David Nugent's Portfolio

To understand my career path and attributes, a good starting point is my education at secondary school level. I used the Irish equivalent of the SATs, the Leaving Certificate, as an opportunity to prove myself and gain confidence. I got the maximum number of points possible, 625, which means I scored over 90% in six varying subjects. Another confidence boost for me came unexpectedly, when I was one of three students in Ireland to get 100% in the Applied Mathematics exam.

For university, I chose to study Computer Science, because I had tried out programming a few times before and felt that I had a natural talent for it. Being a Dubliner, Trinity College was my destination.

Trinity has a historic set of exams that students can sit in second year, named Schols, which give people the opportunity to gain a full five-year scholarship, along with accommodation and meals. I really wanted to move out, so I gave it everything I had. I managed to win the scholarship, placing first in Computer Science.

After I got Schols, I wanted to start prioritizing creation over examination. When the first covid lockdown happened, I kept myself occupied by doing some online courses in AI. I then made a mobile app named BarPath which uses AI to track the path that a barbell takes during weightlifting. The more straight the path, the more efficient the lift. This was my first time training an AI model, and also my first time making a free product which was used and enjoyed by real people.

During the third year of my degree, I got involved with a new self-driving racecar team in Trinity, Formula Trinity Autonomous. Making new friends on this team got me through the remaining lockdowns. It was so much fun to work with like-minded people, while learning about autonomous vehicles. That year, I was the Perception Lead.

The highlight of our year was running the AI Grand Prix, a virtual autonomous racing competition for college students. Installing robotics software was a big barrier to entry, so I developed a system which allowed competitors to write a simple Python script which took LiDAR data as input, and output a speed and steering angle, abstracting everything else away from them.

Meanwhile, to earn some money, I had been correcting Applied Maths exams for my old teacher, Oliver Murphy. When he decided to write his new textbook, he took me on board to write the teacher's solutions to the book's questions, and to provide suggestions about its contents.

At the end of third year, I felt it was time for some industry experience, so I applied for an internship in Evervault, an early-stage cryptography startup in Dublin. Their interview process at that time involved choosing a project from their website. I didn't know what they were expecting, and I felt afraid of not impressing them enough, so I tried to get it done as soon as possible, to a high standard. The result was a Python implementation of the Raft consensus algorithm, written in less than two days.

That summer, as Evervault's sixth employee, I experienced the intensity, pressure, and excitement of an early stage startup. I also became proficient in Rust, which helped me to mature as a programmer.

When I returned to college for my final year, the Autonomous team was finally working together in-person. This year, I got to lead the team with two of my best friends. I was tasked with leading the software engineering, which gave me the chance to take the skills I'd learned in Evervault, and use them in my own leadership style.

Our first competition was F1Tenth, in Prague, where we programmed an autonomous RC car to whir around the track autonomously. We were really proud about this, because we'd only received the vehicle six days before the competition.

A few months later, we competed at the Formula Student AI competition at the Silverstone Formula 1 racetrack. We won the Best Newcomer award, which we were chuffed with, because this competition had been the target of the Autonomous team since its inception.

For my undergrad thesis, I combined my interest in AI with my newfound cryptography interest, by proposing my own idea: using homomorphic encryption in credit card fraud detection AI models. It has a bunch of citations.

When I graduated with a First, I went back to Evervault for a year. I wanted to try out the forty-hour-a-week lifestyle of a career software engineer. I think Evervault was a great place to do that, because they have a combination of interesting, challenging, technical work along with the stability of venture capital funding. It also gave me the chance to sit beside and learn from excellent engineers.

I began working on the Enclaves team, where we built Evervault's confidential computing solution. Once that product was launched, I got to lead a couple of projects myself: File Encryption and Optimizing the Encryption Engine. I had previously led teams in Formula Trinity, but this assured me that I could also do it in the 'real world'.

When working at the cutting edge, I often have ideas that I want to put in writing. Here are a few of the blog posts I made for Evervault about topics I found important or interesting.

I felt that I had ideas which I couldn't explore while I was working full-time for one company. AI was also causing the world of software engineering to be in constant flux, and I wanted to experiment with my own ways of working with it.

I decided to start freelancing. I think it was the right choice, as I was able to learn lots of new skills, express my creativity, and I was happier than before. For IP reasons, I can't discuss every project I did as a freelancer, but some of the skills I picked up included WebGL, WebAssembly, ThreeJS, Unity, Production LLM Usage and more. AI helped me to learn these new skills a lot quicker.

I continued doing some technical writing for Evervault. This gave me a chance to play with my passion for education. I wrote some blog posts that combined text with other mediums, such as code, diagrams, and most importantly – mathematical visualizations.

I had made educational material before, but it was all based around autonomous vehicles.

The maths visualizations I was doing in my new blog posts put me in contact with the founder of Retainit, a startup which was building games to help people retain important information. Retainit was the first client I worked with on a fixed-hour contract.

An early collaborator with Retainit was 3Blue1Brown, the biggest maths YouTuber (6M+ subs), whose maths software I had used in my blog posts. We made games for his viewers which featured interactive maths components, to ensure that they got to exercise the tinkering parts of their brains. They were very well received!

My work with Retainit spanned software engineering, project management, and R&D. One of the prototypes I made for them was an AI game show in which the AI host controls what happens in the webpage. This was one of the first demos of a voice agent controlling elements in a user's browser.

The more I worked with companies, the more I felt that the best use of my skillset was in R&D. I enjoyed and excelled in ideation, prototyping, writing up proposals, and figuring out the best way to achieve something. I wanted to lean further into research in my next fixed-hour contract, so I decided to prepare myself by practicing R&D in my spare time. The first output of this was an article titled Is Homomorphic Encryption ready to solve the AI Privacy Problem?

One of the benefits of my flexible schedule was that I had time to mentor young people in technology, something I found very fulfilling.

I heard about the threat posed by quantum computing to cryptography, and found post-quantum cryptography interesting. However, I still shrugged it off mostly as "quantum computers have only factored the number 15, right? So the attacks must still be decades off."

Then I was introduced to the founders of Project Eleven, a company that had been started a few weeks beforehand. They were focused on the quantum threat to digital assets. I took on some early contract work with them, which involved researching how broad and deep this threat really was. My mind was changed after that research, and I was convinced that this was a problem worth working on immediately.

Focusing on cryptography again was a reminder of how well it aligned with my detail-oriented, sceptical, passionate personality, along with my computer science and mathematics skills. I decided I wanted to focus on cryptography and cybersecurity for the next several years. I figured Project Eleven would be a great place to do that, as the founders were highly competent, and great leaders.

During my time at Project Eleven, as a Founding Engineer in a small team, I worked on many areas including R&D, production-grade engineering, technical writing, project management, and leadership. My applied cryptography experience continued to deepen, including the low-level usage of cutting edge post-quantum schemes. We became known as the first experts in analysing and solving the quantum threat to digital assets, and our work was often cited by the most credible people in the blockchain ecosystem, e.g. Justin Drake of the Ethereum Foundation.

This expertise was also recognised by investors, which enabled us to raise a $6M seed round and a $20M Series A.

Here are my favourite engineering projects that I was part of:

yellowpages: the first service for giving Bitcoin owners post-quantum proof of ownership. It worked by giving users post-quantum keypairs, and creating a TEE-proof that the owner of the Bitcoin wallet also owns these post-quantum keypairs. If their wallet is stolen by a quantum attacker someday, they would still have their post-quantum keypairs as evidence that they owned their Bitcoin wallet before Q-day happened.

My favourite technical achievements in yellowpages were:

• It performed an ML-KEM handshake over WebSockets to achieve post-quantum security in transit for all yellowpages users.
• It was one of the first production, audited uses of the NIST-standardized post-quantum signature schemes ML-DSA and SLH-DSA.
• It achieved state-of-the-art secure connections directly into AWS Nitro Enclaves TEEs from the browser, by using ML-KEM+AES-256 for encryption and providing a session attestation document during the ML-KEM handshake.
• It was the first service to provide people with post-quantum proofs of Bitcoin ownership, along with a whitepaper describing the ultimate vision for this idea.

Bitcoin Risq List: the first accurate, open-source, weekly analysis of the quantity of quantum-vulnerable Bitcoin. This became the go-to reference for the quantum risk to Bitcoin.

howbigistoobig: an interactive 3D visualisation that compared the size and performance of post-quantum signature schemes to their classical predecessors.

Is My Browser Quantum Secure? An automatic check that ran when visiting the Project Eleven landing page, which detected if your browser supported post-quantum TLS.

Stealth: I did a lot of cutting edge R&D for future Project Eleven products, but those haven't been released yet, so can't be discussed.

The quality of the Project Eleven blog was a demonstration of our technical skills, and a significant contribution to spreading awareness about the post-quantum threat to digital assets.

Here's a list of my favourite technical blog posts that I wrote or co-wrote:

• The risk of quantum to classical cryptography: Project Eleven's initial analysis of the quantum threat, which confirmed the hypothesis that it was worth working on immediately.
• The Trust Model of yellowpages v1: technical breakdown of the trust model of yellowpages, making all trust assumptions explicit. Trust models are often left for the user to figure out, and can be a grey area, but we wanted to be up-front about it for yellowpages.
• Guaranteeing post-quantum encryption in the browser: ML-KEM over WebSockets: technical breakdown of how yellowpages established a post-quantum encrypted channel using ML-KEM and AES between the user's browser and the TEE server.
• TEE Attestation from the Browser: technical breakdown of how yellowpages established an attested connection to the TEE server to establish trust before transmitting any sensitive data.
• The State of Post-Quantum Cryptography in Rust: The Belt is Vacant: an assessment of the landscape of post-quantum cryptography packages in Rust. This is likely outdated by now, but was highly relevant at the time.
• Surprises while verifying post-quantum signatures on a MacBook: a technical breakdown of findings while verifying ML-DSA signatures on a MacBook, which provided lessons for others who were designing post-quantum signature verification systems.

I had the opportunity to co-write a cryptography research paper, Lattice HD Wallets: Post-Quantum BIP32 Hierarchical Deterministic Wallets from Lattice Assumptions. This was the first post-quantum HD wallet construction that recovers BIP32's full public key derivation functionality with provable security under standard assumptions.

We did R&D work to advance post-quantum security for the Solana Network, in collaboration with the Solana Foundation. The reports we made were never released, so I can't go into detail on the work we did, but it was a great computer science milestone to work on the low-level cryptography of a high-performance blockchain.

I learned how to build a technical brand for both the company and myself, through consistent meaningful technical posts on LinkedIn and X.

Some of my favourite memories are of attending conferences with my Project Eleven colleagues, in which I got a chance to engage in technical discussions with experts at the cutting edge of both post-quantum cryptography and blockchain technology.

Most importantly though, they were an opportunity to hang out with great teammates!

Next, I intend to start a small Cryptography and Cybersecurity consultancy / R&D lab. But I'm currently doing some travelling before that.