Dan Draper
Verified account This account is verified. Learn more@danieldraper
CipherStash founder, cryptography nerd, Rust zealot.
4.8K Following 7.9K Followers 6.5K Posts
Latest posts 5
Mistakes in cryptographic tooling are making headlines!
First, it was using the number 4 as a private key. Now it's using AES keys with only 9 bits of randomness (they should have 128, 192, or 256).
So, it feels like a good time to share something we’ve been working on for a while now.
I believe cryptography will play a critical role in securing the world in which AI agents reign supreme. High-assurance building blocks like encryption, cryptographic signatures, and key derivation provide guarantees that other security controls can’t.
But that’s only true if you use them correctly.
That’s why we built Vitamin C: Misuse-resistant building blocks for cryptography.
Strong cryptography depends on more than choosing a secure algorithm. Keys need sufficient randomness, secrets need careful handling, and encrypted data needs to be bound to the context in which it is used. Getting these details wrong can undermine the guarantees of the underlying primitives.
Vitamin C is a suite of Rust crates that makes these details easier to get right - for you or your agent. It provides components for protecting secret values, generating cryptographic randomness, handling keys and passwords, encrypting structured values, and unambiguously encoding cryptographic context. It builds on libraries such as Subtle, Zeroize, and RustCrypto, with types and APIs designed to prevent misuse. The goal is to make invalid states and configurations fail to compile wherever possible.
Experts on our team have thoroughly audited each component and comprehensively tested it with property and mutation testing, fuzzing, and formal verification where possible.
Vitamin C is fully open-source and powers much of what we’re building at CipherStash. We’re targeting a 1.0 release by the end of the year and welcome feedback and contributions.
First, it was using the number 4 as a private key. Now it's using AES keys with only 9 bits of randomness (they should have 128, 192, or 256).
So, it feels like a good time to share something we’ve been working on for a while now.
I believe cryptography will play a critical role in securing the world in which AI agents reign supreme. High-assurance building blocks like encryption, cryptographic signatures, and key derivation provide guarantees that other security controls can’t.
But that’s only true if you use them correctly.
That’s why we built Vitamin C: Misuse-resistant building blocks for cryptography.
Strong cryptography depends on more than choosing a secure algorithm. Keys need sufficient randomness, secrets need careful handling, and encrypted data needs to be bound to the context in which it is used. Getting these details wrong can undermine the guarantees of the underlying primitives.
Vitamin C is a suite of Rust crates that makes these details easier to get right - for you or your agent. It provides components for protecting secret values, generating cryptographic randomness, handling keys and passwords, encrypting structured values, and unambiguously encoding cryptographic context. It builds on libraries such as Subtle, Zeroize, and RustCrypto, with types and APIs designed to prevent misuse. The goal is to make invalid states and configurations fail to compile wherever possible.
Experts on our team have thoroughly audited each component and comprehensively tested it with property and mutation testing, fuzzing, and formal verification where possible.
Vitamin C is fully open-source and powers much of what we’re building at CipherStash. We’re targeting a 1.0 release by the end of the year and welcome feedback and contributions.
Something weird is happening in tech right now that isn’t getting as much airtime as I expected.
Big tech is acquiring a lot of open-source startups.
Vercel bought BetterAuth
Supabase bought Turso
Cloudflare bought Deno (and killed most of it!)
And many other curious purchases. All for startups with next-to-no revenue and for undisclosed sums.
I suspect the valuation secrecy is less about how desperate the seller was and more about not revealing how motivated the buyer was.
But what’s really interesting is the trend:
Strategic infrastructure is worth more right now than standalone revenue.
Sure, developer adoption is a distribution advantage.
Bun has almost 100k stars on GitHub. BetterAuth 30k. But that’s not the main driver.
AI makes developer infrastructure strategically critical. And almost all of the really important stuff is open source.
Anthropic didn't need Bun to generate significant subscription revenue. It needed Bun to help Claude Code run faster and more reliably. The Bun team described it: if Bun breaks, Claude Code breaks.
This is about acquiring runtimes, build systems, development tools, and identity infrastructure because these are the essential components of agent-driven software development.
The deals involve projects with significant technical credibility, adoption, or exceptionally specialized teams. Because the infrastructure layer is the hardest part to build right!
Even for frontier models, it's often cheaper to buy these capabilities than to build them.
It's also hard to trust infra if it's proprietary. So, to be a force in tech in years to come, it's all open-source, baby!
Big tech is acquiring a lot of open-source startups.
Vercel bought BetterAuth
Supabase bought Turso
Cloudflare bought Deno (and killed most of it!)
And many other curious purchases. All for startups with next-to-no revenue and for undisclosed sums.
I suspect the valuation secrecy is less about how desperate the seller was and more about not revealing how motivated the buyer was.
But what’s really interesting is the trend:
Strategic infrastructure is worth more right now than standalone revenue.
Sure, developer adoption is a distribution advantage.
Bun has almost 100k stars on GitHub. BetterAuth 30k. But that’s not the main driver.
AI makes developer infrastructure strategically critical. And almost all of the really important stuff is open source.
Anthropic didn't need Bun to generate significant subscription revenue. It needed Bun to help Claude Code run faster and more reliably. The Bun team described it: if Bun breaks, Claude Code breaks.
This is about acquiring runtimes, build systems, development tools, and identity infrastructure because these are the essential components of agent-driven software development.
The deals involve projects with significant technical credibility, adoption, or exceptionally specialized teams. Because the infrastructure layer is the hardest part to build right!
Even for frontier models, it's often cheaper to buy these capabilities than to build them.
It's also hard to trust infra if it's proprietary. So, to be a force in tech in years to come, it's all open-source, baby!
What an epic event! @supabase select was so much fun.
Still so honoured to be partnered with this incredible company.
Still so honoured to be partnered with this incredible company.
Anthropic just used Claude to break RSA-896 encryption.
It was only 16-days after RSA-260 was broken and RSA-1024 is the next target.
Should we be concerned?
No. In fact, I think it’s a good thing.
The breakthrough here was to use GPUs instead of CPUs to find prime factors in parallel. Reducing the time to just 10 days instead of literally decades.
Claude didn’t find a new algorithm - it wrote the code to make GNFS (General Number Field Sieves) work in parallel. Seriously impressive but not for the reason that headlines will have you believe.
RSA-896 is old and hasn’t been a standard since 2007.
If you still use RSA, you likely use 2048 or 4096-bit keys.
Are they at risk?
At face value, it seems like it’s just a matter of time before RSA of any size will be easily factored. But the jump from 1024 to 2048 is astronomical compared to the one from 260 to 896.
Assuming the GPU approach scales, factoring RSA-2048 would take ~510 million years on the same 2048 GPUs used to break RSA-896. RSA-4096 would take 430 quintillion years - or 31 billion times the current age of the universe!
Larger RSA keys are perfectly safe from this kind of attack (though the jury is still out on the practicality of quantum attacks any time soon).
So, why do I think this is a good thing?
It reminds us that most cryptography is about computational advantage. And AI driven results like this push technology providers to ensure they use the current best practices.
There’s no hiding anymore - if there’s a weakness, AI will find it, forcing the adoption of better tech. And that’s a good thing!
It was only 16-days after RSA-260 was broken and RSA-1024 is the next target.
Should we be concerned?
No. In fact, I think it’s a good thing.
The breakthrough here was to use GPUs instead of CPUs to find prime factors in parallel. Reducing the time to just 10 days instead of literally decades.
Claude didn’t find a new algorithm - it wrote the code to make GNFS (General Number Field Sieves) work in parallel. Seriously impressive but not for the reason that headlines will have you believe.
RSA-896 is old and hasn’t been a standard since 2007.
If you still use RSA, you likely use 2048 or 4096-bit keys.
Are they at risk?
At face value, it seems like it’s just a matter of time before RSA of any size will be easily factored. But the jump from 1024 to 2048 is astronomical compared to the one from 260 to 896.
Assuming the GPU approach scales, factoring RSA-2048 would take ~510 million years on the same 2048 GPUs used to break RSA-896. RSA-4096 would take 430 quintillion years - or 31 billion times the current age of the universe!
Larger RSA keys are perfectly safe from this kind of attack (though the jury is still out on the practicality of quantum attacks any time soon).
So, why do I think this is a good thing?
It reminds us that most cryptography is about computational advantage. And AI driven results like this push technology providers to ensure they use the current best practices.
There’s no hiding anymore - if there’s a weakness, AI will find it, forcing the adoption of better tech. And that’s a good thing!
