New dates! Practical TLS and PKI Training - 23-26 Feb 2026. We have a limited number of Early Bird tickets available. From Ivan Ristic and with Scott Helme, based on Bulletproof TLS and PKI. www.feistyduck.com/training/pra...

Cryptography & Security Newsletter is out! In the October issue: Web PKI Ditches TLS Client Authentication - How Many Public PKIs Are There? - Impact on Certificate Transparency Short News www.feistyduck.com/newsletter/i...

Halloween Discount on Practical TLS and PKI Training! 🎃 $500 off on the final training of the year, Nov 10-13. For devs and sysadmins: how to deploy secure servers and design secure web applications www.feistyduck.com/training/pra...

Tile trackers, used by 88 million people worldwide, send critical data without encryption. archive.ph/GyFtT

David Adrian (who works for Google on Chrome security) doesn’t think Web PKI needs revocation. dadrian.io/blog/posts/r...

Filippo Valsorda is looking at how to best archive CT logs for posterity. groups.google.com/a/chromium.o...

Over at CA/Browser Forum, post-quantum cryptography is now part of S/MIME Basic Requirements, via ballot SMC013. cabforum.org/2025/07/02/b...

The previously failed attack on lattice-based cryptography is allegedly coming back after fixes. www.linkedin.com/posts/bart-p...

A whistleblower has sued Meta over alleged WhatsApp security flaws. web.archive.org/web/20250908...

Apple’s new phones come with a new feature called Memory Integrity Enforcement, which makes exploitation more difficult. www.linkedin.com/posts/activi...

Video recordings of DigiCert’s World Quantum Readiness day are now available. www.digicert.com/world-quantu...

Luke Valenta writes at length about the difference between post-quantum cryptography and quantum security technology. You need the former, not necessarily the latter. blog.cloudflare.com/you-dont-nee...

Virtual SIM cards (eSIMs) are making it easier to switch phone providers, but many seem to route network traffic via unexpected remote places, such as China. alertify.eu/silent-esim-...

In Russia, a new, government-sponsored chat app is being preinstalled on all new phones. It’s been called a privacy nightmare. www.forbes.com/sites/thomas...

Trail of Bits released Algo v2.0.0, the next generation of its personal VPN tooling.

There is some movement toward QWAC adoption (via Stephen Davidson); ETSI EN 319 411-2 and ETSI TS 119 411-5 are the relevant standards. www.linkedin.com/posts/srdavi...

Jan Schaumman has looked at the deployment of post-quantum cryptography among top websites. www.netmeister.org/blog/pqc-use...

IPng Networks has published its third post covering the details of CT log operation. ipng.ch/s/articles/2...

The Internet Security Research Group is hiring fundraising professionals.

Apple is looking to hire a PKI engineer for its Crypto Services team. jobs.apple.com/en-us/detail...

Akamai and Amazon CloudFront have added support for post-quantum cryptography. www.akamai.com/blog/securit... aws.amazon.com/about-aws/wh...

From February 2024 through August 2025, Fina CA issued twelve unauthorized certificates for the 1.1.1.1 IP address used by Cloudflare. blog.cloudflare.com/unauthorized...

Cryptography and Security Newsletter: Over 500 GB of source code, work logs, and internal communication records pertaining to the technology behind (or related to) the Great Firewall of China has been leaked. gfw.report/blog/geedge_...

Cryptography & Security Newsletter is out! In this issue: - Waiting for Static CT Logs - Short News www.feistyduck.com/newsletter/i...

New dates! Practical TLS and PKI Training - Nov 10-13 2025. And if you can't wait that long, we still a few tickets for the training next week. Join us! From @ivanristic.com and with @scotthelme.bsky.social www.feistyduck.com/training/pra...

Cryptography & Security Newsletter is out! In this issue: - Google Debuts Device-Bound Session Credentials Against Session Hijacking - Selected Usenix Security ‘25 Papers - Short News (so many this month!) www.feistyduck.com/newsletter/i...

Cryptography & Security Newsletter is out! In this issue: - Encrypted Client Hello Approved for Publication - Short News www.feistyduck.com/newsletter/i...

Daniel Stenberg’s curl supports 11 TLS backends; 6 of those are OpenSSL forks. daniel.haxx.se/blog/2025/06...

Greg Rubin at CryptoGotchas discusses why, in cryptography, domain separation matters. gotchas.salusa.dev/domain_separ...

Cloudflare updated Orange Meets, its open-source video-calling application, with support for end-to-end encryption blog.cloudflare.com/orange-me2ee... using Messaging Layer Security (RFC 9420). datatracker.ietf.org/doc/rfc9420/

Until recently, Amazon was making its public certificates available only on its own infrastructure—but not any longer. It’s now possible to export generated certificates, for a fee. aws.amazon.com/blogs/aws/aw...

Let’s Encrypt is getting ready to issue certificates for IP addresses, but not everyone is happy about it. news.ycombinator.com/item?id=4437...

Logjumps is a recently discovered technique for modular reduction over large prime fields. baincapitalcrypto.com/a-deep-dive-...

Latacora’s Cryptographic Right Answers: Post Quantum Edition is nearly a year old, but it’s still a good read. www.latacora.com/blog/2024/07...

A Trail of Bits blog post by Benjamin Samuels highlights that private key compromise is the single biggest cause of cryptocurrency hacks, at 43.8 percent. More importantly, the blog post focuses on how protocols can be designed to resist this class of attack.

The ACME Renewal Information (ARI) extension has been published as RFC 9773. When this extension is supported, CAs can signal to clients the need to rotate certificates earlier—for example, if they need to be revoked. datatracker.ietf.org/doc/rfc9773/

Ryan Hurst is not happy with CAs and thinks that there’s a disconnect between those who are making decisions and those who are dealing with the consequences. unmitigatedrisk.com?p=1041

Matthew McPherrin has dug into Mozilla’s telemetry data to show us the most often encountered public CAs in Firefox.

If you’d like to learn more about quantum computation, take a look at Peter Shor’s lecture notes from 2022. math.mit.edu/~shor/435-LN/

IBM says it will deliver Quantum Starling—a large-scale, fault-tolerant quantum computer—by 2029. www.ibm.com/quantum/blog...

New Java and C# releases of the Bouncy Castle library improve post-quantum cryptography and interoperability. www.bouncycastle.org/resources/bo...

Twitter has a new protocol for encrypted direct messages, but it’s not great. Matthew Garrett mjg59.dreamwidth.org/71646.html and Matthew Green blog.cryptographyengineering.com/2025/06/09/a... explain in more detail.

KEYMASTER talks about certificate linting for private PKIs. www.ejbca.org/resources/ke...

The Electronic Frontier Foundation is weighing in on the European Union’s “encryption roadmap,” which continues to push for access to private communication. www.eff.org/deeplinks/20...

Frank Denis makes a passionate plea for better user interfaces for OpenSSL cipher suite selection. 00f.net/2025/06/06/c...

The next release of Apple’s operating system, due this fall, will provide post-quantum security for TLS by default for all network communications that rely on the modern, recommended APIs. support.apple.com/en-gb/122756 This video from WWDC25 has more information. developer.apple.com/videos/play/...

Researchers have discovered a novel tracking method, used by Meta and Yandex, that affected the privacy and security of potentially billions of Android users.

The EU has published its guidelines for migration to post-quantum cryptography. The timelines are as follows: triage by the end of 2026, migration of high-risk properties by the end of 2030, and migration of the remaining properties by the end of 2035. digital-strategy.ec.europa.eu/en/library/c...

Cryptography & Security Newsletter is out! In this issue: - Internet PKI to Integrate DNSSEC - Short News www.feistyduck.com/newsletter/i...

Microsoft added a variety of post-quantum crypto algorithms to its early adopters channel and detailed its adoption roadmap. techcommunity.microsoft.com/blog/microso...