@darkuncle
An interesting thing is this: While TLS does not expose a weak mode of using RSA, the majority of X.509 certs on the web are RSA (approx. 2/3). See below for a link to the source for this.

But certificates are also used for other things, e.g. code signing, token issuing, etc. And who knows whether any of those use cases will *always* be avoiding the classic RSA padding for signatures.

So a move to the more efficient and compact ECDSA or (even (better)) to EdDSA would be appreciated. This move will also more likely level the path towards allowing for better cryptographic agility to adopt hybrid #PQC ciphers in the future.

BTW, kudos to Let's Encrypt! There the entire chain is using ECDSA signed certs down to the web site using it.

https://ecdsa.com/research

#cryptography #RSA #ECC

Excellent research (and very useful FAQ) out on a new RSA attack: forging 1024-bit signatures in “nearly SNFS time” (not polynomial, but somewhat faster than previous number field sieve approaches by a few orders of magnitude). Real-world risk is low because most RSA implementations in practice do not meet one of the attack requirements; however … more ammunition on the need to transition away from RSA (and protocols like TLS moved to elliptic curve quite a while ago, or are moving to ML-KEM and #PQC). https://github.com/ucsd-hacc/NSNFSSSFSFN #cryptography

tip o’ the hat to Bruce Schneier’s blog for raising it to my attention

With the current news of a feasible breach of security with RSA signatures, I've been wondering when CAs will finally move away from them. I'd been surprised that still so many certificates had been issued still over the last years with it instead of using ECC.

This may also be a wakeup call for making a move for better cryptographic agility towards adoption of post-quantum secure hybrids.

#cryptography #EllipticCurves #ECC #PQC #PostQuantumSafe

Curious about real-world post-quantum migration experiences?
Frank Morgner (BDR) will share lessons learned from building a PQ-ready ID card, including roadmap considerations and crypto-agility aspects, at the #PQCSA Workshop "Post-Quantum Cryptography: State of the Art" in Bonn.
Registration is still open: https://www.esat.kuleuven.be/cosic/events/pqcsa-workshop-bonn-2026/
#PQC #postquantum #quantum

🔐 Interested in Post-Quantum Cryptography?
You can still register until 27 September for our one-day training on NIST standards, cryptographic libraries and migration strategies in Bonn.
📅 Register now: https://www.esat.kuleuven.be/cosic/events/pqcsa-workshop-bonn-2026/
#PQC #PostQuantumCryptography #PostQuantum #PQCSA

📢 Join Leonard Schild (COSIC, KU Leuven) at the #PQCSA Workshop in Bonn on 6 October 2026, where he will introduce the mathematical foundations of post-quantum cryptography, covering lattices, hash-based signatures, and Classic McEliece.
Register now: https://www.esat.kuleuven.be/cosic/events/pqcsa-workshop-bonn-2026/
#PostQuantum #PQC #Quantum

Interested in post-quantum cryptography implementations? Quinten Norga (COSIC, KU Leuven) will speak on "Performance, Side Channels & Implementation Pitfalls" at the #PQCSA Workshop in Bonn on 6 October 2026.
Register now:
https://www.esat.kuleuven.be/cosic/events/pqcsa-workshop-bonn-2026
#PostQuantum #PQC #Quantum

The quantum threat is approaching. How should we prepare?
Join Bart Preneel at the #PQCSA Workshop in Bonn on 6 Oct 2026 for his talk: "The Quantum Threat: Why Act Now?"
Registration is open: https://www.esat.kuleuven.be/cosic/events/pqcsa-workshop-bonn-2026/
#PostQuantum #PQC #Quantum

RE: https://infosec.exchange/@technotenshi/117271703277002828

One might despise #Cloudflare (also as a US Big Tech player) as much as one likes. But it's really cool to see how they're promoting Good Things (TM) on cryptographic agility.

#PostQuantum #cryptography #PQC #TLS

Syfer Sangraal : Holy Grail of Cryptography in the Arc of the Combinant

DOI : 10.5281/zenodo.22158384

== SUMMARY ==

Embark on the quest for the Syfer Sangraal system, or the holy grail of cryptography hidden in the arc of the combinant. One system to roll them all is the holy grail of cryptography. One algorithm to perform every kind of cryptographic function is the new wine within the Syfer
Sangraal system.

--
OCTADE | https://octade.net

#SyferSangraal #HolyGrail #cryptography #cryptology #crypto #pqc #papers

@crypto
@cryptography
@papers
@cryptography
@cypherpunk

Registration is now open for the Post-Quantum Cryptography: State of the Art workshop, taking place in Bonn on 6 October 2026.

This one-day training will provide an overview of the current state of post-quantum cryptography, with practical insights into NIST standards, cryptographic libraries and migration strategies.

The workshop is co-located with ETSI’s CRA Standards Unlocked Event.

https://www.esat.kuleuven.be/cosic/events/pqcsa-workshop-bonn-2026/

#PQC #PostQuantumCryptography #QuantumSafe

Cryptanalysts are using AI models now, openly and on live claims. So what does "independently confirmed" mean? Less than it meant two years ago, and two events this summer show why.

April 2024 is the baseline. Yilei Chen posted a claimed polynomial-time quantum algorithm for LWE on the first day of the NIST PQC Standardization Conference. Eight days later he withdrew it, with an acknowledgment thanking Hongxun Wu and, independently, Thomas Vidick for finding the bug in Step 9. That parenthetical is the whole quality control mechanism of the field. Two experts, reasoning separately, converged on the same defect. Neither had seen the other's reading.

July 23, 2026. Ananth and Sahai at UCSB and UCLA posted a proof of efficient unclonable encryption at 10:35 Pacific. Seyoon Ragavan at MIT posted the same result three hours and eighteen minutes later. Both credited GPT-5.6 Sol Ultra with the core ideas. Both traced to the same Simons Institute talk. Neither knew the other was working on it. Ragavan drove the model in supervised two-hour stretches; Ananth and Sahai used a self-critiquing UCLA harness. Two workflows about as different as two workflows get, one construction, one working day.

August 2026. Daniel Simon's claimed polynomial-time algorithm for the Dihedral Coset Problem is being adjudicated right now on ePrint and Discord, in days rather than months, with Bernstein and Kirshanova among the people reading it. Several of the substantive responses were produced by humans working with models. One lists two language models on its byline. Disclosure across the documents is uneven: some name the model and version, some say only "AI assistance."

The mechanism cryptanalysis depends on is not expertise. It is decorrelated failure. Two humans with similar training still make different mistakes, at different points, for different reasons, and their errors decorrelate even when their education does not. The risk with shared tooling is not sampling correlation. It is common-cause error, where shared weights, training data, post-training and retrieval reproduce the same blind spot across operators who have no way of noticing they share it.

I am not claiming three model-assisted reviews reduce to one. I am claiming we currently lack the provenance to know how much independent weight they deserve.

The fix is cheap. Every cryptanalysis note that circulates before peer review should end with two sections: who found what, and what was checked by whom, with what, and how hard. Ragavan's paper already does most of it, and ships a Lean 4 formalization that states which claims it does not cover. A kernel shares no weights with anything.

IACR has barred models from bylines since May 2025. That rule governs formal submission. It does not reach the circulating notes where Simon is actually being adjudicated.

(This post was edited by AI, but the points are mine. If anyone else wrote the same thing around the same time, blame it on ChatGPT)

https://postquantum.com/post-quantum/independence-problem-ai-cryptanalysis/

#infosec #cryptography #cryptanalysis #PQC #postquantum #formalmethods

HKMA just published the most granular regulator-led PQC readiness assessment I've seen from any financial authority: a 56-page whitepaper with sector-wide survey data, a four-dimensional readiness index (12 sub-indices), barrier rankings, and five completed pilot descriptions.

The headline number: Hong Kong's banking sector scores 2.3/10 on post-quantum cryptography readiness. Pilots score 1.8/10 — the weakest dimension. 71% of respondents have never conducted or planned any PoC or live testing of PQC algorithms.

The barrier data is more interesting than the score. 87% ranked third-party dependencies as a top-three obstacle. 85% said their vendors lack clear PQC roadmaps. 79% cited technical complexity of cryptographic asset discovery across legacy IT environments. Banks can't migrate what they don't control, and the vendor ecosystem hasn't given them enough to plan against.

FINMA published similar findings from Switzerland two weeks earlier: 72% of 60 surveyed institutions hadn't planned or implemented quantum-safe measures, only 8% had a roadmap. Two jurisdictions, same picture.

What the HKMA report misses: no treatment of signature forgery (Trust Now, Forge Later) as a distinct threat track alongside HNDL. For banking, this matters — a CRQC that can break ECC forges transaction authorizations on the day the capability arrives. The report also never names ML-KEM, ML-DSA, or SLH-DSA in its body (they appear only in the abbreviations appendix), and barely addresses China's divergent PQC standards program despite Hong Kong straddling both cryptographic ecosystems.

Carmen Chu (HKMA Banking Supervision) noted that banks with existing transition plans estimate 5.6 years on average to complete migration. The HKMA targets full readiness by 2030. The contradiction speaks for itself.

Full analysis: https://postquantum.com/security-pqc/hkma-banks-quantum-readiness-2-3/

#infosec #cybersecurity #PQC #postquantum #quantum #cryptography #banking #HKMA

Every technique used in the various July AI hacking incidents has a known defense. Weak passwords. Unauthenticated endpoints. SQL injection. Unmonitored east-west traffic. Two of three organizations Anthropic's models compromised didn't even detect it.

This is not an AI problem. It is a cybersecurity basics problem exposed at machine speed.

Vendors are already starting to market "AI-resilient" infrastructure and "Mythos-resistant" cryptography. Do not buy the label. The correct response to faster attacks is faster defense, not a different kind of defense. Shorter patching windows. Better credential rotation. Tighter segmentation. Automated rollout.

The one actually new investment: crypto-agility. In the same week OpenAI and Anthropic disclosed their hacking incidents, Anthropic's AI killed a PQC candidate that had survived years of NIST evaluation. 60 hours. $100K. HAWK was withdrawn the next day.

AI is now also attacking mathematical layer of your defenses. And the upcoming quantum threat is defeating the mathematical layer. The shared defense is the ability to swap cryptographic algorithms without rebuilding your stack.

Do good cybersecurity. Do it better. Do it faster. Build crypto-agility into the architecture.

https://postquantum.com/ai-security/ai-hacking-theater-crypto-agility/

#cybersecurity #CISO #AIhacking #cryptoagility #PQC #postquantum #infosec #AI #quantumsecurity

@cryptography of course, it could also use #pqc post #quantum #cryptography to generate the #keypare , like ml-kem , dilithium, etc.
i would need to look more into how this would work with not just #nvda , but generally computers. i do know some manufacturers are starting to come with quantum cryptographic chips, like the sealsq chips but other than that, software can handle it too i guess. i'd have to look at microsofts crypto stack and see if i can make something work on that front, that is, if i even can do that...

I just published my analysis of the Anthropic HAWK/AES cryptanalysis papers. Read both against primary sources, and the coverage is getting it wrong in both directions.

"AI broke post-quantum encryption." No. HAWK is a NIST candidate, not a standard. HAWK-256 is a challenge parameter set, not a proposed security level.

"Just implementation bugs." Also no. The HAWK attack exploits a Galois symmetry (τ: ζ↦−ζ) in the power-of-two cyclotomic ring. The AES Mobius Bridge exploits the S-box's GF(2^8) inversion structure as defined in FIPS 197. These are properties of the algorithm specifications. Any correct implementation inherits them.

On the numbers: Anthropic's blog says HAWK-256 cost moved from 2^64 to 2^38. That pairing does not appear in the paper. Table 1 gives per-SVP-call costs of 2^62 and 2^38 (Core-SVP) or 2^74 and 2^52 (gate model). Every outlet running "2^64 to 2^38" is copying the blog, not the paper.

For AES, the "200-800x faster" framing describes the time term only. The attack still needs 2^105 chosen plaintexts, so the balanced complexity max(D,T,M) is unchanged at fixed data. The rebalanced variant reaches 2^96.3 vs DFJ13's 2^99. Call it a 2.7-bit improvement on 7 of 10 rounds. Real work, but production AES is untouched.

The paper that got the least attention matters most: CryptanalysisBench reports a full 128-bit key recovery on unmodified SpoC AEAD using two oracle queries, independently found by two Claude models. Also a KINDI KEM CCA-proof error leading to a working key-recovery attack. Neither scheme was deployed, but these are full-strength design breaks, not reduced-round exercises.

I try to introduce a three-tier framework for classifying cryptographic failures (implementation bug / algorithm design weakness / full-parameter break) and places each result. It also covers the independent GPT-5.6 HAWK attack, Saarinen's HOVER McEliece results, and what I got wrong in my 2025 "Why AI Cannot Break Modern Encryption" article.

https://postquantum.com/security-pqc/ai-cryptanalysis-hawk-aes/

#infosec #cryptography #PQC #postquantum #HAWK #AES #cryptanalysis #cybersecurity

Can't migrate everything to PQC at once. Which layer first?

TLS at the load balancer, IPsec at the tunnel, or application-layer encryption - each covers different threat surfaces. Six enterprise architecture scenarios, one recommendation per scenario.

https://postquantum.com/post-quantum/pick-one-pqc-layer-migration/

#PQC #TLS #IPsec #infosec #cryptography

"Criminals will rent a quantum computer to break encryption." Most repeated claim in quantum security. But it's not going to work quite like that.

CRQCs will be export-controlled, auth-gated, compliance-monitored. Cloud quantum access won't be on a credit card. The rental threat model assumes a market no government will permit.

https://postquantum.com/post-quantum/criminals-rent-quantum-crqc/

#threatmodeling #CRQC #infosec #PQC

If quantum computers start breaking cryptography a few years from now, don't you dare come to me saying nobody warned you." - Aaronson, hours after NAS election.

He names no lab. He's reporting what the builders are telling him: ~2029 for CRQC is now plausible.

https://postquantum.com/security-pqc/aaronson-quantum-warning-nas/

#PQC #CRQC #infosec #cryptography

New analysis: How Much Can AI Actually Help With PQC Migration?

A hypothesis paper in MDPI Cryptography claims frontier AI (Mythos-class) compresses enterprise PQC migration from 12-15 years to 2-4 years. The paper models AI as both defender accelerator and adversary destabilizer through six feedback loops, and that dual-use framing is sound.

The timeline estimate is not.

I've led PQC migration programs generating 120,000+ discrete tasks. AI genuinely helps with the technical analysis fraction: crypto discovery triage (months to days), migration strategy automation across 100K+ instances, code diff generation (hours to minutes), test scenario creation.

That accounts for maybe 15-20% of total program effort.

The other 80%:

- Getting executive mandate and multi-year budget (3-12 months)

- Standing up program governance (3-6 months)

- Negotiating access to production segments across business units (this is the bottleneck in discovery, not analysis speed)

- Change advisory board approvals for every production change

- Vendor firmware/certification timelines entirely outside your control

- Interoperability testing with real counterparties on their schedules

- FIPS 140-3 module validation cycles

- CBOM and crypto-agility as organizational transformations, not technology deployments

Key analytical distinction: effort compression ≠ schedule compression. 20% of effort off the critical path saves zero calendar time. The institutional dependencies dominate the critical path in every large program I've observed.

The paper assigns 8 years to AI-compressible work and 2 years to the institutional floor. In my experience, those proportions are reversed.

EO 14412 (signed June 22, 2026) sets Dec 31, 2030 for PQC key establishment and Dec 31, 2031 for digital signatures in federal high-value systems. CNSA 2.0 requires new NSS acquisitions to be compliant from January 2027.

The correct response to AI-accelerated adversary capability is not "compress the timeline from 15 years to 4." It's: start the program now and use AI within it.

https://postquantum.com/post-quantum/ai-pqc-migration-how-much-help/

#infosec #cybersecurity #PQC #postquantum #cryptography #quantumcomputing #NIST #migration

“You go to war with the algorithms you have, not the ones you wish you had.” — Eric Rescorla

https://blog.cloudflare.com/ml-dsa-will-have-to-do/ #PQC #cryptography

🔐 COSIC Course 2026 speaker announcement!
At Track B (Hardware Sec), Suparna Kundu (COSIC) presents: "Implementing Post-Quantum Cryptography: Challenges and Insights".
From theory to practice in #PQC: implementations, attacks & countermeasures.
Program: https://www.esat.kuleuven.be/cosic/events/cosic-course/programme26/

... to defeat Heffalumps and Woozles!