We’re experts  in real-world systems security.

The Cubist team is uniquely qualified to build products that real people use to protect real things.

Our work secures systems you use every day.

CubeSigner is the culmination of decades of our academic work securing production systems.

Key management is a familiar security problem.

Web3 teams are used to either/or decisions when it comes to their keys: whether to keep keys safe from attackers, available in memory, or hidden from end-users.

We designed CubeSigner using a battle-tested toolbox.

This isn’t the first time we’ve developed new technology that exposed false engineering tradeoffs.

Let’s Discuss Your Needs

We’ve published more than 80 peer-reviewed papers about building and breaking hardware, operating systems, language runtimes, compilers, web browsers, and cryptographic protocols—and our security research actually makes it to the real world.

Prior to Cubist, our founders designed the low-level cryptography underlying Ethereum and Avalanche, shipped software sandboxing in the Firefox browser, identified high-severity security vulnerabilities in Google Chrome, and more.

Our sandboxing systems let browser developers use fast (but unsafe) third-party libraries safely. Our verification tools let companies run untrusted code without worrying about attackers or huge runtime costs. And our compilers let crypto engineers write code in convenient, high-level languages—without giving up on low-level performance or security.

CubeSigner doesn’t force teams to choose between security, performance, and convenience, thanks to the same trusty toolbox we’ve used before: information flow control, formal verification, compartmentalization, and intentionally simple cryptography.

We’ve seen this decision matrix before: it’s there when crypto engineers fight their compilers to write safe, constant-time code, and it’s there when browser engineers begrudgingly render PDFs with unsafe libraries.

As in these domains, the tradeoffs faced by Web3 teams reflect the limitations of existing tooling—they aren’t a fundamental law of nature.

We’ve spent decades pushing the boundaries of security.

Secure Systems

Our expertise is deploying systems that are safe against real attackers.

Bug Finding

We also know how attackers find and exploit bugs in the wild.

Cryptography

We are experts in the theory and practice of cryptography.

Formal Verification

We don’t just design and implement secure systems—we also prove them correct.

We shipped the framework that protects millions of Firefox users from bugs in third-party libraries, built the first commercial system to isolate enterprise secrets from untrusted Node.js libraries, proved that production sandboxes actually keep users safe, and deployed privacy-enhancing tools to millions of Brave users.

We care about ecosystem security, too: our team members have authored IETF and W3C specifications, serve on the Bytecode Alliance board and (formerly) the Node.js Security Working Group, and received the IEEE Cybersecurity Awards for Practice and a Test of Time award for influential academic research on security.

We’ve discovered over two dozen high-severity, bountied, or CVE-carrying bugs in Chrome and Firefox.

We’ve developed exploits that exfiltrate passwords from Chrome’s Password Leak Detection tool and that reconstruct users’ browsing history in four major browsers.

Finally, we've discovered vulnerabilities in modern processors.

We were among the first researchers in practical zero-knowledge proofs, including the first hardware design and one of the fastest known provers.

We designed and standardized the cryptographic primitives that power Ethereum, Avalanche, and many other blockchains, deployed privacy-preserving airdrops, developed cutting-edge compilers for ZK proofs and MPC protocols, built the fastest GPU implementations of AES and SHA3, and created domain-specific languages that prevent timing side channels.

In short, our expertise runs the gamut from cutting-edge theory to low-level implementation.

To protect users from remote attackers trying to steal data or compromise machines, we’ve proven that parts of the Firefox just-in-time compiler and the Cranelift Wasm compiler do what they’re supposed to.

We've proven that software and hardware crypto implementations are resistant to side channel attacks. And, our team includes core developers of foundational tools for proving correctness, tools that companies like Amazon and Certora rely on.