Applied cryptography
2017 · Paris, France
About the practice
An independent applied-cryptography consultancy founded in Paris by Dr. Nadim Kobeissi.
We review the assumptions that a cryptographic system depends on, then examine how the protocol and implementation enforce them. That includes what happens after a key is compromised, a message is replayed, or a dependency fails to provide the security its documentation promises.
A review needs explicit security goals and trust assumptions. Our 1Password work examined vault security under server compromise; our MTProto review examined what a network attacker could observe.
Protocol reviews and public reportsWe distinguish the properties proved about a model from the behavior of the shipped implementation. Our libcrux research documents code defects and gaps in Cryspen's hax verification pipeline separately.
Read the verification researchOur public work includes reports, source code, and protocol models. Verifpal's companion paper states its guarantees and limitations; Crucible connects conformance tests to the standards they exercise.
Explore our open-source workTwo papers on defects in libcrux and the structural gaps in its verification pipeline.
The soundness, termination, trace readability, and limitations of Verifpal.
An Ethereum Foundation-proposed Lean 4 restatement of soundcalc, developed by our Summer 2026 research interns.
We also teach Applied Cryptography, a university course with public materials, and organize Cedarcrypt with the IACR. Our essay on teaching in Lebanon explains the reasoning behind that work.
We have been working together with Symbolic Software as auditors for cryptographic software. They are reliable, precise, honest, thorough and think outside the box.
Symbolic Software is run by an accomplished researcher, with significant contributions in the area of applied cryptography. They're the right team for projects that require rigorous design and engineering.
Symbolic Software are a delight to work with. Their reports are incredibly thorough and they maintain an excellent line of communication. We are grateful we got the opportunity to collaborate with someone of such high calibre.
This website uses no cookies and collects no personal data. We record aggregate page-view counts without fingerprinting or identifying visitors.
Some of our online services process the minimum data needed to provide the service. We do not sell or share that data. Questions can be sent to [email protected].