We are excited to announce a significant advancement in the security of the Signal Protocol: the introduction of the Sparse Post Quantum Ratchet (SPQR). This new ratchet enhances the Signal Protocol’s resilience against future quantum computing threats while maintaining our existing security guar...
Software engineering is so often dominated by a move fast and break things mentality, driven by a rush to deploy and scale and profit, with the ability to fix problems with later updates. It’s a very immature process compared to every other engineering domain, because fix-it-later is much more difficult, expensive, and dangerous when it’s a bridge, building, airplane, or anything else tangible (although Boeing did a great job of destroying engineering process and accountability after the MBAs took control away from the engineers).
The work detailed in this Signal blog post is clearly slow and methodical, with continual checks for correctness and curiosity for optimal solutions driving careful experimentation. Building on existing proven PQ standards and keeping their refinements open for public academic feedback is wonderfully responsible. Building formal correctness proofs into CI and blocking trunk merges is spectacular.
They’re doing everything right, even years after Moxie Marlinspike’s departure. Bravo! Working this way is very expensive and requires absolute support from upper management. I’m definitely a fanboy for Meredith Whittaker and the direction she’s running the organization. Hell yeah!