Merkle Tree Certificates

A Post-Quantum Future for Let's Encrypt

Let’s Encrypt is committed to a post-quantum-safe Web PKI. The path we’re planning to take is Merkle Tree Certificates (“MTCs”), a new approach that adds post-quantum authentication to the web without sacrificing the speed and reliability that have made TLS universal. This post is about these plans and why we believe MTCs are worth pursuing as a key to a post-quantum future. An increasingly urgent problem For much of the last several years, the conversation about post-quantum cryptography has been a conversation about encryption. The reasoning was straightforward: an attacker who records encrypted traffic today might be able to decrypt it years from now once quantum computers can break the underlying math. Authentication, the part of TLS that indicates a server is who it says it is, has been a less urgent problem. A quantum computer needs to forge a signature in real time, not retroactively, so threats to authentication hinge on the existence of a cryptographically relevant quantum computer (CRQC).

Archiving Certificate Transparency Logs

geomys/ct-archive

A directory of archived Certificate Transparency (CT) logs and tools to archive RFC 6962 and Static CT logs.

A look at the latest post-quantum signature standardization candidates

NIST has standardized four post-quantum signature schemes so far, and they’re not done yet: there are fourteen new candidates in the running for standardization. In this blog post we take measure of them and discover why we ended up with so many PQ signatures.

Node.js Cryptography Overhaul: Migrating from SHA-256 to Post-Quantum Algorithms | Markaicode

Learn how to upgrade your Node.js applications from SHA-256 to quantum-resistant cryptographic algorithms with practical code examples and migration strategies.

ATProtocol Attestations: Cryptographic Signatures for the Decentralized Web - Nick's Blog

This post introduces the formal ATProtocol attestation specification, a framework for adding cryptographic signatures to ATProto records through two complementary patterns: inline attestations that embed signatures directly in records, and remote attestations that store proof in separate repository records. The specification prevents replay attacks through repository binding, uses CID-based content addressing for integrity, and provides the cryptographic foundation for verified credentials, trusted content, and authenticated interactions in the decentralized ATProtocol ecosystem.

tailmox v1.2.0 is ready

103 votes, 15 comments. With this version, `tailscale serve` is used which helps to decouple Tailscale from Proxmox as the certificate no longer…

Sirraya One | Enterprise Decentralized Identity Platform

NIST-certified quantum-resistant identity with zero-knowledge proofs. Government & military-grade verifiable credentials.

badge.blue — CID-First Attestation Specification

Specification for CID-first attestations on AT Protocol records. Inline and remote cryptographic signatures with replay-attack prevention.

Keybase

Public key crypto for everyone, publicly auditable proofs of identity.

CE Labs

Secure systems engineering, verified all the way down to the cryptography.

CERT/CC’s VINCE Platform Enables Collaboration on Software Vulnerabilities | CMU Software Engineering Institute

The SEI’s CERT Coordination Center (CERT/CC) debuted a web-based collaboration platform for coordinated vulnerability disclosure called the Vulnerability Information and Coordination Environment (VINCE) in June.

A Digital Signature Based on a Conventional Encryption Function

A new digital signature based only on a conventional encryption function (such as DES) is described which is as secure as the underlying encryption function -- the security does not depend on the difficulty of factoring and the high computational costs of modular arithmetic are avoided. The signature system can sign an unlimited number of messages, and the signature size increases logarithmically as a function of the number of messages signed. Signature size in a ‘typical’ system might range from a few hundred bytes to a few kilobytes, and generation of a signature might require a few hundred to a few thousand computations of the underlying conventional encryption function.

BeeKEM: Decentralized, Secure and Efficient Group Key Agreement

Group key agreement protocols are essential for modern secure messaging. Most existing group key agreement protocols assume a centralized model with a semi-trusted service that mediates the communication. This is efficient, but problematic for some important applications, since a central service can be a choke point for surveillance and censorship. There is a nascent literature on decentralized group key agreement that avoids such reliance, but existing proposals either do not scale, with update costs linear or quadratic in the group size, or lack proofs of security. Centralized protocols can offer much lower (logarithmic) cost. We present BeeKEM, the first decentralized group key agreement protocol with logarithmic update cost in the common case (degrading to linear in the worst case) and proofs of security. We provide an open-source implementation and demonstrate that it is competitive with OpenMLS. BeeKEM opens the door for a range of communication and collaboration applications offering not only end-to-end encryption, but also metadata privacy and censorship resistance.

. · openai/ten-proofs@94bc0fe

Lean certificates accompanying proofs in mathematics and theoretical computer science - . · openai/ten-proofs@94bc0fe