Cryptography & PKI

NIST’s PQC Standards: FIPS 203-205 and the Migration Clock

Post author:Prabhu Kalyan Samal
Post published:September 8, 2026
Post category:Cryptography & PKI Emerging Tech & Architecture Security

On August 13, 2024, NIST published the final versions of FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA) — the first formal post-quantum cryptography standards, capping an eight-year open competition and starting the migration clock for RSA and elliptic-curve infrastructure. With harvest-now-decrypt-later collection already threatening long-lived secrets and federal migration timelines targeting the 2030s, enterprises face a decade-scale cryptographic inventory and replacement program. This guide walks the standards, the threat math, and the migration playbook from inventory to hybrid deployment.

CurveBall CVE-2020-0601: Forging Trust With One Elliptic Curve Parameter

Post author:Prabhu Kalyan Samal
Post published:September 7, 2026
Post category:Cloud & Infrastructure Cryptography & PKI Security

On 14 January 2020, Microsoft’s first Patch Tuesday of the decade included a fix for CVE-2020-0601, a cryptographic implementation flaw in Windows CryptoAPI reported to the vendor by the U.S. National Security Agency. The bug let anyone forge TLS certificates that appeared to chain to the U.S. government’s ECC trusted root, making malicious HTTPS sites look legitimately signed. Researchers named it CurveBall, proof-of-concept exploits appeared within days, and CISA issued Emergency Directive 20-02 ordering federal agencies to hunt and patch. This is the story of how a single mishandled curve parameter undermined certificate trust Windows-wide.

Crypto Agility After PQC: How to Avoid the Next Migration Failure

Post author:Prabhu Kalyan Samal
Post published:September 5, 2026
Post category:Cryptography & PKI Security

Post-quantum crypto migration is just the beginning. Crypto agility strategies to survive future cryptographic transitions.

Downfall and Inception: Speculation Tax Comes Due

Post author:Prabhu Kalyan Samal
Post published:September 5, 2026
Post category:Cloud & Infrastructure Cryptography & PKI Security

August 2023’s dual CPU side-channel reveals — Downfall on Intel and Inception on AMD — proved transient execution is a permanent tax on modern computing, payable in microcode updates and measured performance regressions.

MSI’s BootGuard Key Leak: Hardware Trust on the Market

Post author:Prabhu Kalyan Samal
Post published:September 5, 2026
Post category:Cryptography & PKI Security Supply Chain Security

MSI’s ransomware extorted Intel BootGuard OEM signing keys onto underground markets — keys that certify firmware as bootable. Key ceremony lessons.

DST Root CA X3 Expiry: The Scheduled Outage That Mostly Wasn’t

Post author:Prabhu Kalyan Samal
Post published:September 5, 2026
Post category:Cloud & Infrastructure Cryptography & PKI Security

Five years of notice, one expired root, and a clever cross-sign that kept old Android trusting Let’s Encrypt. The rehearsal for every future trust migration.

KeePass Plaintext Export ‘Flaw’: The Trust-Boundary Debate

Post author:Prabhu Kalyan Samal
Post published:September 5, 2026
Post category:Cryptography & PKI Identity & Phishing Security

CVE-2023-24055 showed a config-planted trigger could export KeePass vaults in plaintext after unlock. The debate: feature, flaw, or threat model?

The KeePass Extractor Fight: Memory Beats Crypto

Post author:Prabhu Kalyan Samal
Post published:September 5, 2026
Post category:Cryptography & PKI Identity & Phishing Security

A 2023 PoC scraped the KeePass master password from memory via a rogue DLL; the maintainer called it working as designed. Both were right — and the endpoint-is-the-perimeter lesson stuck.

git-credential Risks: When Helpers Leak What They Cache

Post author:Prabhu Kalyan Samal
Post published:September 5, 2026
Post category:Cryptography & PKI Security Supply Chain Security

Git’s January 2023 advisory flagged plaintext credential stores and verbose logs echoing 2FA tokens. Developer tooling is production security surface.

SEC v. Binance and Coinbase: Custody Meets Law

Post author:Prabhu Kalyan Samal
Post published:September 5, 2026
Post category:Cryptography & PKI Emerging Tech & Architecture Security

The SEC’s June 2023 suits against Binance and Coinbase charged unregistered securities operations at crypto’s two biggest exchanges — a custody and platform-risk story wearing legal clothing.

The Telegram Arrest and the Encryption Debate of 2024

Post author:Prabhu Kalyan Samal
Post published:September 3, 2026
Post category:Cryptography & PKI Emerging Tech & Architecture Security

On August 24, 2024, French authorities arrested Telegram founder Pavel Durov at Le Bourget airport, and two days later charged him with complicity in organized-crime offenses enabled by his platform’s refusal to cooperate with legal process — the first time a major encrypted-service executive faced criminal liability for governance choices. Released under judicial supervision within days, Durov’s case forced every platform lawyer to reprice jurisdictional arbitrage, moderation staffing, and the meaning of cooperation. This account lays out the charges, the encryption-policy fault lines, and the compliance playbook that followed.

PuTTY ECDSA Nonce Bias: How 71 Signatures Exposed Your SSH Key

Post author:Prabhu Kalyan Samal
Post published:September 3, 2026
Post category:Cryptography & PKI Security

PuTTY’s April 2024 advisory for CVE-2024-31497 read like a physics problem: the terminal’s ECDSA implementation biased nonces on NIST P-521, so roughly 71 captured SSH signatures suffice for a lattice attack that recovers the private key. This piece explains the Hidden Number Problem math, why archived PCAP and DLP session capture retroactively weaponized years of traffic, the 0.81 deterministic-nonce fix, and the brutal rotation drill that made every P-521 key used through Pageant presumptively burned.