Protocol design review
Handshake design, authentication, key schedules, session state, and failure handling.
Cryptography audits,
from design to code.
We review protocol architecture, primitive choices, threat models, formal models, and implementations. Every engagement is led by a senior cryptographer.
ID
Year
Title
- GNMX-01 2026 Telegram MTProto network-attacker review
- LIBCRUX 2026 CE Labs libcrux analysis
- DW-01 2024 dWallet Labs 2PC-MPC implementation audit
- NAT-001 2023 Native Labs smart-contract audit
- B5 MULTI 1Password B5 review with Cure53
- ENIGMAIL 2017 Mozilla Thunderbird Enigmail audit with Cure53
6 public case studies · reports and technical analyses
Security services
Primitive selection & composition
Primitive and parameter choices, including how encryption, signatures, KDFs, and KEMs are combined.
Threat-model review
Explicit attacker capabilities, security goals, trust boundaries, and compromise scenarios.
Implementation review
Cryptographic code and protocol state in Go, Rust, TypeScript, Swift, Java, .NET, C, and Solidity.
Post-quantum migration review
KEM and signature choices, hybrid constructions, libraries, interoperability, and rollout plans.
Formal protocol analysis
Protocol models in Verifpal, ProVerif, or Tamarin, and review of verification claims made about dependencies.
Review of CE Labs' libcrux
We published five findings in libcrux and analyzed gaps between the code, Cryspen's hax verification pipeline, and the claims made for the library. The work is documented in two papers and an OSTIF talk.
- Five public implementation and verification findings
- Analysis of Cryspen's hax extraction and proof boundaries
- ML-DSA conformance issues reproduced by Crucible
- Separate documentation of code defects and verification coverage
- F-01runtimeML-KEM decompression: 1664 where
pow2 (d−1)belongs - F-02proofSerialization proof claims bound 1; code allows 12
- F-03fipsML-DSA verifier norm check missing (FIPS 204)
- F-04fipsHint deserialization accepts malformed hints
- F-05proofAVX2 axiom models x·x where hardware does x·y
MTProto review under a network-attacker model
A technical review of Telegram's MTProto protocol under a network-attacker threat model, commissioned in 2025 by Global Network Solutions and made public in 2026 through a Swiss court filing. Conducted under editorial-independence terms reproduced verbatim in the report.
- 64-bit
auth_key_idexposed in cleartext on every message, on every platform tested - Telegram Desktop uses port 443 without TLS, verified four independent ways
- Identifier persists across app restarts, IP changes, and network switches
- Full editorial control retained by Symbolic Software, per Section 2.4 of the report
- F-01crit
auth_key_idin cleartext on every message - F-02highTelegram Desktop: port 443, without TLS
- F-03medIdentifier survives restarts, IP & network changes
- §2.4noteFull editorial independence, reproduced verbatim
Audit of the 2PC-MPC Rust implementation
With 3MI Labs, we compared dWallet Labs' Rust implementation with the 2PC-MPC protocol and reviewed the supporting crates. The report records three security findings, including critical nonce reuse in the decentralized-party presigning step.
- Protocol-to-code comparison for the Rust implementation
- Three security findings, including critical nonce reuse during presigning
- Review of supporting cryptographic crates
- Recommendations for further protocol and state-machine analysis
- SCOPEcodeProtocol-to-code comparison
- F-01critNonce reuse in decentralized-party presigning
- SCOPEcratesSupporting cryptographic crates
- NEXTworkProtocol and state-machine analysis
Smart contract architecture audit
We reviewed the Native Labs smart contracts, including gas use, interoperability, transaction flows, liquidity models, code quality, and their effects on the user experience.
- Operational efficiency, with emphasis on gas, scalability, and transaction speed
- Integration with internal and third-party systems
- Transaction handling, checked for correctness and security
- Smart-contract effects on the user experience
- S-01scopeGas use, scalability, and transaction speed
- S-02scopeOn-chain and off-chain transaction flows
- S-03scopeInteroperability and external integrations
- S-04scopeLiquidity models and user experience
Review of 1Password B5
This work with Cure53 covered key rotation, vault security under server compromise, and public-key validation in 1Password B5.
- Key-rotation and key-management review
- Vault-security analysis under server compromise
- Public-key validation review
- Conducted with Cure53
- S-01scopeKey rotation and key management
- S-02scopeVault security under server compromise
- S-03scopePublic-key validation
- TEAMwithCure53
Audit of Thunderbird's Enigmail integration
In our first client engagement, we worked with Cure53 on Mozilla Thunderbird's Enigmail PGP integration and identified a critical flaw in the signature path.
- Detected a critical vulnerability in Enigmail's signature path
- Outlined exposure of encrypted messages to attacker mutation
- Evaluated exploitation risk when combined with social engineering
- Identified how message confidentiality could be lost
- F-01critCritical flaw in Enigmail’s signature path
- IMPACTmailEncrypted messages exposed to attacker mutation
- PATHsocialExploitation combined with social engineering
- TEAMwithCure53
