Security, Science & HardwareDone with Claude Code Nov 1, 2025
Debug low-level cryptography code
Cryptography engineer Filippo Valsorda's write-up on Claude Code debugging low-level crypto.
- What They Did
- Filippo Valsorda ran Claude Code (Opus 4.1, no system prompt) on his new Go ML-DSA implementation. His prompt named the test command and code directory, described the failing symptom, and asked it to think hard. It read the code and traced the bug. It also tested a hypothesis with a small test of its own. He then repeated this on two earlier signing bugs, using a fresh session for each.
- How It Went
- It found all three bugs in one shot without help. The Verify bug took minutes: high bits were taken twice. Its proposed fixes were mediocre, so Valsorda threw them away and rewrote them himself.
- Worth Knowing
- Use well-scoped failing tests, start a fresh session for each independent bug, and treat the agent's output as a pointer to the bug, not a fix to merge.
Try it yourself with Claude Code
I have a failing test in my cryptography code at [path], where [describe the symptom, e.g. wrong output for certain inputs]. Investigate why it fails, compare against [reference implementation or test vectors], and propose a fix. Finished means the tests pass and you've explained the root cause, and you should show me the diff before changing any files.