Episode 38 of The Security Podcast of Silicon Valley aired on March 9, 2024, with Jon McLachlan hosting. The guest was Nick Sullivan, who spent a decade at Cloudflare as head of security engineering, then head of cryptography, then head of research, and was advising the company and startups when they spoke (Podbean, Apple Podcasts, Spotify). The episode is called “Nick Sullivan on Cryptography, Cloudflare, and Building a Better Internet.” It has no video version. Jon and Nick go back to Apple, where both worked on the DRM team.
The line that sums up the conversation is the slogan Nick gave his research team at Cloudflare.
“one of the slogans that I came up with for the research team was, we make friends.”
Nick Sullivan, at 16:34
This page follows the conversation in order: a section for each part of it, thirteen figures, thirteen clips from the tape, a LinkedIn post, the full transcript, and five tools: a quiz, a scorecard for whether your security makes friends, a calculator for how many handshakes a group chat needs, a timeline, and a to-do list. Where the decodes of the tape disagree on a word, the transcript puts its best guess in brackets, and the page doesn’t quote or retell those words.
Pure math first
Jon opened with a career built on security and cryptography, and asked whether Waterloo had been about cryptography. Not quite:
“I studied pure mathematics, actually.”
Nick Sullivan, at 0:33
“it is much more abstract and much more theory focused.”
Nick Sullivan, at 0:40
Jon had no complaint about that order of operations.
“before you can get into the bit smashing, right?”
Jon McLachlan, at 0:46
Nick’s LinkedIn lists a BMath with distinction from the University of Waterloo in pure mathematics, combinatorics and optimization, and an MSc in computer science and mathematics from the University of Calgary, specializing in cryptography, with a thesis on fast arithmetic on elliptic curves over prime fields (LinkedIn). Jon ran through what came next: cryptography researcher, security analyst at Symantec, then Apple.
The DRM team
“We were both on the DRM team.”
Jon McLachlan, at 1:08
Nick worked more on the cryptography and the business logic, Jon said, and Jon was on the obfuscating compiler team, which is harder to talk about. They worked closely together. Nick’s LinkedIn gives his Apple title as “Mathemagician,” from 2007 to 2013, and says he built the core DRM technology behind iTunes Movie Rentals and Purchases, iBooks, App Store receipts and iTunes Radio, with custom cryptographic protocols and services that handled over a trillion transactions a day (LinkedIn). FairPlay is Apple’s family of DRM technologies, for videos, books, apps and music (Wikipedia).
“Apple Media Empire is built on the foundations of having secure ways of enforcing business logic.”
Nick Sullivan, at 1:28
Jon noted the strong political opinions on whether DRM is good or evil.
“Maybe it’s both.”
Jon McLachlan, at 1:46
Without getting into the politics, he said, the technical challenges were open and interesting. Then Nick had the good sense to leave for a young, budding Cloudflare. If you ship software that people will try to take apart, our anti-reverse engineering work starts where that team’s did.
A proxy in the middle
“I joined when it was a small company, under 50 people or so.”
Nick Sullivan, at 2:55
“it basically sits as a proxy between people and websites or web resources.”
Nick Sullivan, at 3:03
That generic framework makes it powerful, he said. In the middle, you can do security monitoring, run web application firewalls and stop denial of service. Wikipedia describes Cloudflare’s services as acting primarily as a reverse proxy between website visitors and a customer’s hosting provider. Matthew Prince, Lee Holloway and Michelle Zatlyn founded the company on July 26, 2009, and it went public on the New York Stock Exchange in 2019 (Wikipedia).
The web is under constant attack, he said. Attackers keep finding new loopholes to steal identities and money, and a security blanket over your website and web services helps.
Trust plumbing
His first years were heavy engineering, he said, on the security architecture that was missing.
“So I built Cloudflare’s public key infrastructure”
Nick Sullivan, at 4:05
He also built a small team around an open source tool called CFSSL, for creating certificates and managing internal trust, and it helped a fledgling company take off. His LinkedIn adds Red October, an open source take on the two-man rule, and work on Keyless SSL, which let Cloudflare serve HTTPS without holding a customer’s private key (LinkedIn). On September 29, 2014, Cloudflare made SSL free for every site with Universal SSL. The release said fewer than 0.4 percent of websites were encrypted before the launch, and it almost doubled the encrypted web in a day. Nick, then Cloudflare’s security engineering lead, said the company made “cutting-edge cryptography” free and easy for anyone (Cloudflare). Alan Braithwaite remembered Nick from that same year, on the interview panel that hired him, on episode 50.
Bridging the gap
Bringing security, cryptography and privacy to a wide audience as a product was one part, he said. The other was the industry’s problems themselves. He worked with standards bodies, tested new ideas with academic researchers and built prototypes.
Ideas that academia had explored with rigor were not always ready to deploy at scale, and he helped bridge that gap. His own focus was cryptography, which led to the head of cryptography role. In that role, his team
“participated in TLS 1.3, invented stuff like Privacy Pass.”
Nick Sullivan, at 5:35
TLS 1.3 was defined in RFC 8446 in August 2018 (Wikipedia). Privacy Pass started as a 2018 paper by Alex Davidson, Ian Goldberg, Nick Sullivan, George Tankersley and Filippo Valsorda: a protocol that hands users anonymous tokens for solving a challenge, which they can spend later to skip challenges like CAPTCHAs (Cloudflare Research). The IETF published the Privacy Pass architecture as RFC 9576 in 2024 (Cloudflare Research). The model, he said, was long-term research based on
“collaboration across the industry and not competition”
Nick Sullivan, at 5:53
That meant the IETF, conferences and academics, and an internship program with probably 40 interns at least over the last couple of years. The team grew past cryptography and protocols into DNS, network measurement, distributed systems and privacy-enhancing technologies. Taher Elgamal, who helped make SSL a standard, talked about where it came from on episode 61.
Tampering at scale
He still consulted with Cloudflare, he said, and a recent paper from his work there measured tampering: participants on the network stopping traffic from getting through, in various parts of the world. Cloudflare sat in front of almost 20% of the web at that point, he said.
“And it’s a lot higher in certain countries.”
Nick Sullivan, at 7:22
The reasons vary: corporate security that keeps employees off phishing sites, geopolitics, and schools that filter content. Sitting in front of so much of the web gave the team the data to see it.
“Yeah, you have just tons of data, I imagine.”
Jon McLachlan, at 7:56
The paper is “Global, Passive Detection of Connection Tampering,” presented at ACM SIGCOMM 2023, September 10 to 14 in New York, by Ram Sundararaman, Louis-Henri Merino, Kevin Bock, Marwan Fayed, Dave Levin, Nick Sullivan and Luke Valenta. It calls itself the first global study of connection tampering through passive analysis of traffic received at a global CDN (Cloudflare Research).
Seen from the server side
Jon asked how you could tell something was being censored inside a school, if the packets never reach Cloudflare.
“It’s very counterintuitive that one would be able to learn this”
Nick Sullivan, at 8:29
Most measurement until then had been active, he said: groups like OONI put devices in people’s homes, or let people opt in, and test a preset list of names. The Open Observatory of Network Interference has monitored internet censorship since 2012, when it launched under the Tor Project (Wikipedia). The new study needed only the server side of the connection, where it looked for signatures. Nick credited the folks at the University of Maryland with the machine learning analysis of TCP flows.
“There’s no authentication on any of these TCP things.”
Nick Sullivan, at 9:44
A request names the site it wants in the handshake. Server Name Indication is the TLS extension that carries that hostname, and it isn’t encrypted, so a passive eavesdropper can see it. Wikipedia notes that security software has used that for filtering and monitoring, and governments for censorship (Wikipedia). A device in the path matches the name against its list and sends a reset, or does other things to confuse the state machines on either side. The handshake gets through, then a stray reset shuts the TCP connection down. Many of those signatures are high confidence, he said, and correlate with particular products that people sell.
A free tier as an immune system
“I always say that’s one of the superpowers of Cloudflare”
Nick Sullivan, at 11:05
He meant the free customer base. Millions of customers can join and use the service. They get a lot of value, and Cloudflare pays a cost for it, and in return it sees what threats are going on across the internet.
“So it’s kind of like an immune system, if you will.”
Nick Sullivan, at 11:26
A threat hits a free customer, he said, and Cloudflare can study it, build a mitigation, and protect its large enterprise customers.
“It’s a really good symbiotic relationship.”
Nick Sullivan, at 11:37
Five years to Private Relay
Some of his most recent work, he said, depended on a company whose business is making the network work the way it should, with no money made from tracking individuals.
“Cloudflare participated in iCloud Private Relay”
Nick Sullivan, at 12:14
He described it as a privacy proxy that uses CDNs and network providers, naming Cloudflare, Akamai and Fastly, to hide the client’s IP address, and it’s native on iOS now. Private Relay is part of an iCloud+ subscription. It sends Safari browsing, DNS and unencrypted app traffic through two relays: an ingress proxy run by Apple sees your IP address but not your destination, and an egress proxy run by a provider other than Apple sees the destination but not your IP. Apple announced it in June 2021 (Wikipedia).
“And that kind of happened through five years from when we came out with Privacy Pass and published it.”
Nick Sullivan, at 12:31
It took a lot of conversations behind the scenes about secure DNS and privacy, he said. Apple and Cloudflare were aligned.
“Neither company is trying to monetize individuals”
Nick Sullivan, at 12:51
A five-year process
That’s the kind of win a research team should expect, he said, on a timeline an executive team funding it has to be comfortable with.
“This is a five-year process.”
Nick Sullivan, at 13:15
Most of the successful projects at Cloudflare took “three to five years to become fully robust,” he said.
Jon asked whether that was a hard sell to the executives. The mission helped, Nick said:
“Cloudflare’s mission statement is to help build a better internet.”
Nick Sullivan, at 13:45
Better can mean more secure, more available, or more private. Research teams are a cost center, he said, and a company growing as fast as Cloudflare did for ten years has a million tensions.
Funding, priorities and communication look different at 100, 500 and 2,000 people, he said. Long-term research is a big swing that few companies are comfortable taking, given the pressure on revenue, cash flow and growth.
“But I think we showed that research can pay off, even in a smaller company, even in a growing company”
Nick Sullivan, at 15:36
He took lessons from research groups at places like Google and Microsoft, and from the Bell Labs days. Bell Labs is credited with the transistor, the laser, information theory and Unix, among much else (Wikipedia).
We make friends
Without short-term deadlines, he said, research can’t promise deliverables within even six months, so it leans on relationships and communication inside the company. People need to know the value it brings and want to work with you. Hence the slogan.
“And there’s absolutely no way to do some of the more difficult, long-term things that take away from other priorities that come with research”
Nick Sullivan, at 16:40
Those take people and their support, he said.
Two kinds of security people
Jon liked the slogan, and told a story he likes to tell. One kind of security person walks into a meeting room and everyone thinks, oh no: new standards to implement, a deadline pushed back by a couple of months.
“it’s just going to be roadblock after roadblock.”
Jon McLachlan, at 17:28
The other kind walks into the same meeting with exactly the same expectations for the product, and the room is glad to see them. Jon used Nick as the example: someone who helps the team build the new thing in a way that fits its security goals and its customers’ expectations.
“And Nick is the guy who’s going to help us understand and navigate that complex space as an ally.”
Jon McLachlan, at 18:01
“I’d like to think that I try to embody that second person”
Nick Sullivan, at 18:07
The scorecard on episode 35 asks whether your security enables or restricts, and the scorecard below asks whether yours makes friends.
A resource or a burden
If people come into the meeting expecting trouble from you, Nick said, you won’t get far in a company.
“So you’ve lost already, like, at that point.”
Jon McLachlan, at 18:35
His approach is collaborative, inclusive and helpful, and he encourages his team to help anyone who asks. Research and security groups hold specialized knowledge that a typical engineer won’t have, and a short talk with an expert can save a team from easy mistakes.
If you aren’t a resource for your company, he said:
“you’re potentially a burden, right?”
Nick Sullivan, at 19:32
That’s worse when your group’s goals look like they run against the company’s, he said. Jon called it a dangerous place to be, especially in a contracting market with layoffs going around.
“efficiency is super important.”
Nick Sullivan, at 20:16
Everybody wants a team that can do more with less, he said.
A series of doors
Jon asked whether a moment tipped him from mathematics into security.
“It was kind of a series of events and doors that opened up.”
Nick Sullivan, at 20:50
In his last semester at Waterloo, after pure math and combinatorics, all pen-and-paper abstract work, he took the intro cryptography class from Alfred Menezes, one of the cryptography professors there. Menezes, he said, invited him back to give a guest lecture a couple of years before the episode. Menezes is a professor in Waterloo’s Department of Combinatorics and Optimization and a co-author of the Handbook of Applied Cryptography (Wikipedia).
“everything just clicked for me”
Nick Sullivan, at 21:18
He could take his hard-learned intuition about prime numbers and discrete mathematics and put it into a concrete application.
Like magic
Cryptography is like magic to him, Nick said. It lets you do digitally what could only be done physically, and the intuition is weird.
“you can take data and make it so that no one in the world can see it.”
Nick Sullivan, at 21:54
Physically, you’d put it in an unbreakable safe. Digitally, math does it. Even basic tools like digital signatures enable capabilities that shape how communication systems are designed.
How software really works
After that, he did a master’s degree in cryptography and moved from math into computer science. A few courses got him into antivirus, exploits and security.
“there’s a way that you think software works, and then there’s a way that software really works.”
Nick Sullivan, at 22:41
He finished the master’s in elliptic curve cryptography and started on implementation, then on threats and the internet. Elliptic curves were suggested for cryptography independently by Neal Koblitz and Victor Miller in 1985, and give equivalent security with smaller keys than RSA (Wikipedia). Symantec hired him as a security analyst and one of the co-authors of its annual Internet Security Threat Report. His LinkedIn lists volumes XI and XII (LinkedIn).
“this kind of opened the door to, like, massive data problems, and data as a tool for explaining the world of security.”
Nick Sullivan, at 23:10
Cryptography solves problems with magical primitives, he said. Meanwhile most of the world lives and builds online, and nothing was built perfectly.
“Everybody’s taking shortcuts one way or the other.”
Nick Sullivan, at 23:40
Combining the two was the perfect fit.
Not a cryptanalyst
Jon asked a crazy question: did Nick ever sit in a coffee shop trying a new way to factor the product of two large primes? In the early days, before he knew the theory, Nick said, he played with it. Then he learned the quadratic sieve and the general number field sieve.
“it was like, oh, this is really deep.”
Nick Sullivan, at 24:36
The quadratic sieve is the second-fastest factoring method known, and the fastest for integers under about 100 digits. The general number field sieve is the most efficient classical algorithm known for integers larger than 10^100 (Wikipedia, Wikipedia). Cryptanalysis takes real creativity and deep knowledge, he said. At Apple he could protect content with encryption and work on authentication, device attestation, obfuscation and reverse engineering. At Cloudflare:
“I can upgrade the cryptography for 20% of the internet”
Nick Sullivan, at 25:46
He called the academics in cryptography brilliant. In his telling, there hasn’t been a new factoring algorithm in 20 years.
“I’m not the kind of sit in a room for seven years and solve the hardest problem in the world type of person.”
Nick Sullivan, at 26:08
He’s the kind who brings smart people together. Then, Jon added, you see what happens in practice.
Write it down
Once you figure something out, Nick said, explain it.
“One of the things that I emphasized in my job at Cloudflare is blogging.”
Nick Sullivan, at 26:30
He wrote dozens of technical deep dives. Once you learn something, it becomes second nature and harder to teach, so writing it down while it’s new reinforces your own understanding and brings people into the industry. He has mentored high school students who became interns and developers, and given guest lectures at universities. His LinkedIn lists Cloudflare blog posts such as a primer on elliptic curve cryptography and the launches of CFSSL and Red October (LinkedIn).
Society needs people in security who understand these things, he said, to make its technical infrastructure better than it is today. It works today, but “that’s not enough, I think.”
“That’s right. It’s not enough.”
Jon McLachlan, at 27:58
All of this is about people
Jon took it to leadership: you get to share what you know and pass it on, and at some point you give back to the community more than you take from it. Nick agreed, and Jon kept going.
“and at the end of the day, like, all of this is about people.”
Jon McLachlan, at 28:50
When a project loses sight of its impact on people’s lives, Jon said, he takes that as a red flag, steps back and asks whether it matters. Everyone sees issues with the world. People who can do something about them should.
“like to be the change that you want to see in the world”
Jon McLachlan, at 29:26
“Well, I know that, Jon, from your history.”
Nick Sullivan, at 30:01
Signal and MLS
There are a lot of ways to give back, Nick said. He had moved from full-time at Cloudflare to advising, and kept volunteering on the internet itself. He was co-chair of a couple of committees at the IETF, he said, including the Crypto Forum and Messaging Layer Security.
The Crypto Forum Research Group sits in the Internet Research Task Force, which runs long-term research groups and does not set standards (Wikipedia). Messaging Layer Security is a protocol for end-to-end secure group messaging.
Jon asked whether Signal is based on it. Signal came first, Nick said. It did end-to-end encryption between two people and scaled to groups with essentially a pairwise handshake, where every participant has to do the handshake with everyone. That doesn’t scale well. Signal brought forward security and post-compromise security: ways to recover when a key is compromised. MLS set out to keep those properties for groups of a hundred, a thousand, ten thousand, with key agreement that scales with the size of the group.
“And so we recently published an RFC on this”
Nick Sullivan, at 31:45
MLS was officially published on July 19, 2023, and it is designed for groups as large as 50,000 and for people on multiple devices. Its security properties include forward secrecy, post-compromise security and scalability (Wikipedia). Nick said Webex already used it. The Signal Protocol, developed by Open Whisper Systems in 2013, calls its ratchet self-healing: after an attacker compromises a session key, later messages are out of reach (Wikipedia). The calculator below counts what a pairwise design costs as a group grows.
One final document
Standards are another thing he’s passionate about, he said. Everyone building companies and products bumps into the same problems.
“And people have built the same solutions for the same problems in multiple different places.”
Nick Sullivan, at 32:21
Jon pleaded guilty, and Nick said he had done it too. To make something global and interoperable, he said, it helps to pool the work of a few experts into one final document.
He also reviews for top security conferences, even without a PhD, he said, after co-authoring over a dozen papers at Cloudflare, and the background reading keeps him fresh. He leans toward enabling the group: less final reviewer, more sanity check, keeping the process moving and the people involved.
“you can scale your impact by enabling others and sharing knowledge.”
Nick Sullivan, at 34:19
A secret group in a secret company
That came naturally over ten years in public, he said. At Apple, the team couldn’t be so public.
On his way out of Apple, Jon said, he looked for security roles inside the company, and found that security means different things to different teams. Apple takes corporate security seriously, and the two of them had worked in
“a secretive group inside of a secretive company that just was so secret.”
Jon McLachlan, at 35:04
The way Nick had learned to do technology is hard in a secret group within a secret org, he said,
“because to me, communication is so important.”
Nick Sullivan, at 35:20
Jon put it another way:
“security based on, like, keeping what you do a secret is not secure.”
Jon McLachlan, at 35:26
Secrecy raises the cost of an attack, he said, but it cuts out everyone who could help move the needle. It might solve a short-term business problem and still be misaligned with your values in the grand scheme of things.
The Heartbleed Challenge
Nick recalled the moment the power of the crowd became obvious to him: Heartbleed. He described a silly bug in OpenSSL, a widely used cryptography library, that let an attacker send a single packet and grab memory contents. Heartbleed was a missing bounds check in OpenSSL’s TLS heartbeat extension, introduced in 2012 and disclosed in April 2014. At disclosure, some 17%, around half a million, of the internet’s secure web servers certified by trusted authorities were believed vulnerable to theft of private keys, session cookies and passwords (Wikipedia). Cloudflare had patched ahead of time, he said, but the open question was whether someone could have taken the private keys for all those websites. The team spent about a day on experiments.
Someone out there had to have a better way, he said. So Cloudflare set up a vulnerable website and invited the world to take the key.
“And I remember the challenge, yes.”
Jon McLachlan, at 37:26
“we were kind of overconfident that it would take a while for people to do it.”
Nick Sullivan, at 37:38
In less than a day, he said, a dozen people had solved it, some in different ways. Wikipedia records that on April 12, 2014, at least two independent researchers stole private keys from the server Cloudflare set up. John Graham-Cumming’s write-up two weeks later says Cloudflare was “unsure if private keys could be accessed” when it launched, and that most solvers searched the leaked memory for the prime numbers at the heart of an RSA key (Cloudflare).
“So the power of the crowd is strong.”
Nick Sullivan, at 37:57
Collaborate, mostly
Jon drew the lesson: we all face the same huge set of problems, and collaborating on the solutions helps everyone make the world better much more quickly. Nick added a caveat.
“It doesn’t always work that way, though, right?”
Nick Sullivan, at 38:22
Sometimes you have to make a strategic, bold announcement and take advantage of timing, he said. Jon agreed that some problems don’t have a one-size-fits-all approach.
Advising startups
Jon asked how advising was going. Nick was a technical advisor to a number of small companies. Since leaving full-time work at Cloudflare, he said, he had been exploring the up-and-coming startups, security among them. If a company solved a problem he saw in ten years at Cloudflare and with its customers, he was happy to work through it with the founders. He did technical advising and some matchmaking, for technical roles or investors.
“It’s obviously kind of a tricky time in terms of fundraising”
Nick Sullivan, at 40:12
Nobody knows what happens macro, he said, and the foundations still matter: product market fit, and something novel in security or other functionality.
He loves entrepreneurs and admires anyone who takes on the world to build something of their own. Having him on a pitch deck as an advisor helps founders raise money too, he said. Jon could picture the investors’ reaction:
“oh, it’s Nick? Nick from Cloudflare?”
Jon McLachlan, at 41:33
Trust is the currency
A network helps connect the dots and close deals, Jon said, and then made a bigger claim.
“People talk a lot about currency and the security space, but our main currency, I think, is trust.”
Jon McLachlan, at 41:48
Trust builds up over time, he said, and it’s “shared between people, not companies.”
Nick added that security is a diverse group of professionals and even non-professionals, whose communities don’t always overlap: corporate security, AppSec and applied cryptography among them.
Three prongs
Jon asked for predictions about the next huge change in cryptography, and offered his own: he thinks
“quantum is going to break everything.”
Jon McLachlan, at 42:35
Nick saw three different prongs, all exciting at the time, and Jon had touched on each. The first is post-quantum cryptography, being rolled out in a lot of places. Jon expected it in FIPS in about a year and a half. NIST finalized the first three post-quantum FIPS standards in August 2024 (Wikipedia). Nick had been part of the standardization work for a long time.
“because it’s important to get out ahead of it.”
Nick Sullivan, at 43:10
“The threat with quantum computers is that someone in the future will go back and take your encrypted data and decrypt it.”
Nick Sullivan, at 43:14
So you start encrypting with future-proofed algorithms now, he said, whether a quantum computer comes in 10 years, 20, or never. That attack has a name, harvest now, decrypt later: storing encrypted data today and waiting for a hypothetical Q-Day when it can be read (Wikipedia). His LinkedIn says his teams ran the first widespread post-quantum deployment on the internet, with Google (LinkedIn). In 2019, Cloudflare and Google ran two post-quantum key exchanges in TLS 1.3 for 53 days, with Chrome builds on one side and Cloudflare’s edge on the other (Cloudflare). Kevin Kane laid out the harvest attack on episode 96, and our post on harvest now, decrypt later covers what to move first.
Tracking without the tracking
The second prong is privacy-enhancing technologies.
“I think there is a sea change happening in terms of how the internet is monetized.”
Nick Sullivan, at 43:33
“Advertising and personal privacy and tracking are at odds.”
Nick Sullivan, at 43:38
There are proposals, he said, to use cryptography for some of what tracking provided, in a privacy-preserving way. He pointed to a project called DAP, which uses a multi-party computation system to collect analytics privately. Secure multi-party computation lets parties jointly compute a function over their inputs while keeping those inputs private (Wikipedia).
“This is just at the very beginning.”
Nick Sullivan, at 44:09
Trust less
The third prong is confidential computing, and homomorphic encryption is
“the superpower, holy grail of that field.”
Nick Sullivan, at 44:22
The performance still isn’t great, he said, but other advanced cryptography gives you useful pieces: private information retrieval, private set intersection, searchable symmetric encryption. Homomorphic encryption runs computations on encrypted data without decrypting it first. Private information retrieval fetches an item from a database without revealing which one. Private set intersection lets two parties compare encrypted sets and learn only what they share (Wikipedia, Wikipedia, Wikipedia). Today, he said, it’s tied together with trust, contracts and promises.
“You don’t have to trust as much.”
Nick Sullivan, at 45:13
“this gives you something cryptographically verifiable”
Nick Sullivan, at 45:18
Jonathan Mortensen made the same case for AI on episode 75: a promise in a contract isn’t enough.
Phone or cloud
Jon had heard one approach: keep all the data on the device, since devices keep getting more powerful, memory cheaper and silicon cheaper. Nick pointed to AI. New machine learning and LLM applications are humongous, he said, and they don’t fit on phones anymore.
“So you’re going to have to have a hybrid architecture no matter what”
Nick Sullivan, at 46:02
Jon agreed: the models will be ginormous, the computers that run them will sit in the cloud, and there are lots of reasons to use a centralized SaaS service.
“And to be able to do that, like, and preserve your privacy at the same time, is ideal.”
Jon McLachlan, at 46:17
“it’s going to be a talking point.”
Nick Sullivan, at 46:30
On episode 75, Jonathan walked through Apple’s reference architecture for doing exactly that.
Ideas from operators
Jon asked what doesn’t exist that someone should build. Nick, on the inspire-your-audience segment, didn’t have one idea to put on the table: there are so many. Many of the companies he advises started from problems he and his Cloudflare colleagues ran into.
“a lot of the best ideas come from people who are just banging their head against the walls inside of a big company”
Nick Sullivan, at 47:15
The companies that inspire him come from operators, he said: people with a generic problem they know isn’t being solved anywhere else, who go out and solve it.
Follow your curiosity
Jon asked what advice Nick would give his younger self. It’s a hard question, Nick said, and he’s relatively happy where he is.
“I feel like I’m much more of someone who learns through experience and through making mistakes”
Nick Sullivan, at 48:25
As a young person he was always chasing novel ideas and things that change how people interact with technology.
“be curious, my young self”
Nick Sullivan, at 49:16
Curiosity opens up the world, he said, and helps you know yourself.
What happened after the tape
Nick’s next roles. His LinkedIn shows his advisory contract with Cloudflare ending in January 2024, part-time work as head of research at Blind Insight, a searchable-encryption startup he co-founded, from October 2023 to March 2026, a visiting fellowship at the Center for Democracy & Technology in 2025, and a seat on the Internet Architecture Board from March 2026. He still co-chairs the Crypto Forum Research Group (LinkedIn).
Post-quantum went default. NIST finalized its first three post-quantum FIPS standards in August 2024. Hybrid key agreement that pairs classical ECDHE with ML-KEM, standardized as FIPS 203, has been on by default in Chrome since version 131 in November 2024 and in Firefox since version 132, and OpenSSL 3.5, BoringSSL and Cloudflare support it (Wikipedia).
Privacy Pass became a standard. The IETF published the Privacy Pass architecture, authentication scheme and issuance protocols as RFCs 9576, 9577 and 9578 in 2024 (Cloudflare Research).
Tampering got a dashboard. On September 5, 2024, Cloudflare launched a dashboard and API on Cloudflare Radar for connection tampering signals, built on the SIGCOMM work (Cloudflare).
MLS reached phones. In March 2025, the GSMA said version 3.0 of the RCS Universal Profile would support MLS, and Apple said it would support that standard. Google Messages and Apple Messages began rolling out MLS end-to-end encryption over RCS in May 2026 (Wikipedia).
The hostname went dark. Encrypted Client Hello, which encrypts the whole Client Hello including the name of the site, was defined in RFC 9849 in March 2026 (Wikipedia). Nick’s LinkedIn lists him as a co-author of ECH.
A startup he backed. His LinkedIn lists RunReveal among his exits as an investor and advisor. RunReveal announced it was joining ClickHouse on September 1, 2026, as covered on episode 50.
His post on a Berkeley talk. On October 29, 2026, Nick announced a talk at the UC Berkeley Security Seminar, set for November 16, on how a cryptographic construction becomes Internet infrastructure, with the CFRG’s work on post-quantum KEMs as the example. Earlier that month, he co-chaired an IAB workshop on deploying post-quantum authentication (LinkedIn).
Nick on how a cryptographic construction becomes Internet infrastructure.
Nick Sullivan · October 29, 2026
More on this show. Kevin Kane talked about cryptography and the quantum clock on episode 32. Riad Wahby of Cubist argued that security against speed is a false choice on episode 69. On the blog, Harvest Now, Decrypt Later covers which data to move first.
Did you catch it? A seven-question quiz
Seven questions from the episode. Each answer links the moment in the transcript.
Quiz · seven questions
Did you catch it?
Pick an answer to see whether you caught it.
-
What did Nick study at Waterloo?
c. "I studied pure mathematics, actually." Transcript, 0:33.
-
How did Nick describe what Cloudflare does?
a. "it basically sits as a proxy between people and websites or web resources." Transcript, 3:03.
-
What did Nick compare Cloudflare's free customer base to?
b. "So it's kind of like an immune system, if you will." Transcript, 11:26.
-
How long did most successful research projects at Cloudflare take to mature?
c. "three to five years to become fully robust." Transcript, 13:21.
-
What slogan did Nick come up with for the research team?
a. "one of the slogans that I came up with for the research team was, we make friends." Transcript, 16:34.
-
How did Cloudflare find out whether Heartbleed could leak private keys?
b. "So what we did is we came up with this thing called the Cloudflare Heartbleed Challenge." Transcript, 37:21.
-
What did Nick call homomorphic encryption?
a. "the superpower, holy grail of that field." Transcript, 44:22.
Does your security make friends?
Eight questions on whether people bring your security team in, and whether your security holds up in the open. Each tip quotes the tape or paraphrases it, and links its section.
Scorecard · eight questions
Does your security make friends?
Answer for your company as it runs today. If two answers fit, pick the lower one.
-
When engineers start a new feature, when does security hear about it?
- After it ships
- Right before launch
- At the design stage, because they ask us
Jon's second kind of security person is the one the room is glad to see. See Two kinds of security people.
-
How do engineers reach someone with security expertise?
- They file a ticket and wait
- They know who to ask
- A five-minute chat, any day
A five-minute talk with an expert, Nick said, can send a team in a different direction. See A resource or a burden.
-
When you need a cryptographic protocol, what do you use?
- Something we built ourselves
- A library, set up by whoever got there first
- A published standard, such as TLS 1.3 or MLS
Nick's case for concentrating the experts on one final document. See One final document.
-
Does any part of your security depend on keeping the design secret?
- Yes, it's the main defense
- Some of it
- No, it holds up if the design is public
"security based on, like, keeping what you do a secret is not secure." See A secret group in a secret company.
-
Can an outside researcher report a bug and get an answer?
- There's no way to reach us
- An inbox nobody watches
- A published policy, and a reply within days
"So the power of the crowd is strong." See The Heartbleed Challenge.
-
Do you write down what you learn and share it?
- It stays in people's heads
- Internal notes, sometimes
- Write-ups the whole company can read, some of them public
"One of the things that I emphasized in my job at Cloudflare is blogging." See Write it down.
-
Have you started moving data that must stay secret for years to post-quantum key exchange?
- We haven't looked
- We know where that data lives
- Hybrid key exchange is on wherever our stack supports it
Nick's reason to move now: someone can decrypt today's traffic later. See Three prongs.
-
Could a vendor that holds your data read it?
- Yes, we rely on the contract
- Some of it is encrypted with keys we hold
- Sensitive data is protected in a way we can verify
"You don't have to trust as much." See Trust less.
People route around security, and some of it depends on secrets. Start with a standard in place of homegrown crypto, and a way for outsiders to report bugs.
The pieces are there. Next, get into design reviews early, write down what you learn, and find the data that must stay secret for years.
Engineers bring you in, and your security holds up in public. Keep the post-quantum work moving, and trade contract promises for things you can verify.
How many handshakes does a group need?
Nick described the first way to scale two-person encryption to a group: a pairwise handshake between every pair of members. This calculator counts what that costs.
Calculator
How many handshakes does a group need?
Two numbers: the people in the group, and the messages each one sends a day.
Pairwise sessions for a group of 100: 4,950. Encrypted copies of each message: 99. Encryptions a day, at 20 per person: 198,000.
Pairwise means every member keeps a session with every other member, so the count grows with the square of the group. MLS was built so key agreement scales with the size of the group, Nick said, and Wikipedia describes it as designed for groups as large as 50,000. The defaults are placeholders: put in your own group.
From pure math to the Internet Architecture Board
Nick’s path, the protocols he talked about, and the episodes on this site that pick up the thread. Filter by topic.
Timeline
From pure math to the Internet Architecture Board
- CISaC
Cryptography researcher on elliptic and other algebraic curves, during his master's (LinkedIn).
- Symantec
Security analyst, and a co-author of the Internet Security Threat Report (LinkedIn, on this page).
- Apple
The DRM team, where his path crossed Jon's (LinkedIn, on this page).
- Cloudflare
Head of security engineering, when the company had under fifty people (LinkedIn, on this page).
- Heartbleed
The OpenSSL bug is disclosed, and Cloudflare's challenge server gives up its key within hours (Wikipedia, Cloudflare, on this page).
- Universal SSL
Cloudflare makes SSL free for every site (Cloudflare, on this page).
- Head of cryptography
Reporting to the CTO, on everything at Cloudflare that touches cryptography (LinkedIn).
- Privacy Pass
The paper on anonymous tokens for skipping challenges, with Nick among the authors (Cloudflare Research, on this page).
- TLS 1.3
RFC 8446 defines the version Nick worked on (Wikipedia, on this page).
- CFRG co-chair
Co-chair of the Crypto Forum Research Group (LinkedIn, on this page).
- Head of research
He founds Cloudflare Research (LinkedIn, on this page).
- The post-quantum experiment
Cloudflare and Google test two post-quantum key exchanges in TLS 1.3 for 53 days (Cloudflare, on this page).
- iCloud Private Relay
Apple announces the two-relay privacy service (Wikipedia, on this page).
- MLS
Messaging Layer Security is published (Wikipedia, on this page).
- Advisor
From head of research to an advisory contract with Cloudflare (LinkedIn).
- Episode 32
Kevin Kane on cryptography and the quantum clock (episode page).
- SIGCOMM
The connection tampering paper is presented in New York (Cloudflare Research, on this page).
- Episode 38
Nick on the show (Podbean, transcript).
- Episode 50
Alan Braithwaite of RunReveal, whom Nick interviewed at Cloudflare (episode page).
- FIPS 203
NIST finalizes its first three post-quantum standards (Wikipedia, on this page).
- Tampering on Radar
Cloudflare publishes connection tampering signals (Cloudflare, on this page).
- Chrome 131
Hybrid post-quantum key agreement on by default (Wikipedia).
- Episode 61
Taher Elgamal, the father of SSL (episode page).
- Episode 75
Jonathan Mortensen on using AI without giving up your data (episode page).
- Internet Architecture Board
A two-year term on the IAB (LinkedIn, on this page).
- ECH
Encrypted Client Hello is defined in RFC 9849 (Wikipedia, on this page).
- MLS over RCS
Google Messages and Apple Messages begin rolling out MLS encryption (Wikipedia).
- Episode 96
Kevin Kane on the harvest attack (episode page).
- A Berkeley talk
Nick on how a cryptographic construction becomes infrastructure (LinkedIn, on this page).
What to do this week
Five things, in the order of the episode.
- Take the scorecard. Ask whether engineers bring your security team in early, then take the scorecard.
- Use the standard. Swap homegrown protocols for TLS 1.3, and for MLS where you encrypt group messages, as in One final document.
- Give the crowd a way in. Publish how an outside researcher can report a bug, and answer within days, as in The Heartbleed Challenge.
- Start post-quantum with long-lived data. Find the data that must stay secret for years, and turn on hybrid key exchange where your stack supports it, as in Three prongs.
- Get help building it in. Our Product Security work puts security into the design. Our Anti-Reverse Engineering work protects the software you ship. If you want to talk it through, book 15 minutes with us.