Root Causes: A PKI and Security Podcast

In this episode about certificate agility, Jason and Tim discuss what it takes to replace any or all digital certificates across an organization rapidly and reliably. They explain why browser root programs are driving shortened certificate lifespans (down to 47 days) and deprecating public clientAuth certificates as a forcing function for automation, why public WebPKI rules exist to protect everyday internet users, and how visibility and Certificate Lifecycle Management (CLM) prepare enterprises for revocations, key compromises, and post-quantum transitions.

In this episode about "Turducken" (post-quantum opt-out) certificates and WebPKI downgrade attacks, Jason and Tim discuss why trusting even a single classical Certificate Authority leaves the entire web vulnerable to a cryptographically relevant quantum computer. They explain how wrapping classical RSA or ECC keys inside an ML-DSA post-quantum CA signature prevents global downgrade attacks during the transition to Merkle Tree Certificates (MTCs), and walk through the 2027–2028 browser root store roadmap from Chrome and Apple.

In this episode, Jason and Tim discuss the recent compromise of DNS for several country-code top-level domains, including .gh (Ghana), .sl (Sierra Leone) and .as (American Samoa), which made domain control validation untrustworthy for every domain under them. Chrome blocked the unauthorized certificates that were found, thanks to certificate transparency logs, though it could not guarantee it found every affected domain. We explain why CAA records could not help, since CAA lives in the same DNS that the attacker controlled, how this relates to multi-perspective issuance corroboration, and the two takeaways: protect your DNS settings at all costs and watch the CT logs.

In this episode, Jason and Tim start from the P versus NP question and use a Sudoku puzzle to show the difference between problems that are easy to check and hard to solve. We discuss why RSA and ECC, which rest on factorization, fall to Shor's algorithm and the quantum Fourier transform, and why lattice-based post-quantum algorithms such as ML-DSA were chosen. Because it is impossible to know which hard problem will survive AI-accelerated cryptanalysis, we make the case that cryptographic agility is essential. We also cover NIST's push for math diversity beyond lattices, and Apple's proposed Merkle Tree Certificate root program including SLH-DSA, so that MTCs can act as an abstraction layer that makes swapping algorithms practical.

In this episode, Tim and Jason revisit the "Bugzilla bloodbath," the surge of public CA compliance incidents on Mozilla's Bugzilla, which has become the official WebPKI incident reporting platform. A normal year brings around 100 bugs, but there are now 138 open at once and several hundred opened this year. Almost all are reported by third parties, which suggests security researchers are using AI-assisted automation to scour public CA behavior in CT logs, CPS documents and root hierarchies. We discuss why the volume is a healthy sign of the system working as designed, why finding these issues before attackers do is a good thing, and why we hope the backlog will eventually run out and return to normal levels.

As the WebPKI drives toward a Merkle Tree architecture for post quantum cryptography, we have seen a significant development. Google Chrome has announced its preliminary intention, as early as 2028, to remove all non-MTC CAs from its traditional root store. We give you the details.

Jason uses a quantum simulator to show us how a cryptographically relevant quantum comptuer (CRQC) would employ Shor's algorithm to attack RSA. Part two of two, with guest Bruno Coulliard.

Jason uses a quantum simulator to show us how a cryptographically relevant quantum comptuer (CRQC) would employ Shor's algorithm to attack RSA. Part one of two, with guest Bruno Coulliard.

In this second of two episodes, Jason walks guest Bruno Coulliard and me through his real-world experience building quantum simulators, including some of the lessons he learned.

In this first of two episodes, Jason walks guest Bruno Coulliard and me through his real-world experience building quantum simulators, including some of the lessons he learned.

Repeat guest Bruno Coulliard of Crypto4A joins us to discuss the accelerating pace of change in digital technology, which is going at a rate unprecedented in human history. How do we as people adjust to the hyperspeed of today's technology landscape? And how do we apply these ideas to cryptography?

Researchers have used AI to decode two German Enigma messages that have remained unbroken since the second world war. We describe how this was accomplished.

This year we have seen a series of AI-enabled cryptographic attacks. In this episode we discuss a new exploit to abuse signing mechanisms in HSMs.

The PLANTS working group in IETF recently released its draft 6 of the Merkle Tree Certificates standard. We go over what is new in this draft.

Apple has announced it will support Merkle Tree Certificates for PQC and has released a draft root store policy. We share some of the surprising requirements in this draft.

Publicly trusted client authentication certificates have a hard deadline to be deprecated in Q1 2027. Not everyone is ready for that. We discuss some of the reasons why and what to do about it.

In our ongoing series on how AI will change in the next three years, we discuss unresolved questions involving ownership of AI-created or -modified content. Plus, what happens when your AI steals intellectual property without your knowledge?

The NIST contest has not been the only government-led effort to discover qunatum-resistant algorithms. In this episode we describe South Korea's PQC contest, which is entirely independent of the NIST contest.

In this second of two episodes, we finish our discussion of Scientifically Relevant Quantum Computers (SRQC) and their implications.

We define a new term, Quantum Security Posture Management (QSPM) and explain what it is and why it's important for PQC plans.

Much ado has been made about quantum computers breaking traditional cryptography. But that's not the reason so much effort is going into their creation. In this first of two episodes, we discuss the expected scientific applications for quantum computing architecture and the idea of a Scientifically Relevant Quantum Computer (SRQC).

Quantum Key Distribution (QKD) is supposed to be this highly secure method of key exchange. But is it as secure as people say? We explore the potential weaknesses with QKD.

We follow up on the recent Mythos attack against PQC candidate HAWK. We discuss the impact of this attack on both HAWK and FALCON.

TLS certificates from CA/Browser Forum CAs are not the only server certificates in the WebPKI. eIDAS QWACs are treated as server certificates by the major browsers. We see clear progress toward post quantum cryptography (PQC) for TLS by way of the Merkle Tree Certificate (MTC) architecture. But what is the path to PQC for eIDAS? We examine this question.

As certificate lifespans become extremely short, new methods of delivery become functionally necessary. We explain RFC 9345 and how delegated credentials play a role in CDNs to deliver very short-lived certificates.

With certificate lifespans shortening, we occasionally run into those who disagree with this trend and seek to lengthen maximum term once again. We examine regressive attitudes in PKI, why they occur, and the reasons that lessening security is generally a bad policy.

X9 is a consortium certificate for interbanking applications. There is a common misunderstanding that X9 certificates are a public-trust surrogate for mTLS using WebPKI certificates. We clarify why this is not the case.

"Chaos engineering" describes the practice of injecting faults into a system to see what happens. This is a known strategy for deterministic systems, but with the advent of non-deterministic AI systems, chaos engineering has taken on greater importance.

Since frontier-model AIs have been trained on a large portion of published human knowledge, widespread publication of incorrect information can taint AI results. As more AI-generated slop finds its way onto the internet, this runs the risk of further poisoning AI results. This ultimately can result in completely unusable information.

It is possible to use common tools like OpenSSL to create your own ML-DSA private CA. This is a great tool for development and research projects, but Jason explains the pitfalls with trying to do this for production systems.

We are replacing RSA with the combination of ML-DSA and ML-KEM. We explain the naming convention and specifically what these two algorithms do.

Jason explains de-quantization, which is the practice of using our knowledge of how to use a quantum computer to reframe problems for processing using traditional computing architecture.

There is no CABF or root program rule preventing public CAs from implementing new requirements earlier than their assigned due dates. We discuss reasons to implement a rule early and how early it should be.

It is surprising that we continue to see root expirations occur at the most inopportune times. Weekends, public holidays, even New Year's Eve. In this episode we have simple advice to anybody setting up a new root, which is "look at a calendar."

SSL hasn't been a standard in use for nearly thirty years, but we still use the word. We discuss why that is, what else we might say, and the expected effect of Merkle Tree Certificates (MTC) on our technical vocabulary.

With the upcoming deprecation of client authentication using publicly trusted TLS certificates, we go over the common use cases for these certificates. We discuss the reasons public trust is often chosen and how to transition away from it.

Anthropic recently announced that Mythos has found mathematical weakness in the core algorithm for the third-round NIST PQC candidate HAWK, effectively halving its effective key strength. Mythos also developed a faster attack on a round-reduced version of AES-128. These are not implementation attacks but mathematical attacks on the core cryptography. We discuss the massive implications of these developments.

A newly revealed flaw in Active Directory Certificate Services (AD CS) allows an attacker to improperly obtain cryptographic credentials for an agent. We discuss the implications that this flaw Certighost (pronounced sert-uh-GHOST) has for agentic AI at large.

Because of a change in the drop-dead date, we have observed confusion in the timeline for deprecation of client authentication and mTLS for public TLS certificates. This is an inflexible deadline, and enterprises that are not ready risk outage. In this episode we spell out these dates very clearly.

In our series on digital identity for AI agents, we discuss FAPI 2.0 as an option.

In our ongoing series on digital identity for agents, we have previous discussed use of certificates for authentication. In this episode we describe how cryptographic proof of possession can enable secure authentication using tokens.

We survey different strategies for securely authenticating agentic AI, including certificates and SPIFFE. We discuss Zero Trust and the Principle of Least Privileges as applied to agents.

Anthropic has announced its intentions to support SPIFFE/SPIRE with the SPIRE server rooted in an "upstream authority," which will require a root private CA rather than allowing self-attestation for agentic AI.

In our episode 640 we defined SPIFFE, which provides digital identity for agentic workloads. In this episode we explain SPIRE (SPIFFE Runtime Environment), the SPIFFE certificate provisioning protocol.

SPIFFE (Secure Production Identity Framework for Everyone) is a standard for digital identity for agentic workloads. In this episode we explain.

Static API keys are a common security practice. In this episode we discuss the risk of these keys being revealed, including directly by the AIs that use them.

Tim shares his very personal experience with would-be catfishers and we talk about how AI is set to change the catfishing attack.

The Baseline Requirements, CT logs, the Bugzilla Bloodbath, shortening certificate lifespans, all these trends serve to enforce a high level of quality and predictability across WebPKI certificates. Nearly twenty years after the introduction of EV SSL, we ask if it has served its purpose and should be retired.

Dustin Moody of NIST joins us to talk about the evolution of standardized cryptography beyond the current PQC efforts. Topics include maintaining visibility on cryptography presently in use, 50 years of RSA, and cryptographic heterogeny.

Bas Westerbaan of Cloudflare joins us to discuss recent information that heightens concerns about Elliptic Curve Cryptography (ECC) and its vulnerability to a cryptographically relevant quantum computer (CRQC). We pose the question do we need to deprecate ECC in advance of our migration to ML-DSA and other PQC algorithms.

A new Executive Order (EO) moves the deadline for ML-DSA deployment up to 2031. We talk about why this happened and its implications on government, the technology industry, and enterprises around the globe.

We are freshly returned from the 2026 ETSI PQC Conference. We give a debrief on the conference, including the difference between post quantum cryptography (PQC) and quantum key distribution (QKD), the algorithmic zoo, PQC for blockchain, the Dunning Kruger Effect, and cryptographic Frogger.

We recently attended the Gartner Risk and Security conference for 2026, where we observed a great deal of attention on not only AI but also post quantum cryptography (PQC). Join us as we share the key takeaways.

2024 saw a flurry of high profile incidents for public CA, which we named the Bugzilla Bloodbath. We look back to see how the WebPKI has changed as a consequence.

Resource-constrained devices may need to address PQC through real-time, seed-based, key generation. Unfortunately, this leaves the full key exposed very briefly in RAM. The potential consequences of this are far-reaching and scary. We go into the details.

Sam Jaques of the University of Waterloo returns to discuss his tracking of progress in quantum computers and offer a perspective on moving our PQC deadlines up to 2029.

An emerging attack against AIs is to create a significantly complex and recursive prompt that will occupy the AI indefinitely or for a sufficiently long time that it acts as a Denial-of-Service (DoS) attack. We describe how this works.

In the latest in our coverage of government versus encryption, the UK issued secret orders to Apple to give it a cryptographic backdoor to Apple's advanced data protection capability for iCloud. Apple responded by eliminating encryption entirely for UK users. We break it down.

TLS 1.3 is required to take advantage of post quantum cryptography (PQC) algorithms. Yes, we still see a lot of TLS 1.2 or earlier in deployment. We examine why this is the case and what to do about it.

Recent revelations about Mythos and its ability to expose vulnerabilities have forced us to rethink basic assumptions about cyber defense. In our "AI in 1000 Days" series, Jason Soroko and I examine the implications of these revelations three years from now. This includes upping the overall pace of attack and changes to best practices in cyber security defense.

Anthropic has delayed its widespread release of Mythos to give major software providers a chance to close off the many vulnerabilities it has discovered. We dig into the vast implications of Mythos and other AI models for the future of cybersecurity.

We discuss the possibility that our standardized ML-DSA keys turn out to be too short for true confidence, why that might occur, and the implications for private PKI certificates.

Sam Jaques joins us to explain his much-referenced chart mapping progress toward cryptographically relevant quantum computing (CRQC).

We break down the phrase "Simplicity at Scale" to see what it means to us in the context of CAs and CLM.

A few years ago NIST proposed deadlines for PQC deployment at 2030 and 2035. But recent announcements from Google and Cloudflare suggest 2029 as a better deprecation target. We are joined by Dustin Moody to get the NIST perspective on these announcements.

Recent announcements from Google and Cloudflare have declared new 2029 deadlines for full post quantum cryptography (PQC) migration. Bas Westerbaan explains the rationale behind Cloudflare's decision and discusses implications for other enterprises, asking "Are you a gambler?"

Repeat guest Bas Westerbaan of Cloudflare joins us to explore the role of Merkle Tree Certificates in private CA scenarios with an eye toward where they will be needed and where traditional PKI will be better suited.

The US-based X9 financial industry consortium has created a server certificate. We explain what X9 certificates are and suitable use cases for this certificate type.

Dustin Moody of NIST joins us to discuss Merkle Tree Certificates (MTC) and the NIST position on them.

Repeat guest Bas Westerbaan of Cloudflare joins us to explain the PLANTS working group in IETF, which is driving standards around post quantum cryptography (PQC) and Merkle Tree Certificates (MTC). Bas explains the path to becoming a final standard, where we are in this process, and how you can get involved.

It's reasonable to believe that Merkle Tree Certificates (MTC) and traditional RSA will co-exist on the same servers for years, if not decades, during the transition to post quantum cryptography (PQC). Bas Westerbaan of Cloudflare joins us in this episode to explore the possibility of quantum downgrade attacks and what we can do about them.

We are joined by Dustin Moody of NIST to go over the current state of the various post quantum cryptography (PQC) contests, including upcoming FIPS standards for Falcon (FN-DSA) and HQC, other Round 4 algorithms, the digital signing algorithm (DSA) On Ramp, isogeny, and future cryptographic exploration.

We are joined by Bas Westerbaan of Cloudflare to explain considerations and requirements for use of Merkle Tree Certificates (MTC). This includes full adoption of TLS 1.3, offering PQC and RSA at the same time, the imperative value of automation, and running production MTC in 2027.

There are strong reasons to believe that the architecture of PQC TLS will take the form of Merkle Tree Certificates (MTC). We are joined by post quantum cryptography expert Bas Westerbaan of Cloudflare as he explains this new PKI architecture, how it works, and why we need it. We define new concepts like landmark certificates and log mirrors and discuss what's necessary to move to this new architecture.

We describe three different kinds of logical qubits with their relative strengths and weaknesses.

Jason explains the extreme danger of side channel attacks in the new post quantum cryptography (PQC) era.

The reliability of cryptographic algorithms is largely a matter of conjecture based on track record. Proving security is impaired by the difficulty of formal verification, implementation weaknesses, and failure in randomness.

The first of the five pillars of Certificate Lifecycle Management (CLM) is discovery. While many of your certificates are easily discoverable, some difficult PKI remains.

The UK Online Safety Act intends to force vendors who sell hardware and software to allow the government to scan end-to-end encrypted communication on end devices. We once again marvel at governments seeking to undermine the security of their own citizens.

Google has taken a strong position supporting Merkle Tree Certificates (MTC) as the PQC-enabled future for SSL / TLS. We unpack this extremely important position from the WebPKI's most influential organization.

A new paper from Google Quantum AI and others documents a new technique for breaking ECC, particularly the curve protecting crypto currencies, smart contracts, and blockchain. This accelerates post quantum cryptography (PQC) timelines.

New research suggests that a cryptographically relevant quantum computer is achievable with only 10,000 qubits. This was an important contributor to Google moving its PQC target to 2029.

Google has announced that it is moving its target for full PQC support to 2029. This is a strong statement from one of the most knowledgeable PQC technology companies that the existing 2030 target is too late.

Legacy PKI implementations in the enterprise are holding back technical progress and creating security risk. We discuss reasons why, consequences, and what to do about it.

In our previous episode we defined cryptography as the new geopolitics. Now in our 600th episode we follow up to explain how all cryptographic decisions reflect the social, political, and legal viewpoints of the cryptography's designers.

In the last decade or so, nations around the world have become keenly determined to use cryptography for their own legal, economic, and military advantage. We explore this concept.

A recent CISA report declares that the nation's OT infrastructure is incapable of keeping up with the crypto agility and certificate management needs that modern security demands. We examine this finding.

Microsoft has publicly stated that it will hand over Bitlocker keys to US law enforcement agencies without requiring a subpoena or court order. These keys can be held by users rather than Microsoft, at their option. We dive into this topic.

We usually think of Certificate Lifecycle Management (CLM) as a security category. But we could equally well categorize it as an operations category that enables uptime. In this episode we make our case.

We introduce the concept of a "digital parasite," explaining why this attack philosophy appears to be on the rise.

In a recent blog post Google made five recommendations for policy makers. We walk down the list.

CISA (Cybersecurity and Infrastructure Security Agency) has released new guidance about post-quantum cryptography in critical infrastructure, including some very sobering warnings. We go into the details.

CAA records exist to restrict issuing CAs for a given domain to as few as one CA. But what happens when the CAA record outlives the CA to which it restricts issuance? Join us to find out.

Chrome's deadline for deprecation of the clientAuth EKU and mTLS in public certificates has moved out. We give you the what, when, and why.

It would be easy to believe that the amount of risk posed to the WebPKI by any individual public CA is somehow proportional to the number of active certificates that CA has. This is false, however. In this episode we address this misconception.

We recently heard the argument that it's simply too expensive to develop a cryptographically relevant quantum computer. We vehemently disagree. In this episode we explain why.

In this episode Tim explains that the transition to PQC is not just a change in cryptographic algorithms but also a fundamental shift in how we treat our cryptography. From here on out, IT systems need to be fundamentally crypto agile in a way we've never had to be before. Cryptographic Agility is the key to solve this problem.

Jason describes a recent intrusion almost entirely operated by off-the-shelf AI tools. This is an important milestone in security. We describe its potential consequences.

We expand on the concept of trust-now-forge-later to list a whole bevy of additional attacks that eventually will be enabled by cryptographically relevant quantum computers.