Architecture

Age Checks Are Going Digital. They Should Go Zero-Knowledge.

On June 30, 2026, the UK Home Office laid regulations allowing licensed premises in England and Wales to accept digital proof of age for alcohol sales…

Cloud KMS and Bring-Your-Own-Key: What You're Actually Trusting

Every major cloud provider sells a key management service, and most sell a "bring your own key" option layered on top, marketed as the difference betw…

The SGX Enclave: Building the First Cryptographically Sovereign Smart City

Imagine an economic free zone with no tax declarations, no tedious audits, and no intrusive KYC processes requiring passport uploads to vulnerable ser…

Why we pay AI to undo the failures of PDFs (Introducing UDS 1.0)

Most people do not think about file formats. We focus on the words, the contracts, the medical records, and the transactions. The format is invisible,…

CBC Bit Flipping Explained: Why Encryption Alone Doesn't Guarantee Integrity

Most developers learn a hard lesson at some point in their careers: just because data is encrypted doesn't mean it’s safe from tampering. It’s an easy…

UVS: a draw's fairness as a fact you can recompute — not a certificate you trust

I've built casino slot machines and gaming systems for 15 years. I mostly stayed away from compliance, but once I had to write the official algorithm …

rscrypto v0.4.0: Verifying Constant-Time Behavior Instead of Assuming It

Every cryptography library says it's secure and performant. Very few can explain how that security is validated and how that performance is proven aft…

Post-quantum cryptography for embedded and IoT: secure boot, TLS and OTA

Post-quantum cryptography is no longer just a research topic. It is starting to affect the way embedded teams design TLS, secure boot, OTA, firmware s…

OPAQUE: Password Authentication That Never Sends the Password

The standard way to log in — type a password, send it to the server, hope the server hashes it well — has a structural flaw nobody has been able to fi…

EU Chat Control: What Client-Side Scanning Actually Means for Encryption

The EU's proposed Chat Control regulation would require messaging providers to scan your messages for illegal content before encryption, on your devic…

Why Strict "Zero Trust" Breaks Secret Management (And How We Built a Zero-Persistence Vault Instead)

This is a technical deep dive into the cryptography behind Ennote's enterprise architecture. You can read the original full-length post on our enginee…

Matrix: The Open Protocol for Federated Encrypted Messaging

Signal works well when everyone involved trusts the same company. Matrix is built for the case where they don't — where organizations want to run thei…

Building an Experimental TypeScript Cipher Inspired by 8 Dimensions

Over the last few days, I started an experimental study on cryptography with the goal of better understanding concepts such as symmetric encryption , …

C8s: A Confidential Kubernetes Architecture

How Group Encrypted Messaging Actually Works

Adding a third person to an encrypted conversation seems like it should be simple. It isn't. The cryptographic properties that make 1:1 messaging secu…