Insights from our audit practice, software releases, and applied cryptography research. Updated whenever we publish.
Fifty students from nine institutions have been selected for the Summer 2026 Applied Cryptography online program, our free intensive course bringing modern cryptography to Lebanese university students. Here's a quick look at what the course covers, and at the wonderful group joining us this June.
4 min readAcross 62 head-to-head benchmarks against hpke-rs, hpke-ng wins 43 — including ML-KEM decap at 53–55% faster, X-Wing decap at 38%, X25519 decap at 41%, and every post-quantum encap/decap row a clean win — ties 14, ships a 30% smaller binary, and a type system that catches four classes of bug at compile time.
21 min readA 52-page practitioner guide for engineers and architects working on post-quantum migration, alongside an interactive scorecard and TLS scanner at pq-migration.symbolic.software.
1 min readVerifpal 0.51.0 tightens the analysis engine's treatment of password-qualified values, checked ASSERT? assertions, and AEAD associated data, all on the back of excellent bug reports from the community.
7 min readWhy Symbolic Software agrees with Soatok's position on hybrid post-quantum constructions: hybrids are compelling for KEMs, far less necessary for signatures, and the real risk is migration friction.
6 min readFive proof-of-concept exploits against ML-DSA, ML-KEM, Ed25519, and ChaCha20 demonstrate three classes of semantic gap in hax's Rust-to-F* extraction pipeline, where verified models diverge from deployed code.
11 min read