Root Causes Podcast

In honor of the upcoming US elections, we describe the six main requirements for a post-quantum voting system.

In this episode we describe the LoRA protocol, which allows IoT devices to communicate securely without using a cellular network.

In this episode we discuss the dual nature of a public certificate as both a file and part of a holistic service that lasts until its expiration.

With a few easy tweaks, you can get your track to listeners most likely to love it. Learn more about how to modify your track to make it eligible.

White hat researchers have raised concerns about FIDO 2 (AKA WebAuthn). We explain.

EUCLEAK, a newly revealed side-channel vulnerability, can clone the contents of a YubiKey. We talk about the attack and its significance.

There are still products and operating systems that don't support ACME. We explore what happens to them when 90-day SSL certificates become required.

PQC will move us from cryptographic homogeneity to cryptographic heterogeneity, with multiple KEMs and DSAs eventually expected as ongoing standards.

We introduce pkimetal, an open source project from Rob Stradling that allows CA to write to many popular linters with a single integration.

An enterprise SSL subscriber recently used a Temporary Restraining Order to prevent the proper revocation of misissued certificates. We explain.

NIST recently released PQC algorithmic standards in FIPS-203, 204, and 205. We describe what is necessary for enterprises to begin using these algorithms.

We detail mandatory revocation periods for leaf certificates and intermediates and explain when a 24-hour versus a 120-hour revocation deadline applies.

On August 13, 2024, NIST released its first three standards for PQC algorithms, ML-KEM, ML-DSA, and SLH-DSA.

We have in the past covered Chrome's initiatives to replace cookies. Now Chrome has announced that for the foreseeable future cookies will remain.

Repeat guest Bas Westerbaan of Cloudflare talks through the concept of "security levels" in post-quantum cryptography.

Microsoft blames the problem on the fact that it must, by European law, allow kernel updates to Windows. We unpack the challenges this poses.

This week Mozilla chose to follow Chrome in deprecating the Entrust trusted roots. We give you the details and explain why this action matters.

We recap key takaways from recent conversations about post-quantum cryptography (PQC) with leading experts.