Cryptography & Security Newsletter

Feisty Duck’s Cryptography & Security Newsletter is a periodic dispatch bringing you commentary and news surrounding cryptography, security, privacy, SSL/TLS, and PKI. It's designed to keep you informed about the latest developments in this space. Enjoyed every month by more than 50,000 subscribers. Written by Ivan Ristić.

The State of Post-Quantum Cryptography

For people who deal with network security, the last couple of years have been busier than usual, largely because of the impending threat of quantum computers that are going to annihilate all cryptography we use and love today. If you’re feeling fatigue from the firehose of events, you’re not alone. For me, personally, there is a sense that we’re seeing fewer and fewer technical announcements, which is perhaps pointing to the fact that most of the technical decisions have been made. At the same time, the deadlines have been shortened on account of the fears that cryptographically-relevant quantum computers (CRQC) are arriving sooner than anticipated. What lies ahead of us is definitely going to be hard, but we’ll need to only execute on the plans?

Yes and no. In one sentence: The transition to post-quantum encryption is well underway; the transition to post-quantum authentication has only just begun.

The Story So Far

If there is an official starting date for the PQC transition, it’s going to be NIST’s announcement of its new standardisation efforts in 2016. That work took a while, and the competitions took place, with the key new cryptographic algorithms officially announced in 2024. The two algorithms that led the way are ML-KEM for key establishment and ML-DSA for authentication.

In parallel with the competitions, there was a lot of conversation in the technical community about the threat model. The threat of “harvest now, decrypt later” (HNDL) presented itself as the most pressing, because attackers can capture encrypted communication today, when they can’t break it, only to attack it later, when they can. The technical communities responded with new hybrid key exchange methods, combining the currently dominant elliptic curve cryptography with the new ML-KEM standard. Browsers and big infrastructure providers moved quickly, securing most of the web traffic.

At some point, Google decided to embark on an effort to reimagine Web PKI with new certificates that mitigate the quantum threat, while at the same time largely preserving the performance characteristics. They deemed the size of the ML-DSA signatures to be too big to accept. The new Merkle Tree Certificates (MTC) combine the old (X.509 and Certificate Transparency) and new (ML-DSA, but just as little as possible) to produce a nominally better, but more complex authentication ecosystem.

Google won’t accept ML-DSA in public certificates, but they (and other vendors, for example Microsoft) already support it for use in private certificate hierarchies. Thus, the world of PKI, already fragmented, is being fractured further into MTC and X.509 with ML-DSA.

By now, the new cryptographic algorithms have made their way into the key libraries, Linux distributions, and Windows Server. MTC certificates are expected in 2027. The feeling is that the bulk of the technical work has been accomplished.

The technical work—difficult as it is—is the easier part of the migration. The other part, which requires that we examine and understand every part of our networks and systems, is complex and tedious, and it’s going to take forever. The deadlines were initially set at around 2035, but later, several big vendors settled on 2029 as their target, citing faster than anticipated technological advances. The vendors are being squeezed, because they have to complete their transition before anyone else can start.

Post-Quantum Authentication

Post-quantum authentication is where things get really messy. First, the new (MTC) certificates add a lot of complexity and machinery to achieve post-quantum security while preserving the network performance we’re used to today. To deploy them, we’ll need to create a new ecosystem of CAs working with the new technology. Then, we’ll need to rebuild ACME for it. Then, we’ll need to touch every server to replace the issuance stack. In the following years, servers serving public websites will have to switch from 1-2 certificates they use today (two if using dual RSA and ECDSA authentication), to maybe 4-5. MTC introduce two new certificate types: one is slow, but can be used immediately after issuance; the other is fast, but can’t be provided immediately. Certificate rotation, today a single event, becomes a multi-step process in the future.

But that’s not the messiest part. The downgrade attacks against authentication are.

Here’s the thing. Upgrading key establishment is relatively easy, once you select your new algorithms. In TLS, for example, an active network attacker can’t alter the initial handshake during which key establishment is negotiated. The entire handshake is authenticated and validated using… well, using public key cryptography. Today, we don’t have to worry about this step being broken because CRQCs don’t exist.

But, in a world where CRQCs do exist, a capable attacker can target the intermediate and root certificates of public CAs, and start to mint their own end-user certificates at will. That breaks everything. Upgrading clients to support PQC is not sufficient; we also have to disable all non-PQC cryptography. Otherwise, an active network attacker can intercept network traffic, even for websites that use PQC certificates, and offer elliptic curve certificates instead.

And that’s the last remaining big problem to solve. The transition of PQC authentication will take a while, but there are different ways to get there. The path in which we don’t do anything may take, perhaps, decades? All other paths require that we devise something new and make the transition faster. That new component will be another messy thing we need to add, a signal embedded somewhere that selectively upgrades to PQC-only authentication for websites that need better security sooner rather than later.

Short News

Artificial Intelligence

• Thereallo reverse-engineered Claude Code and found it steganographically marks requests by subtly altering the date string apostrophe and separator based on the API base URL hostname and system timezone, likely to flag resellers and Chinese AI lab proxies. In response, Alibaba banned its employees from using Claude Code.
• Apple expands Private Cloud Compute beyond its own data centers to Google Cloud using NVIDIA GPUs and Intel TDX, maintaining its core privacy properties including stateless computation, enforceable guarantees, and verifiable transparency.
• Matthew Green argues that Apple's plan to power Siri with Google Gemini models under an expanded Private Cloud Compute likely keeps Apple and Google out of user data, but warns that private inference alone does not resolve the deeper risks of AI agents acting on your most sensitive personal context.
• OpenAI discloses that during an internal cyber-capability evaluation with reduced refusals, its GPT-5.6 Sol and a pre-release model chained a zero-day in a package registry cache proxy with privilege escalation to reach the open internet and pull solutions from Hugging Face's production database, which it calls an unprecedented AI-driven cyber incident.
• Eric Rescorla releases a working-draft white paper distilling for policymakers what the AI safety and security literature shows, arguing existing models already aid attackers, guardrails only modestly help hosted models, and open models make preventing misuse by sophisticated users impractical.
• Jonathan Corbet (LWN) documents the worsening AI scraper bot problem, focusing on residential proxy networks that route traffic through millions of compromised devices to overwhelm websites.

Post-Quantum Cryptography

• Jan Schaumann examines why post-quantum signatures bloat TLS certificate chains and how Merkle Tree Certificates, landmark-relative inclusion proofs, and SVCB-based trust anchor discovery aim to keep handshake sizes manageable.
• PQShield's interactive comparison table of NIST post-quantum signature schemes covers all on-ramp candidates and standardised algorithms, with sortable columns for key size, signature size, speed, and security assumption.
• Microsoft's Mark Russinovich announces the company is accelerating its Quantum Safe Program to transition critical products to post-quantum cryptography by 2029, citing faster-than-expected advances in quantum computing and US and French government guidance to adopt PQC by 2030 in high-risk systems.
• ENISA maps the standardisation status of hybrid PQC across IETF protocols including TLS, IKEv2, CMS, SSH, and others, covering both key agreement and digital signature hybridization frameworks as of April 2026.
• The open access proceedings of MAgiCS 2026, the first International Workshop on Migration and Agility in Cryptographic Systems co-located with Eurocrypt 2026, collect ten peer-reviewed papers on crypto-agility, PQC migration frameworks, cryptography bills of materials, and quantum-ready systems, edited by Daniel Loebenberger and Marc Stottinger.
• Libroot.org draws a parallel between the current debate over non-hybrid PQ-only TLS and GCHQ's 2010 intervention against MIKEY-IBAKE, which was blocked in favor of MIKEY-SAKKE, a backdoored alternative with a government-held master key.

Cryptography

• RFC 9846 is a revised TLS 1.3 specification by Eric Rescorla that obsoletes RFC 8446 and consolidates several related RFCs, while also adding new requirements for TLS 1.2 implementations.
• JP Aumasson announces an update to his "Too Much Crypto" paper with clearer text, newer cryptanalysis, and a conclusion on what six years changed about his case for faster crypto.
• Bruce Schneier highlights a newly auctioned cache of wartime papers documenting Alan Turing's portable voice-encryption system Delilah, built between 1943 and 1945 and preserved for decades by his assistant Donald Bayley.
• JP Aumasson explains why breaking symmetric ciphers is both easy and hard in practice, showing how operational security can survive weak or unknown ciphers and why real-world decryption rarely comes down to pure cryptanalysis.
• The Joy of Cryptography is a free open-access undergraduate textbook introducing the fundamentals of provable security, covering pseudorandomness, symmetric and asymmetric encryption, hashing, and advanced topics.
• Scott Helme's June 2026 Tranco Top 1 Million crawl measures the cryptographic state of the web, finding free short-lived CAs dominant led by Google Trust Services and Let's Encrypt, Extended Validation certificates collapsing to 4,186 sites, and post-quantum TLS key exchange arriving at scale through provider defaults.
• The Security Cryptography Whatever podcast hosts Mark Schultz-Wu for an accessible tour through the history and intuition of lattice cryptography, from the original hardness results and LWE to NTRU, Dilithium, and Falcon.

Privacy and Society

• Patrick Breyer condemns EU governments for re-enacting Chat Control 1.0 warrantless mass scanning of private messages until April 2028 without European Parliament approval, arguing the system floods police with false alarms and criminalises children en masse rather than protecting victims.
• noyb argues the US Supreme Court's Trump v. Slaughter ruling, stripping the FTC of its independence, collapses the legal basis of the EU-US Data Privacy Framework and calls on the European Commission to withdraw its adequacy decision.
• Waag argues that European digital identity wallets relying on Google's Play Integrity API and Apple's device attestation entrench dependence on big tech, exclude de-Googled operating systems like GrapheneOS, and undermine the EU's stated goals of openness and interoperability.
• Michael Geist analyzes data showing Australia's under-16 social media ban has largely failed six months in, with multiple studies finding 70-85% of minors still accessing restricted platforms, and argues that "strengthening" the law necessarily means less privacy and more surveillance for all users.
• The EU's top court ruled that VPNs are lawful technical tools and providers are not liable when users bypass geo-blocking, in a landmark copyright case involving the Anne Frank Fonds, Rene Millman reports for TechRadar.
• US prosecutors are charging Atlanta resident Sam Tunick under a property-destruction statute after his GrapheneOS Pixel phone apparently wiped itself during an airport search, in what experts call a possibly unprecedented attempt to treat a privacy-focused operating system as criminal by default.

Public Key Infrastructure

• Corey Bonnell explains how a security weakness in the proposed dns-persist-01 ACME validation method is blocking its production rollout at Let's Encrypt and stalling the IETF standardisation process.
• AWS announces ACME protocol support in AWS Certificate Manager, letting teams use any ACMEv2-compatible client to issue public TLS certificates from Amazon Trust Services with centralized IAM-based access control, domain scoping, and CloudTrail auditability.
• GoDaddy announces two new static Certificate Transparency logs built on the Sunlight implementation: staging log Peridot and production log Aquamarine, both accepting all publicly trusted WebPKI roots, with Aquamarine already receiving all newly issued GoDaddy certificates.
• Microsoft's Trusted Root Program launches a PQC TLS Pilot letting approved CAs test post-quantum certificate hierarchies in closed non-public environments, requiring ML-DSA-87 for roots, capping certificate lifetimes, and excluding public trust and Certificate Transparency logging, Stephen Davidson reports.

Security

• Scott Helme marks ten years of crawling the Tranco Top 1 Million, finding HTTPS, HSTS, and CSP adoption climbing steadily while EV certificates collapse and several long-tracked security headers plateau or slide.
• Laneful's July 2026 monthly measurement of email authentication across the top 1M domains finds DMARC at 64%, BIMI and MTA-STS each growing roughly 2%, and DANE declining because Migadu removed TLSA records for its entire customer fleet, illustrating how adoption moves in provider-sized blocks.
• The FBI and CISA warn that Russian intelligence threat actors have evolved their messaging-app phishing campaign to elicit victims' Backup Recovery Keys, verification codes, and PINs, letting them read historical messages and hijack accounts even after a reset unless the key is regenerated.
• Google, coordinating with the FBI and Lumen, disrupted the NetNut residential proxy network by disabling associated accounts, sharing C2 infrastructure intelligence, and using Google Play Protect to warn users of apps embedding NetNut SDKs, degrading the network by millions of devices.
• LG Electronics will suspend webOS smart TV apps that turn televisions into always-on residential proxy nodes after Spur found more than 42 percent of LG store apps bundled proxy SDKs, Brian Krebs reports.
• URIports publishes an up-to-date best practices guide for SPF, DKIM, and DMARC, covering recommendations from M3AAWG and security specialists, including why ~all is preferred over -all, key rotation schedules, and DMARC enforcement policies.
• DMARCwise's Matteo explains how the new DMARC np tag in RFC 9989 conflicts with RFC 9824's Compact Denial of Existence in DNSSEC, causing np to silently fail for DNSSEC-enabled domains at Cloudflare, AWS Route 53, NS1, and Azure, with the IETF acknowledging the issue but reaching no fix.
• Scott Helme introduces Connection Allowlist, a new WICG browser security proposal in Chrome origin trial that lets a document declare an exact allowlist of permitted outbound network destinations, blocking everything else at the network layer before it leaves the machine, complementing rather than replacing CSP.
• Chrome for Developers details how NHS England, working with Hippo, rolled out passkeys for NHS login, cutting median sign-in time from 43 seconds to 5, reaching 6.7 million passkeys and 6 million monthly sign-ins, and saving up to £1.2 million on SMS OTP costs.
• Iran exploited long-known SS7 telecom signaling vulnerabilities and ad-targeting data to locate US military personnel across Middle East bases and hotels before and during the Iran War, enabling strikes that caused injuries, per Financial Times reporting relayed by Lorenzo Franceschi-Bicchierai for TechCrunch.
• RFC 10026, a new IETF Best Current Practice by Steve Sheng and Peter Thomassen, gives operational recommendations for automating DNSSEC Delegation Signer records, covering acceptance checks, error reporting, and concurrent multi-party update issues for registries and registrars.
• Cloudflare's investigation of the mandatory BGP ORIGIN attribute finds roughly 70 percent of observed paths carry an ORIGIN value different from what the originating AS set, revealing widespread manipulation that shapes how traffic is routed across the Internet.
• The European Commission published non-binding practical guidance, featuring 67 examples, use cases, and flowcharts, to help manufacturers and SMEs meet their obligations under the Cyber Resilience Act ahead of its December 2027 application.