes for "P79 Cryptography and Protocol Engineering" are now online: www.cl.cam.ac.uk/teaching/242... 🎉. This is the first time that @martin.kleppmann.com and I have done this course—we very much welcome feedback, corrections, and suggestions for next time

cl.cam.ac.ukDepartment of Computer Science and Technology – Course pages 2024–25: Cryptography and Protocol Engineering – Course materials

7 Apr 2025

We believe that simply preaching "Don't roll your own crypto" does not cut it anymore—the next generation of engineers and researchers needs to be able to critically evaluate available implementations and competently navigate risks and trade-offs.

Daniel Hugenroth reposted

papoc-workshop.github.ioCall for PapersThe 12th Workshop on Principles and Practice of Consistency for Distributed Data

6 Dec 2024

The PaPoC workshop is once again accepting submissions on distributed consistency. Deadline 15 January papoc-workshop.github.io/2025/cfp.html

Daniel Hugenroth reposted

28 Nov 2024

My CS department @cst.cam.ac.uk is now on Bluesky, with a properly validated domain handle. Please give them a warm welcome!

danielhugenroth.comAndroid HKDF implementationsThis article discusses several open-source implementations of the HKDF scheme for Android. Since HKDF is a relatively simple algorithm, it allows for a good case study of cryptographic code. The prima...

23 Apr 2024

I went down a rabbit hole studying HKDF implementations for Android and wrote up some impressions: www.danielhugenroth.com/posts/2024_0...

4 May 2023

I'll be speaking at TUM in Munich next week about "🎢 Rollercoaster: An Efficient Group-Multicast Scheme for Mix Networks". Say Hi if you're around, or join online: https://hedgedoc.net.in.tum.de/s/xDwzUxvFV#TUM-Blockchain-Salon

Daniel Hugenroth reposted