Nadim Kobeissi

The sad thing about Cryspen’s CEO is that he insists on publicly treating me like a misbehaving child while he copy-pastes the free fixes I keep providing him for critical vulnerability after critical vulnerability and show him that he didn’t even know how to write advisories. So embarrassing.

She loved it 🥰

I can’t drink coffee for a few weeks due to some dental work! How annoying! I love coffee. Luckily I got some caffeine products that I can eat instead. But I miss the taste of coffee!!

Coffee and video game music are my life blood!

We Found Bugs in Cryspen's Verified Code Cryspen said they'd be 'very interested' if someone found a bug in their verified code. We found two.

Everyone knows you keep your best card for last.

Valentine’s Day gift for wife (she got me my current keyboard a few years back/she writes code constantly at her job)

This is a very funny post

It sounds made up.

Explained to someone IRL that my former thesis advisor blocked me on GitHub because I sent PRs for bugs in his crypto libraries (two critical) and called me irresponsible because I didn't tell him about them in private instead. Then he went quiet for a week and then published an evasive blog post

The strengths and limits of formal verification Getting precise about the guarantees of formal verification in our open-source libraries.

Absolutely no mention of the critical nonce reuse vulnerability in Cryspen code that is still in deployed in production in Signal and OpenMLS today. For shame

Three Lebanese Researchers Were Awarded The Unesco 'For Women In Science' 2022 Five young researchers from Lebanon, Jordan, and Syria were honored during the 9th edition of the L’Oréal-UNESCO For Women in Science.

For #WomenInScience Day, ATFL recognizes the vital contributions of Lebanese women advancing research, medicine, engineering, and innovation, often in spite of extraordinary national challenges.

One week today since I submitted my five vulnerabilities to Cryspen (with fixes) which include nonce reuse and their PSQ library not being IND-CCA

Still no release with fixes and not a single security advisory

These are libraries that they lobbied for Signal/OpenMLS to adopt.

Going through Verifpal is making me realize how much I've grown since I first started writing it ~6 years ago.

Not only was it written in Go while Rust is obviously the right choice, but its internal design is really inefficient and in many cases just wrong.

I feel ready now to design Verifpal 2.

Add Jevil and Spamton support · symbolicsoft/verifpal@b014be7

Pleased to announce that Verifpal finally has Spamton support

High Assurance Cryptography and the Ethics of Disclosure w/ Nadim Kobeissi · Luma Description Formally verified cryptographic libraries are increasingly deployed in critical systems, marketed as providing the highest level of assurance…

I'm giving a talk soon about my Cryspen findings, in collaboration with @ostifofficial.bsky.social. Happening online, will be live-streamed.

Register here: luma.com/xc4yuezb?tk=...

Here's three-message Signal verifying in 35 seconds, with a (correct) authentication attack on the first message:

Porting Verifpal from Go to Rust would have taken me a month. AI basically gave me a 30x speedup, and the result was clean code, with tests passing, and strong perf.

OK I went through the code and cleaned some stuff up but that's nothing, and AI helped even with cleanup!

I rewrote Verifpal in Rust with all tests passing, IN A SINGLE DAY, with performance matching that of the original Go codebase (years of work).

This was made possible obviously thanks to AI and so now we need to all stop and think where the hell AI is going because this is an insane result.

Should I add a "music mode" to Verifpal that plays select YM2612 chiptune music while analysis is being conducted

Track Rust rewrite progress here: github.com/symbolicsoft...

Verifpal Rust rewrite

Keychron Q3 Pro (gift from wife)

100%. Audioengine HD3. Unbelievable value for money

It's a coincidence

Dual Mac Studios, nice!

Uploaded daytime pics as reply to this post

My Productivity Zone (Daytime)

- Performance
- Match syntax
- No GC

Abstract. This paper is a Systematization of Knowledge (SoK) on cryptography applied in Multi-Cloud Storage (MCS) schemes. Such techniques distribute and fragment data among multiple cloud providers to strengthen confidentiality, integrity, and availability compared to single-cloud deployments. Over the past decade, many cryptographic mechanisms have been proposed to secure outsourced data. However, the lack of unified framework has led to fragmented terminology, inconsistent trust assumptions, and unclear comparisons between existing protocols. In this SoK, we analyze and classify existing MCS approaches along two complementary dimensions: (i) their architectural trust models, and (ii) the cryptographic primitives they employ to achieve confidentiality, integrity, availability, access control, and auditability. This taxonomy allows us to highlight recurring design patterns, evaluate trade-offs between security and efficiency, and identify redundancies and research gaps. By unifying terminology and mapping the landscape of cryptographic techniques in MCS, this SoK provides both researchers and practitioners a structured foundation to guide future designs and deployments.

Image showing part 2 of abstract.

SoK: On Cryptography for Multi-Cloud Storage (Dayane Horkos, Ludovic Perret) ia.cr/2026/207

YouTube video by BlastoiseVeteran [YM2612+SN76489] A DARK ZONE - DELTARUNE: Chapter 4

Today's work music