A cryptography guide distinguishes algorithm choices from protocol design

Filippo Valsorda’s updated cryptography guide maps common engineering tasks to concrete choices: managed keys for cloud encryption, Argon2id or scrypt for passwords, and hybrid post-quantum key exchange within established protocols. Its most useful boundary is architectural: selecting primitives is not permission to invent a protocol. The recommendations assume no stricter compliance regime and include explicit qualifications about draft standards and library availability.

Filippo Valsorda · Oct 12, 2026

Why it matters

A focused reference for reviewing old cryptographic defaults without designing a new cryptosystem.

More context

Read the relevant task section with your security reviewer. The guide discusses using ML-KEM-based exchange through TLS, SSH or HPKE rather than constructing your own exchange, and distinguishes password storage from phishing-resistant login.

Keep in mind

These are the author’s engineering recommendations, not a universal compliance standard or a guarantee that every library exposes the suggested configuration.

Original read