Writing

Essays

Things I have learned. Things I built, broke, and eventually figured out.

A key wrapped in a key wrapped in a key Jul 21, 2026 · 9 min You type one passphrase, but ZFS native encryption juggles three kinds of key: a wrapping key derived from what you know, a random master key it guards, and a per-dataset data key derived from that. The indirection isn't bureaucracy — it's what makes changing a passphrase instant, inheritance sane, and 'send an encrypted backup to a machine you don't trust' a one-flag operation. Here's the whole hierarchy, the GCM authentication underneath, why copy-on-write lets ZFS reuse a per-block IV safely, and an honest account of what the encryption does not hide. cryptography · security · zfs
The key server that never sees a key Jul 16, 2026 · 16 min LUKS encrypts your disk with field arithmetic in GF(2^128) and guards the key behind a memory-hard wall. Tang unlocks it over the network using a blinded Diffie-Hellman trick — McCallum-Relyea — so elegant that the server can hand back your key without ever learning it, or anything else. The whole stack, mathematics included. cryptography · linux · security
Your terminal executes strings May 18, 2026 · 13 min Every string you print is a little program: escape sequences can move the cursor, erase the screen, retitle the window. What sanitize-ansi strips before untrusted text hits the render grid — and why it's an allowlist, not a blocklist. rust · security · tui