Álvaro López
I design distributed systems and then make them hard to attack: cloud-native platforms, blockchain infrastructure, and the networks that connect machines to each other. TrustSentinel is the name under which I publish the tools and research that endured.
Most of my code is on GitHub. I write on the blog (RSS). To reach me, open an issue on the project you are writing about. Every repository has a security policy with the channel for vulnerability reports; please use it for anything sensitive.
Trajectory
Eighteen years across distributed systems, cloud-native platforms and security. The drift went from high-load systems toward security architecture and decentralized-network research.
- 2006–2014, high-load distributed systems. Distributed, fault-tolerant server platforms at scale on the JVM: performance tuning, heap analysis, cross-platform systems architecture. Java, Spring, Python, Redis, RabbitMQ, Cassandra.
- 2014–2021, cloud-native architecture and SecDevOps. Systems for 10K+ concurrent users. Early Docker, Redis sharding, Kubernetes, CI/CD and event-driven pipelines, Linux tuning, infrastructure as code, and security hardening entering the practice. Go, .NET, Node.js, Kubernetes, AWS, GCP, Terraform. The first TrustSentinel projects were born here: stuk (2018), marshmallows and stk (2019).
- 2021–2022, platform security and private cloud. Security engineering for high-traffic infrastructure: a DIY private cloud on OpenStack, Kubernetes-bound clusters, infrastructure as code and OS-level hardening down to sub-10 ms P99 latency.
- 2022–2024, blockchain and custody security. Secure custody for Bitcoin and multi-coin: Lightning Network, hardware key custody (FIPS 140-2 Level 4 HSM), IAM, secrets management, STRIDE threat modelling, audit-grade event sourcing.
- 2020–now, decentralized-network security and zero trust. Doctoral research on the attack surface of blockchain peer-to-peer networks, decentralized identity (DID/SSI), self-custody and Layer 2, alongside zero-trust architecture, service-mesh microsegmentation (Istio, Cilium) and AI/LLM security governance. netso (2020), argos and eth-rlp (2024) were born here.
Projects
One pattern repeats across them: a device proves its identity with a Noise handshake, dials out to a broker, and never listens on an open port.
- netso (2020). Secure decentralized platform: self-sovereign identity and end-to-end encryption, with a Kubernetes operator. Top 10 at the INCIBE National Cybersecurity Competition 2020.
- marshmallows (2019). Secure mesh networking for IoT: an encrypted peer overlay with WebAuthn and TOTP, Tailscale-like. INCIBE 2019. Rebuilt in 2026 as version 1.0.
- stk (2019). Lightweight broker for browser-based remote shells over the Noise Protocol. INCIBE 2019.
- stuk (2018). SSH access management with port knocking and MFA/TOTP. INCIBE 2018.
- argos (2024). Distributed P2P blockchain network scanning and vulnerability-analysis pipeline.
- eth-rlp (2024). RLP codec for Ethereum node discovery (discv4) packets.
- malware-analysis (2018). Static analysis and forensic case studies.
Next
Not public yet: whispermesh, an experimental Noise-over-WebRTC chat in Rust and WebAssembly. Next on the list: a P2P security observatory built on argos, and a formal model of the netso handshake. Both will show up on the blog first.
Security
Starting from 2018 I took part in the INCIBE National Cybersecurity Competition (Spain) with three projects: stuk was a finalist in 2018, marshmallows and stk in 2019, and netso reached the top 10 in 2020.
All my security research is defensive. Experiments run on systems I own, isolated labs, testnets, intentionally vulnerable environments and public datasets. I follow coordinated disclosure.
Research
Since 2020 I have been doing doctoral research on the security of blockchain peer-to-peer networks: how to discover vulnerabilities in the node population of Bitcoin and Ethereum from the outside, and how to measure the exposure of a decentralized network over time. argos and eth-rlp are the tooling side of that work.
Domains
- Security and architecture. Zero trust, security by design, threat modeling (STRIDE, PASTA), NIST 800-53 and 800-207, ISO 27001, OWASP ASVS and SAMM, security governance, DevSecOps.
- Distributed and cloud. Distributed systems, microservices, event-driven architecture, Kubernetes, service mesh (Istio, Cilium), AWS, GCP, OpenStack, Terraform.
- Identity and cryptography. IAM (Keycloak, Okta, Cognito), OAuth, SAML, OIDC, PKI and mTLS, HSM custody (FIPS 140-2), decentralized identity (DID/SSI), end-to-end encryption, Noise Protocol.
- Blockchain and AI security. Bitcoin, Lightning and Layer 2, Ethereum, smart-contract security, P2P protocols, self-custody, OWASP LLM Top 10, MITRE ATLAS, NIST AI RMF, prompt-injection defense.
Talks and papers
Slides and papers will be listed here as they get published.
Principles
- Identity comes before the network. A machine should prove who it is before anything is allowed to reach it. An IP address and a port are not an identity.
- The best attack surface is the one that does not exist. Dial out, never listen. Most of my projects are variations of this idea.
- End-to-end or it does not count. A relay that can read the traffic is inside the trust boundary whether you like it or not, so say so in the threat model.
- You cannot secure what you do not measure. Decentralized networks are full of assumptions about their nodes that nobody checks. The data is public and the checking is cheap.
- Simple beats clever. The simplest architecture that satisfies the threat model is the one that will still be secure in five years. This site is a few files of HTML for the same reason.
- Security research should be defensive and reproducible: isolated labs, testnets, your own systems, coordinated disclosure.
- A language model is an untrusted input processor. Whatever it reads can try to instruct it. Design for that, do not hope against it.