Writing
Essays
Things I have learned. Things I built, broke, and eventually figured out.
- A key wrapped in a key wrapped in a key Jul 21, 2026 · 9 min You type one passphrase, but ZFS native encryption juggles three kinds of key: a wrapping key derived from what you know, a random master key it guards, and a per-dataset data key derived from that. The indirection isn't bureaucracy — it's what makes changing a passphrase instant, inheritance sane, and 'send an encrypted backup to a machine you don't trust' a one-flag operation. Here's the whole hierarchy, the GCM authentication underneath, why copy-on-write lets ZFS reuse a per-block IV safely, and an honest account of what the encryption does not hide. cryptography · security · zfs
- The key server that never sees a key Jul 16, 2026 · 16 min LUKS encrypts your disk with field arithmetic in GF(2^128) and guards the key behind a memory-hard wall. Tang unlocks it over the network using a blinded Diffie-Hellman trick — McCallum-Relyea — so elegant that the server can hand back your key without ever learning it, or anything else. The whole stack, mathematics included. cryptography · linux · security
- How to agree on a secret in front of everyone Jul 15, 2026 · 13 min Diffie-Hellman key exchange lets two strangers build a shared secret while the whole world listens in. The trick is a one-way street in modular arithmetic: exponentiation is cheap, un-exponentiation is a wall. Here's the protocol, the group theory that makes it correct, the hardness assumptions that make it safe — and a live playground where you can run it, and try to break it. cryptography · math