The industry is seeing more and more attention spent on the idea of CA agnosticism. As with any buzzy technology term, it can be used to mean a variety of things. Join us as we catalog the various ways a Certificate Lifecycle Management (CLM) system can be "CA agnostic."

Root Causes 273: A Deep Dive on CA Agnostic

Concerns recently have been raised about OCSP real-time certificate checking and its potential to violate privacy.  In this episode we unpack these concerns and discuss the alternatives to OCSP.

Root Causes 272: OCSP's Privacy Problem

A white hat security researcher recently revealed a large number of identity-based vulnerabilities across many automotive manufacturers. In this episode we explain how a group of white hats exploited these manufacturers' dependence on non-secret "secrets" such as VIN or email address to force a raft of unacceptable behaviors across a large number of automotive brands.

Root Causes 271: A Whole Fleet of Identity-based Automotive Hacks

One of the little known changes that has come to the world of TLS is that the secret handshake and key exchange updated from Public Key Exchange (PKE) to Key Encapsulation Methods (KEM).  In this episode we explain the difference between the two methods and why this change is taking place.

Root Causes 270: What Is the Difference Between KEM and PKE?

On July 5, 2022 NIST announced its Round 3 PQC winners. What most people don't realize is that same day, the interested parties cleared a patent dispute that had the potential to prevent several of the winning primitives from moving forward. Join us as we explain who held that patent, what the potential impediment was, and how everything was resolved.

Root Causes 269: Did a Patent Dispute Nearly Derail Post Quantum Cryptography?

In this episode we discuss rising attacks that overcome the protections of Web Application Firewalls (WAF).  We explain these attacks, why this bypass might effective against you even if think it doesn't, and what you should do to ensure you're safe.

Root Causes 268: WAFs Subverted by JSON Bypass

Much has been made of Schor's algorithm and the inevitable defeat of RSA using quantum computers. But a new research paper suggests a quantum computer may be applied to the problem in a fundamentally different way, hastening RSA's demise beyond even our current expected timelines. In this episode we discuss this new research, reactions to it, and its potential implications.

Root Causes 267: Can Quantum Computers Break RSA Today?

Recent announcements from Apple lay out a set of expansions in the scope and capability of encryption throughout the Apple ecosystem. In this episode we detail the announced changes and some of their implications.

Root Causes 266: End-to-end Encryption in the Apple Technology Stack

2022 was post-quantum cryptography's biggest year so far.  Our hosts are joined by guest Bruno Couillard, CEO and CTO of Crypto4A.  We go over many developments in PQC, including the announcement of the NIST round 3 winners, the defeat of several late candidate algorithms, isogeny-based cryptography, hybrid certificates, and the significance of April 14, 2030.

Root Causes 265: A Banner Year for Post-quantum Cryptography

We define the important needs and initiatives that are changing the crypto agility landscape.  We discuss topics including CA independence, cryptography in public clouds, post-quantum cryptography (PQC) agility, hybrid certificates, and FIDO 2/WebAuthn.

Root Causes 264: Crypto Agility for 2023

In this episode we discuss the three methods a user might choose for secure remote communications: VPN, SSH, and TOR.  For each we discuss the reasons you might choose them and the pros and cons of each.

Root Causes 263: Secure Connection Methods Roundup

In one of our 2022 wrap up episodes, we look back at the continued erosion of the idea of reliable online identity throughout the year. We discuss the rise of deep fakes, celebrity phishing, voice biometrics, AI-generated art, trust models, and the failure of Twitter blue check marks.

Root Causes 262: The Continuing Erosion of Online Identity

The word spoof is a security industry term used in the context of social engineering attacks.  In this episode we explore the word's connotations in different walks of life and why its connotations may not serve us well when applied to security concerns.

Root Causes 261: Why I Don't Say Spoof

Public CA TrustCor has had its roots deprecated by Microsoft and Mozilla, following a public dialog about TrustCor's suitability as a public CA. This entire investigation was prompted by a Washington Post article articulating a series of connections between this CA and spyware purveyors.  In this episode we explain these connections, the public dialog and investigation that occurred, and the ultimate deprecation of TrustCor.

Root Causes 260: CA TrustCor Deprecated

The Twitter authenticated identity blue check marks made a big splash and then quickly went away.  In this episode we explore the intent of these check marks and why they failed.  In particular, we detail the challenges involved in authenticating and vouching for the identity of an individual or organization.

Root Causes 259: What Went Wrong with the Twitter Blue Check Marks

The CA/Browser Forum has passed new Baseline Requirements for S/MIME certificates, in effect late 2023.  In this episode we explain the broad stipulations of the new S/MIME BRs, including the multiple available levels of authentication and use case profiles that will be allowed.

Root Causes 258: New S/MIME Baseline Requirements Ratified

"If you don't hold the keys, you don't hold the cheese." Crypto exchange giant FTX recently collapsed, causing ripples through the cryptocurrency world. In this episode we focus on the cryptographic difference between cryptocurrency exchanges and other exchanges and how specific FTX user experience decisions led to the loss of valuable digital assets for investors.

Root Causes 257: FTX Crypto Exchange Collapses

As we prepare for the reality of quantum computers breaking RSA and ECC, a keenly important concept to understand is "Harvest and Decrypt."  The practical impact of Harvest and Decrypt is that for secrets with a reasonable lifespan, the quantum computer threat is much closer than you might think, including as early as today. In this episode we explain why that's the case and how this attack is likely to roll out.

Root Causes 256: What Is Harvest and Decrypt?

In this episode we describe privacy browsers, which quite simply are browsers designed to pay special attention to the user's privacy, including some of the strategies they use to protect privacy and the pros and cons of this approach.

Root Causes 255: What Is a Privacy Browser?

In a recently exposed error, key material for a popular automobile manufacturer's PKI has been discovered on GitHub, resulting in exposure of sensitive information.  In this episode we explain the dual errors that led to this breach.

Root Causes: A PKI and Security Podcast

Root Causes: A PKI and Security Podcast

Get Started

Download the App