Root Causes: A PKI and Security Podcast

In this episode about the security risks of treating a phone number as an identity, Jason and Tim discuss why a telephone number is merely a routing label for potential reachability rather than a proof of who is on the other end. They examine how silent SIM-swapping attacks, three-line mobile SMS redirection malware, low-entropy knowledge-based verification questions, and AI voice cloning render t...

In this episode about certificate agility, Jason and Tim discuss what it takes to replace any or all digital certificates across an organization rapidly and reliably. They explain why browser root programs are driving shortened certificate lifespans (down to 47 days) and deprecating public clientAuth certificates as a forcing function for automation, why public WebPKI rules exist to protect everyd...

Jason uses a quantum simulator to show us how a cryptographically relevant quantum comptuer (CRQC) would employ Shor's algorithm to attack RSA. Part two of two, with guest Bruno Coulliard.

Jason uses a quantum simulator to show us how a cryptographically relevant quantum comptuer (CRQC) would employ Shor's algorithm to attack RSA. Part one of two, with guest Bruno Coulliard.

In this second of two episodes, Jason walks guest Bruno Coulliard and me through his real-world experience building quantum simulators, including some of the lessons he learned.

Repeat guest Bruno Coulliard of Crypto4A joins us to discuss the accelerating pace of change in digital technology, which is going at a rate unprecedented in human history. How do we as people adjust to the hyperspeed of today's technology landscape? And how do we apply these ideas to cryptography?

Apple has announced it will support Merkle Tree Certificates for PQC and has released a draft root store policy. We share some of the surprising requirements in this draft.

Publicly trusted client authentication certificates have a hard deadline to be deprecated in Q1 2027. Not everyone is ready for that. We discuss some of the reasons why and what to do about it.

The NIST contest has not been the only government-led effort to discover qunatum-resistant algorithms. In this episode we describe South Korea's PQC contest, which is entirely independent of the NIST contest.

In this second of two episodes, we finish our discussion of Scientifically Relevant Quantum Computers (SRQC) and their implications.

We define a new term, Quantum Security Posture Management (QSPM) and explain what it is and why it's important for PQC plans.

Much ado has been made about quantum computers breaking traditional cryptography. But that's not the reason so much effort is going into their creation. In this first of two episodes, we discuss the expected scientific applications for quantum computing architecture and the idea of a Scientifically Relevant Quantum Computer (SRQC).

Quantum Key Distribution (QKD) is supposed to be this highly secure method of key exchange. But is it as secure as people say? We explore the potential weaknesses with QKD.

We follow up on the recent Mythos attack against PQC candidate HAWK. We discuss the impact of this attack on both HAWK and FALCON.

TLS certificates from CA/Browser Forum CAs are not the only server certificates in the WebPKI. eIDAS QWACs are treated as server certificates by the major browsers. We see clear progress toward post quantum cryptography (PQC) for TLS by way of the Merkle Tree Certificate (MTC) architecture. But what is the path to PQC for eIDAS? We examine this question.