Root Causes: A PKI and Security Podcast

PKI stands for Public Key Infrastructure. In this episode we focus on the word infrastructure. Our hosts discuss the key qualities of credential form factors, how they are separate and distinct from the infrastructure surrounding them, and the minimum capabilities necessary to refer to a public-private key system as PKI.

In a recent interview Tim Cook took a strong stance against application sideloading as a danger to mobile devices. In this episode we explain sideloading, its potential dangers, and the underlying motivators behind the sideloading debate.

If you pay attention to blockchain and crypto currency, you are sure to hear the phrase consensus algorithm. This concept is fundamental to distributed trust systems like blockchain. In this episode our hosts explain consensus, proof of work, and the Byzantine Generals problem.

A new academic paper has described how a purpose-built quantum computer could break RSA encryption in fewer qbits than commonly are thought necessary possible. In this episode our hosts summarize the basic argument in this highly technical paper and its potential implications on the Quantum Apocalypse.

The CEO of Sky Global, a provider of encrypted data devices and services, has been indicted on RICO charges related to drug trafficking and money laundering. Our hosts discuss this highly unusual development and where it fits into the ongoing battle between law enforcement and encryption technology.

The ongoing Microsoft Exchange vulnerability is huge news in the IT world. In this episode our hosts discuss the reasons why on-premises services might present greater risk than providing the same capabilities in the cloud.

A recently published study of public revocation information takes a numerical approach to revocation behavior from CAs. Our hosts give their first take on this paper and the idea of "revocation transparency."

In the summer of 2019 the Kazakh government attempted to force its citizens to trust its private root, enabling MITM attacks for a variety of potentially nefarious purposes. A recent research paper goes into previously unknown detail about who was targeted and how the regime sought to abuse this short-lived exploit.

In this episode we explore the relationship between Relying Parties (aka users of online services) and Certificate Subscribers (aka providers of these services). We discuss the common attitude that certificate requirements that negatively impact Subscribers are inconsequential. We explain the downstream effects of certificate incidents and why unthinkingly forcing rules on service providers withou...

A recently published paper by a reputable German mathematician and cryptographer has garnered widespread attention for its claim to have destroyed the RSA algorithm. However, many people are skeptical. Join us as we discuss the paper's content, the proposed methodology, and the public discussion it has generated.

Trust models in multi-vendor environments can be particularly tricky. We are joined once again by Tom Tansy, Chairman of the SunSpec Alliance for a deep dive in the challenges and best practices in maintaining trusted roots in complex, global supply chain ecosystems.

The SunSpec Alliance is an important source of standards for clean energy infrastructure including solar and electric vehicles. To protect our electrical infrastructure and ensure proper functioning, digital identity and certificates are a necessity. Join us and guest Tom Tansy as we discuss how SunSpec employs PKI to this end.

Rustls is an important emerging alternative to OpenSSL. In this episode we discuss the Rust programming language and the implications of the fact that is was designed with security in mind from the ground up. This includes how Rustls is protected against attack vectors that have been effective in the past, including Heartbleed. Join us to learn more.

Recent news of the discovery of abandoned Enigma machines on the ocean floor inspires our hosts to discuss history's most famous code system, how it was broken, and how that relates to cryptography today.

In past episodes we have discussed the possibility of cyber attack against civil infrastructure like utilities. That possibility recently became real with the attempted poisoning of a Florida city's water supply through online security breach. Learn more on this episode.

A proposed law in Australia would require sites linking to news articles to pay for the right to link to these articles. While this law appears to be aimed at Google and Facebook, it has implications that are much bigger than these two news aggregators. Google has upped the ante by offering to cease operations in Australia before doing so. In this episode we discuss this ongoing development and wh...

Recent research reveals a possible attack that would allow the cloning of the Google Titan secure key. Join our hosts and guest Alan Grau as they describe this attack and its implications for Titan and other secure keys.

A white hat researcher recently took over .cd, the Democratic Republic of the Congo's ccTLD. The implications of taking over a top-level TLD are of course staggering. Join our hosts as we describe how this feat was accomplished and the many malicious activities that could occur under such circumstances.

A few days ago Google announced that Chrome will distrust Spanish public CA Camerfirma in its upcoming build 90. Our hosts go over the history of browsers distrusting public CAs and explain the reasons for (and implications of) this decision.

For more than a decade browsers displayed the "green address bar" on sites that had undergone the high authentication required for EV SSL certificates. But in recent years the identity information in the browser has has shrunk, lost its color, and in some cases disappeared entirely. In this episode our hosts walk you through the history of how the green address bar came to be and how bro...

In this episode our hosts explain the Four Pillars of Certificate Automation: deploy, discover, revoke/replace, and renew. They detail what these pillars entail and why they're important. They also discuss the umbrella capability of visibility, which affects all four pillars.

On March 1 Sectigo will remove street address and postal/zip code information from its public certificates of all types. Our hosts explain the reasons for and advantages of this upcoming change, along with answers to some of the common questions we receive.

Recent years have seen multiple reductions in the maximum term for public SSL certificates. Our hosts are joined by guest Nick France to discuss the benefits of shorter certificate lifespans for both public and private CAs.

BGP, or Border Gateway Protocol, controls traffic routing on the internet. Real and theoretical attacks over the years have been revealed against BGP with varying levels of success, including recent research on how BGP attacks can be used to improperly obtain DV certificates. Our hosts explain them along with recent industry actions intended to thwart such attacks.

Public CAs recently have discovered a repeated error whereby certificate subscribers accidentally include the private key along with CSR submissions. Our hosts break down this phenomenon and its implications.