Profile picture

Markus Schiffermüller

About Me

Hi, I am a Cryptography Security Engineer at Trail of Bits, where I audit cryptography and work on security research.

Previously, I worked on applied cryptography with Maria Eichlseder at ISEC, TU Graz. I completed my Master’s thesis under the supervision of Carmela Troncoso at the SPRING lab at , where I built a censorship circumvention system that enables covert communication through messaging apps without end-to-end encryption. During my internships at Trail of Bits, I found vulnerabilities in open-source cryptography libraries and worked on making the Tamarin protocol verifier use less memory and resume interrupted proof searches.

I am interested in security broadly, with a particular soft spot for cryptography. This blog is where I share things I have worked on, learned, or found interesting.

I used to compete in Capture the Flag (CTF) competitions with my friends at LosFuzzys. I was team captain from July 2022 to October 2023 and have helped organize workshops, talks, and started the GlacierCTF.

The views expressed on this blog are my own and do not represent those of my employer or any other organization. All content is provided for educational and informational purposes only.

Recent Posts

GlacierCTF 2025 - AES Zippy

This year, I once again had the opportunity to contribute to Glacier CTF for its fourth edition. The challenge, AES Zippy, is designed for players with intermediate familiarity with cryptography, specifically focusing on AES-GCM.

Glacierctf 2024 - AES Overdrive

I had the pleasure of providing a challenge for the third iteration of the Glacier 2024 event in the crypto category. It is a symmetric encryption challenge that is split into an easier first stage and a more challenging second stage, which revolves around symmetric cryptanalysis to recover a round key of AES.

Google CTF 2023 - myTLS

During the Google CTF 2023, my college and I encountered a fascinating challenge which was TLS themed. The task at hand involved exploiting files writes, hashes and signatures.

News

Our work on Content-Based Censorship was accepted for a talk at RWC 2026
A blog post I authored about wycheproof got published on the Trail of Bits Blog
I am going to attend Real World Crypto 2025. See you there.
During my internship at Trail of Bits, I wrote a guide to shed some light on how to test cryptographic implementations to ensure correctness against common mistakes and timing attacks, which was published in the Trail of Bits testing handbook
During my internship at Trail of Bits, I found multiple vulnerabilities in elliptic, one of the most popular elliptic curve libraries for javascript CVE-2024-48949, CVE-2024-42461