This document defines combinations of US NIST ML-DSA in hybrid with traditional algorithms RSASSA-PKCS1-v1.5, RSASSA-PSS, ECDSA, Ed25519, and Ed448. These combinations are tailored to meet regulatory guidelines. Composite ML-DSA is applicable in applications that uses X.509 or PKIX data structures that accept ML-DSA, but where the operator wants extra protection against breaks or catastrophic bugs in ML-DSA, and where EUF-CMA-level security is acceptable.
zama-ai/concrete-ml
Concrete ML: Privacy Preserving ML framework using Fully Homomorphic Encryption (FHE), built on top of Concrete, with bindings to traditional ML frameworks.
Keri.one | The First Truly Decentralized Identity System
Key Event Receipt Infrastructure (KERI) is the first truly fully decentralized identity system.
tassis/atfield-core
Framework-agnostic AT Protocol utilities for identity resolution and public record reads.
Data integration | Proceedings of the twenty-first ACM SIGMOD-SIGACT-SIGART symposium on Principles of database systems
As part of the Digital Library's transition to Open Access, new features for researchers are available in the Premium Edition. Click here to learn more.
Structured Primary Keys
Structured primary keys prevent contradiction and perform better than surrogate keys
Differential Privacy
A robust yet accessible introduction to the idea, history, and key applications of differential privacy—the gold standard of algorithmic privacy protection
Nydus - Acceleration Framework For Cloud-Native Distribution
Nydus Provides Fast, Secure And Easy Access to Data Distribution
Evolution of AI Agent Registry Solutions: Centralized, Enterprise, and Distributed Approaches
Autonomous AI agents now operate across cloud, enterprise, and decentralized domains, creating demand for registry infrastructures that enable trustworthy discovery, capability negotiation, and identity assurance. We analyze five prominent approaches: (1) MCP Registry (centralized publication of mcp.json descriptors), (2) A2A Agent Cards (decentralized self-describing JSON capability manifests), (3) AGNTCY Agent Directory Service (IPFS Kademlia DHT content routing extended for semantic taxonomy-based content discovery, OCI artifact storage, and Sigstore-backed integrity), (4) Microsoft Entra Agent ID (enterprise SaaS directory with policy and zero-trust integration), and (5) NANDA Index AgentFacts (cryptographically verifiable, privacy-preserving fact model with credentialed assertions). Using four evaluation dimensions: security, authentication, scalability, and maintainability, we surface architectural trade-offs between centralized control, enterprise governance, and distributed resilience. We conclude with design recommendations for an emerging Internet of AI Agents requiring verifiable identity, adaptive discovery flows, and interoperable capability semantics.
A (Relatively Easy To Understand) Primer on Elliptic Curve Cryptography
Elliptic Curve Cryptography (ECC) is one of the most powerful but least understood types of cryptography in wide use today. At CloudFlare, we make extensive use of ECC to secure everything from our customers' HTTPS connections to how we pass data between our data centers.
High Assurance DIDs with DNS
This document outlines a method for improving the authenticity, discoverability, and portability of Decentralized Identifiers (DIDs) by utilizing the current DNS infrastructure and its technologies. This method offers a straightforward procedure for a verifier to cryptographically cross-validate a DID using data stored in the DNS, separate from the DID document.
RFC: Identity · tilesprivacy · Discussion #52
Tiles Identity Decentralized identifiers (DIDs) Tiles will be having decentralized identifiers, since its foremost should be used locally that means authn/authz should be also local. But since Tile...
The Digital Services Act and Theories of Power
The European Commission put a 120M EUR fine on X for DSA violations. But as the European politicians cannot get themselves to leave the platform, it shows the issues with how they understand how power works on social platforms.
alright protocol devs, some wonky bits: we revisited the recent service auth JWT harmonization proposal, and have a revision up that sticks with a single string 'aud' field. also touches on issuer 'kid', and makes 'lxm' mandatory for XRPC endpoints.
proposals/0014-service-auth-revised at main · bluesky-social/proposals
github.com