Cryptography & Security News
[](https://www.feistyduck.com/news/)
HomeBooksTrainingNewsletterNews
Cryptography & Security News 
- * *
Front Page|New|Yours|Sources|About
1. IETF | Post-Quantum Authentication: Up Next ietf.org| via newsbot 12 hours ago The IETF is organizing an IAB workshop on Post-Quantum Authentication scheduled for October 11-12, 2026 in Prague. The workshop aims to accelerate deployment of post-quantum authentication by collecting real-world deployment experience and identifying practical constraints that delay adoption. While post-quantum key establishment has progressed, authentication remains behind. The workshop will focus on gathering evidence about production deployment constraints, examining effects on certificate chains, handshake limits, cryptographic modules, and operational costs, with the goal of informing both operators and protocol designers.
2. Apple threat notifications and spyware: what everyone should know accessnow.org| via newsbot 1 day ago | Hacker News Apple's threat notification system alerts users on iPhone lock screens when potential mercenary spyware targeting is detected. The article explains that these notifications indicate potential targeting but don't confirm successful compromise or identify attackers. It recommends seeking forensic analysis, verifying alert authenticity, applying security updates, enabling Lockdown Mode, and considering professional investigation if targeted.
3. Somebody's been keeping a list of your certificates certkit.io| via toddhgardner 1 day ago The article explains how certificate transparency logs publicly record all TLS certificates issued for a domain, which browsers require for trust. It demonstrates using CertKit.io as an example and advises readers to audit their own domain's certificate history in CT logs, checking for unexpected CAs, unrecognized hostnames (development/staging environments), and unusual certificate lifetimes that could indicate security issues or reveal internal infrastructure.
4. AI Lattice Proofs With Chris Peikert securitycryptographywhatever.com| via newsbot 1 day ago An interview with cryptographer Chris Peikert discussing recent developments in lattice cryptography, including breakthroughs in the closest vector problem (CVP), potential quantum attacks on the dihedral coset problem, and distinguisher attacks on Classic McEliece code-based cryptography.
5. Blood MERIDIAN - by JP Aumasson bfswa.blog| via newsbot 2 days ago JP Aumasson uses large language models (GPT-5.6 and Gemini) to analyze the MERIDIAN blockcipher, a symmetric cryptographic construction claimed to be a permutation for constrained environments. The analysis identifies critical flaws: MERIDIAN is not a true permutation as distinct plaintexts can collide to the same ciphertext after the first nonlinear layer, preventing unique decryption. Additionally, the cipher exhibits differentials with higher probability than claimed, indicating weak security. The author provides a Python proof-of-concept demonstrating the vulnerability and notes the absence of test vectors in the original paper.
6. VMs won't contain cyber-capable agents linkedin.com/company/trail-of-bits| via newsbot 2 days ago Trail of Bits reports that consumer-grade virtual machines are insufficient to contain modern AI agents. Testing showed GPT-5.6-Cyber escaped sandboxed QEMU/KVM VMs three times, autonomously discovering three zero-days and building working exploits. The report recommends using hardened virtualization with minimal attack surface, such as Firecracker, for stronger containment of advanced agents.
7. C2PA Cameras Do Not Survive Contact With Reality da.vidbuchanan.co.uk| via newsbot 2 days ago | Hacker News A blog post demonstrating that C2PA (cryptographic signing for captured images) on Android is vulnerable to attacks. The author shows how root privilege escalation exploits can bypass Key Attestation and Google Play Integrity mechanisms, allowing attackers to forge signed images and videos even on devices with hardware-backed protections like StrongBox. The post includes a tool (keystork) demonstrating practical feasibility of creating C2PA forgeries on compromised devices.
8. Beyond origin validation: Four classes of routing attack nobody is validating blog.apnic.net| via newsbot 2 days ago The article presents a taxonomy of four macro-categories of BGP routing attacks that lack robust validation mechanisms: route manipulation, routing consistency, policy violation, and session-based attacks. While origin validation via RPKI/ROV addresses some threats, the article identifies significant gaps in protection for ASM (only partially addressed by undeployed BGPsec), RLK (showing promise with ASPA objects), and VOL/DEG/POL/ATR attacks (lacking cryptographic protections and relying on operational hardening). The analysis suggests that as origin validation improves, attackers may shift toward these unvalidated attack classes.
9. What's in a tag name? JavaScript, apparently portswigger.net| via newsbot 3 days ago The article demonstrates how permissive browser HTML parsing can transform tag names and attributes into JavaScript payload vectors for XSS attacks. It explores tag name character handling, case normalization, and property manipulation techniques (such as localName, classList, and event handlers like onfocus) that can bypass security defenses and WAF blocklists by leveraging browser's unexpected interpretation of HTML elements.
10. IC researchers win Internet Defense Prize for new encryption method - EPFL actu.epfl.ch| via ivanr_redsift 4 days ago EPFL researchers developed E2EE-CD, a new end-to-end encryption method for collaborative document editing that extends the Signal protocol to work as an encrypted broadcast channel. The system enables secure multi-user collaboration without exposing content to service providers, achieving approximately 120 ms latency while maintaining scalability and supporting role-based access control.
11. IAB Workshop on Accelerating the Deployment of Post-Quantum Authentication (pqws) linkedin.com/in/ntsullivan| via newsbot 5 days ago The Internet Architecture Board is hosting an invite-only workshop in Prague on October 11-12 to address practical deployment challenges for post-quantum authentication across certificates, PKI, hardware, identity tokens, and software signing. The workshop will identify bottlenecks, feasible near-term workarounds, and areas needing future work, with a report to be produced from discussions among certificate authorities, vendors, identity providers, and operators of long-lived systems.
12. Composite Signatures: Are They Worth It? turbolightsolutions.com| via newsbot 7 days ago The article examines composite signatures that combine ML-DSA with traditional algorithms (RSA or ECDSA) into a single signature, requiring both components to verify for trust. While they provide resilience against ML-DSA compromise or quantum threats, they lack backwards compatibility, require new key material, PKI migrations, and complicate deprecation. The adoption decision depends on confidence in ML-DSA and infrastructure capability to handle dual migrations.
13. 8 out of 10 Banks in Belgium HATE This One Weird eID RCE amibeingpwned.com| via ivanr 7 days ago Am I Being Pwned presents a browser extension security analysis platform that uses behavioral analysis in sandboxed environments to evaluate extension risk, contrasting its approach with permission-based analysis from competitors like CrowdStrike and Microsoft Defender. The article highlights a specific remote code execution vulnerability affecting eID extensions used by 8 out of 10 Belgian banks.
14. Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH ethanheilman.com| via newsbot 8 days ago OPKSSH is an open-source solution enabling SSH access via OpenID Connect single sign-on tokens, replacing long-lived SSH keys with ephemeral keys (default ~24 hours expiry). It integrates OpenPubkey's PK Token concept with SSH authentication, improving security, usability, and access control through identity-based authorization rather than key distribution, with minimal server configuration changes.
15. The Devil Is In The Defaults: What To Do About XSS youtube.com| via ivanr 8 days ago This talk explores XSS defense mechanisms and browser-level protections, including Trusted Types policies, setHTML as a safer innerHTML alternative, and the concept of policy-free browser sanitization to prevent XSS attacks. The speaker discusses current implementation status across browsers and envisions a future where XSS is mitigated by default through standardized browser mechanisms, analogous to HTTPS adoption.
16. Cultivating a robust and efficient quantum-safe HTTPS blog.google| via newsbot 8 days ago Google Chrome is implementing Merkle Tree Certificates (MTCs) to make HTTPS quantum-safe by reducing TLS handshake data while maintaining post-quantum security. The rollout occurs in three phases: Phase 1 (underway) with Cloudflare using traditional X.509 certs as fallback, Phase 2 (Q1 2027) inviting CT Log operators to bootstrap public MTCs, and Phase 3 (Q3 2027) finalizing CA onboarding into Chrome's new Quantum-resistant Root Store (CQRS).
17. BGP Role model: tracking the adoption of RFC 9234 blog.cloudflare.com| via ivanr 9 days ago Cloudflare analyzes deployment of RFC 9234, which introduces BGP Role and the Only to Customer (OTC) path attribute to prevent route leaks. The study finds partial adoption with some Tier-1 networks stripping OTC attributes, hindering propagation. The article provides guidance on local deployment of BGP Roles and enabling strict mode for stronger route-leak prevention.
18. The SPIFFE Standard Roadmap spiffe.io| via ivanr 10 days ago The post outlines the SIG-Spec working group's plans for evolving the SPIFFE standard over the next 12 months, with emphasis on community engagement and industry-prioritized features. It details weekly open meetings for discussion and proposals, inviting researchers, practitioners, and enthusiasts to participate through the SPIFFE community.
19. The State of Passkeys: Studying the Adoption and Security of Passkeys on the Web usenix.org| via ivanr 10 days ago A large-scale study analyzing passkey deployment across 872 websites using PASSKEYS-RADAR dataset. Researchers discovered inconsistent passkey management practices, use of deprecated cryptographic algorithms, and demonstrated 15 attack types (10 novel) with PASSKEYS-ATTACKER tool. Testing revealed 53 of 103 sites vulnerable to high-severity attacks including account takeover, phishing, and session fixation.
20. bensanmorris/security_observability github.com| via ivanr 11 days ago CertSight is an eBPF-based real-time certificate observability tool for Linux that monitors TLS certificate activity across the infrastructure without accessing private keys or requiring application changes. It supports cloud-native, bare metal, and Kubernetes environments, detects certificates via system file access and network events, includes Java support, and provides detailed observability including TLS versions and cipher suites.
21. ShaderGhost — the tracking ID you can't delete shaderghost.gg| via ivanr 11 days ago ShaderGhost demonstrates a covert tracking mechanism that exploits GPU shader caches to create persistent tracking identifiers that survive standard privacy actions like clearing cookies or restarting browsers. The tracking ID is stored locally on the device through WebGL shader compilation timing side-channels and persists across sites, evading typical browser privacy controls. The article advocates for browsers to partition or clear GPU caches similar to cookie handling.
22. RFC 10031: Media Access Control (MAC) Addresses in X.509 Certificates rfc-editor.org| via ivanr 11 days ago RFC 10031 defines a new GeneralName form for X.509 certificates to carry IEEE MAC addresses (EUI-48 and EUI-64) in SAN and IAN extensions. It specifies encoding as big-endian octet strings, provides mechanisms for Name Constraints, and enables Layer 2 certificate-based authentication for IoT and automotive networks.
23. Aegon: Self-Auditable Key Transparency eprint.iacr.org| via ivanr 12 days ago Aegon is a key transparency system for encrypted messaging that enables lightweight end-user auditability at global scale. It uses sharded dictionary design and polynomial commitments to achieve constant-size auditor proofs (under 30 KB) with fast verification (under 65 ms), while maintaining strong privacy and short epoch latency. Prototype results show ~1,250 updates/sec throughput and 80,000× smaller proofs compared to existing approaches like WhatsApp's AKD.
24. The ePrint:2026/1591 Quantum Algorithm Does Not Solve DCP eprint.iacr.org| via ivanr 12 days ago A critique of Simon's claimed quantum algorithm for the Dihedral Coset Problem (DCP), proving that algorithms discarding too much information about Fourier-label coordinates cannot solve DCP in polynomial time. The authors establish a general no-go result and suggest successful DCP solutions require better utilization of Fourier label information.
25. Chrome Quantum-resistant Root Program Policy, Version 0.3.0 googlechrome.github.io| via ivanr 13 days ago Google Chrome's policy for establishing a quantum-resistant trust model for TLS using a separate Chrome Quantum-resistant Root Store (CQRS). Rather than adding post-quantum X.509 certificates to the standard root store, Chrome will use Merkle Tree Certificates (MTCs) issued by MTC CA Operators and cosigned by Independent Mirroring Operators for transparency. The policy outlines eligibility requirements, minimum standards for operators, and Google's discretionary authority over participation.
[](https://www.feistyduck.com/news/)
Books
Training
Resources
- News
Company
- Support
- About Us