Google's commitment to a quantum-safe future: Why PQC is Google's path forward and not QKD
An overview of Google's strategy for transitioning to post-quantum cryptography.
Professional Summary
I am a Staff Software Engineer and Tech Lead Manager at Google, where I work in the Security Engineering team. My focus is on post-quantum cryptography and enabling developers at Google and across the internet to use cryptography safely and correctly.
I have a PhD in cryptography and an extensive background in the design and analysis of symmetric-key algorithms, post-quantum cryptography, and lightweight cryptography. I have contributed to several cryptographic standardization efforts, including the SKINNY cipher, which is part of the ISO/IEC 29192-2 standard. I also contributed to the SPHINCS+ signature scheme, which was standardized by NIST as FIPS 205. I currently represent Switzerland in the ISO/IEC JTC 1/SC 27/WG 2 committee for cryptography and security mechanisms.
Before joining Google, I was a Senior Technology Manager at Cybercrypt and a postdoctoral researcher at the Technical University of Denmark, working on the H2020 PQCRYPTO project.
Education
PhD in Cryptology
Technical University of Denmark
MSc in Computer Science
Graz University of Technology
BSc in Computer Science
Graz University of Technology
Interests
Post-quantum Cryptography
Cryptographic Hash Functions and Block Ciphers
Secure and Efficient Implementations
Tools for Cryptanalysis
Recent Posts
From Inventory to Agility: A CISO's Guide to Robust Key Management
A guide for CISOs on how to build a robust and agile key management strategy.
Cryptographic Agility and Key Rotation
A deep dive into the importance of cryptographic agility and key rotation in modern systems.
Featured Publications
How to Abuse and Fix Authenticated Encryption Without Key Commitment
Authenticated encryption (AE) is used in a wide variety of applications, potentially in settings for which it was not originally designed. Recent research tries to understand what …
The SPHINCS+ Signature Framework
We introduce SPHINCS+, a stateless hash-based signature framework. SPHINCS+ has significant advantages over the state of the art in terms of speed, signature size, and security, …
Finding Integral Distinguishers with Ease
The division property method is a technique to determine integral distinguishers on block ciphers. While the complexity of finding these distinguishers is higher, it has recently …
Gimli: a cross-platform permutation
This paper presents Gimli, a 384-bit permutation designed to achieve high security with high performance across a broad range of platforms, including 64-bit Intel/AMD server CPUs, …
The SKINNY Family of Block Ciphers and its Low-Latency Variant MANTIS
We present a new tweakable block cipher family SKINNY, whose goal is to compete with NSA recent design SIMON in terms of hardware/software performances, while proving in addition …
Recent Publications
(2018).
ShiftRows Alternatives for AES-like Ciphers and Optimal Cell Permutations for Midori and Skinny.
In TOSC 2018.
Talks
(2024).
A note on SPHINCS+ parameter sets.
Projects
SPHINCS+ / SLH-DSA
SPHINCS+ is a stateless hash-based signature scheme standardized as FIPS 205.
Skinny
A lightweight tweakable block cipher standardized in ISO 18033-7.
CryptoSMT
A tool for automating differential cryptanalysis for cryptographic primitives.
Gimli
Gimli is a cryptographic permutation designed for high performance and security across a wide range of platforms. It is part of the NIST Lightweight Project and is integrated into …
Haraka
A short-input hash function optimized for high performance on platforms supporting [AES-NI](https://en.wikipedia.org/wiki/AES_instruction_set). Used in …