Martin R. Albrecht

@malb.bsky.social

906 Followers 302 Following

Cryptography Professor at King's College London and Principal Research Scientist at SandboxAQ. Erdős–Bacon Number: 6. He/him or they/them. https://malb.io

Cover of the paper at https://eprint.iacr.org/2026/1319.pdf
Morpheus (from the movie The Matrix) asking: "What if I told you that ISIS is hard even given a trapdoor"
A screenshot of https://www.ft.com/content/bbdf1851-1255-4217-9544-e87c8044b5cb?syn-25a6b1a6=1
Screenshot of text that reads: All of these challenges arise at a moment when the consequences of large-scale investment in artificial intelligence are being widely discussed in regard to warfare, mass surveillance, political disruption, and environmental damage. These raise grave ethical concerns. By failing to act, we run the risk of becoming complicit in the support of technologies which threaten much more than the practice of mathematics. We thus feel that there is an urgent need for a considered response from the mathematical community. The following constitute brief descriptions of actionable recommendations. We encourage professional organizations to endorse this Declaration, and to add provisions according to their own values, priorities, and governance.
We're hosting an Autumn School in London, UK, from 15 to 17 September 2026, to bring together ethnographers and cryptographers to discuss ways in which the two fields can be meaningfully brought into conversation. This is also the premise of our Social Foundations of Cryptography project: to ground cryptography in ethnography. Here, we rely on ethnographic methods, rather than our intuition, to surface security notions that we then formalise and sometimes realise using cryptography. Our intention is to 'flip' the typical relationship between the computer and social sciences, where the latter has traditionally ended up in a service role to the former. Rather, we want to put cryptography at the mercy of ethnography. But how do we do this? How do we as cryptographers interact with and make sense of ethnographic field data? How can we refine, improve or extend this interaction? What obstacles do we face when we make cryptography rely on ethnographic data which is inherently 'messy'? How do we handle that cryptographic notions tend to require some form of generalisation but ethnographic findings can only be particular? How do ethnographers retain the richness of ethnographic field data in conversations with cryptographic work? Indeed, our project has already highlighted some limitations of our approach. It has brought to the fore concrete challenges in 'letting the ethnographic data speak' while still making it speak to cryptography. The Autumn School is an opportunity to explore these questions jointly across ethnography and cryptography, through a series of talks, group discussions and activities. We say a bit more about the programme and registration for the Autumn School here.
Screenshot of https://uk-crypto-day.github.io/2025/09/11/uk-crypto-day/ with text: Rikke Bjerg Jensen & Martin Albrecht: At-Compromise Security: The Case for Alert Blindness We start from the observation (Blanchette’12) that cryptography broadly intuits security goals – as modelled in games or ideal functionalities – while claiming realism. This stands in contrast to cryptography’s attentive approach towards examining assumptions and constructions through cryptanalysis and reductions. To close this gap, we introduce a technique for determining security goals. Given that games and ideal functionalities model specific social relations between various honest and adversarial parties, our approach is grounded in a careful social science methodology for studying social relations in their contexts: ethnography. As a first application of this technique, we study security at-compromise (neither pre- nor post-) and introduce the security goal of alert blindness. Specifically, as observed in our 2024/2025 ethnographic fieldwork with protesters in Kenya, alert blindness captures a security goal of abducted persons who were taken by Kenyan security forces for their presumed activism. It may have applications elsewhere. Joint work with Simone Colombo and Benjamin Dowling. See also: Social Foundations of Cryptography Bios. Rikke Bjerg Jensen is a Professor in the Information Security Group at Royal Holloway, University of London. Her work is ethnographic and grounded in explorations of information security practices and needs among groups of people living and working at the margins of societies. Martin Albrecht is a Professor of Cryptography at King’s College London. He works broadly across the field of cryptography but focuses on the analysis of deployed or soon-to-be deployed cryptographic solutions and on analysing the security of lattice-based cryptography against classical and quantum computers.
Website excerpt: Here, the authors consider a whistleblower setting which then motivates the definition of ring signatures. Thus, a ring signature claims to be at least also a formalisation of the social setting in which a member of a group wishes to alert outsides to something without revealing themselves while still convincing the outsider that they have access to the information being leaked. Put differently, cryptography presumes and models social relations. As such, cryptography is also a social science. However, cryptography is unaware of itself as a social science and we cryptographers more or less speculatively make up the social settings we model in our paper’s introductions. I highly recommend Jean-François Blanchette’s “Burdens of Proof: Cryptographic Culture and Evidence Law in the Age of Electronic Documents” for a deeper dive into this observation. This begs the question if cryptography gets that part of its models right? In general, we work hard to have precise definitions and definitional work is a central activity of cryptography. Yet, the correctness of this part of the definitional work is usually simply presumed: “On these questions, the literature remains silent” as Blanchette put it.
Article extract: From what he could see, the data leaving, almost all text files, added up to around 10 gigabytes — or the equivalent of a full stack of encyclopedias if someone printed them, he explained. It's a sizable chunk of the total data in the NLRB system, though the agency itself hosts over 10 terabytes in historical data. It's unclear which files were copied and removed or whether they were consolidated and compressed, which could mean even more data was exfiltrated. It's also possible that DOGE ran queries looking for specific files in the NLRB's system and took only what it was looking for, according to the disclosure.
An excerpt from the linked FT piece that reads: "So the fight for domination of the future payments system is on — and the US wants to win. The broader European public may be blissfully unaware. But those in charge of the Eurozone are also determined that this battle for technological control over the economy is one that the EU must not lose. This is the fundamental motivation for the digital euro — a central bank-issued official digital currency that, if done well and fast enough, will rival or outperform the attractiveness of dollar stablecoins."
Given recent instances of US visa holders and residents being detained or deported by US immigration authorities, we understand that some members of our community may not feel safe traveling to the US for Crypto this year. We want to assure everyone that we will provide the option to present and attend remotely.
Wednesday, May 7, 14:30-16:00 (Room TBD): Cryptography in a Changing World: Navigating Geopolitical Uncertainty and Security Risks Join us to discuss what we as a community can and should do in light of a dramatically changing political landscape, both domestically for some of us and internationally for all of us. We don't have ideas to pitch to you, but we think it will be useful to meet and to start a discussion. For more information: Martin Albrecht and Kenny Paterson.
Drake No: A(s,e) + A(t,d) Drake Yes: UAO
A worrying trend in this area is that vendors “outsource” this process to “bug bounty” service providers. These services are based around the idea of vulnerability disclosure being financially rewarded, often in return for some form of agreement on non-disclosure. This process is unsuited to the activities considered here; both with regard to their motivation – improving security independently of financial reward – and with regard to their content – cryptographic vulnerabilities are rarely disclosed and thus the industry around vulnerability disclosures and bug bounties is inexperienced in dealing with them. We recommend avoiding any intermediaries in the disclosure process, since they may impose their own policies with negative consequences. For example, our disclosure of the previously mentioned plaintext recovery attack against (Open)SSH  was hampered by us going via the UK’s Centre for the Protection of National Infrastructure, resulting in the following notification on the OpenSSH project webpages: The OpenSSH team has been made aware of an attack against the SSH protocol version 2 by researchers at the University of London. Unfortunately, due to the report lacking any detailed technical description of the attack and CPNI’s unwillingness to share necessary information, we are unable to properly assess its impact.[1] [1] See https://www.openssh.com/txt/cbc.adv.