Understand what happens when a server is compromised, a key is reused, or a protocol step fails. We examine the design assumptions and the code that depends on them.
300+ engagements. Every engagement is led by a senior cryptographer.
What you receive
Scope, schedule, and fee agreed in writing before work begins.
Read a sample report (PDF)The system reviewed, attacker capabilities, security goals, and the limits of the analysis.
What can go wrong, the conditions that make it possible, its severity, and the evidence behind the finding.
Recommendations your engineers can work from, discussion of the findings, and retesting where agreed in the scope.
We published five findings in libcrux and analyzed gaps between the code, Cryspen's hax verification pipeline, and the claims made for the library. The work is documented in two papers and an OSTIF talk.
pow2 (d−1) belongsA technical review of Telegram's MTProto protocol under a network-attacker threat model, commissioned in 2025 by Global Network Solutions and made public in 2026 through a Swiss court filing. Conducted under editorial-independence terms reproduced verbatim in the report.
auth_key_id exposed in cleartext on every message, on every platform testedauth_key_id in cleartext on every messageWith 3MI Labs, we compared dWallet Labs' Rust implementation with the 2PC-MPC protocol and reviewed the supporting crates. The report records three security findings, including critical nonce reuse in the decentralized-party presigning step.
We reviewed the Native Labs smart contracts, including gas use, interoperability, transaction flows, liquidity models, code quality, and their effects on the user experience.
This work with Cure53 covered key rotation, vault security under server compromise, and public-key validation in 1Password B5.
In our first client engagement, we worked with Cure53 on Mozilla Thunderbird's Enigmail PGP integration and identified a critical flaw in the signature path.
We have been working together with Symbolic Software as auditors for cryptographic software. They are reliable, precise, honest, thorough and think outside the box.
Symbolic Software is run by an accomplished researcher, with significant contributions in the area of applied cryptography. They're the right team for projects that require rigorous design and engineering.
Symbolic Software are a delight to work with. Their reports are incredibly thorough and they maintain an excellent line of communication. We are grateful we got the opportunity to collaborate with someone of such high calibre.
