Root Causes: A PKI and Security Podcast

Root Causes 464: Defending Against Harvest and Decrypt Feb 05, 2025

Harvest and decrypt is a well-known attack vector against traditional cryptography prior to PQC. In this episode, we discuss what enterprises should be doing today to defend themselves against harvest and decrypt.

Root Causes 463: Cellular Networks Are Insecure Feb 03, 2025

In this episode we explain that all cellular networks, contrary to popular belief, are fundamentally insecure.

Root Causes 462: Crypto War 3.0 Jan 31, 2025

In this episode we walk through the evolution of the war on cryptography, from the beginning up through today, terminating in what we call Crypto War 3.0.

Root Causes 461: Sectigo Acquires Entrust Public CA Business Jan 29, 2025

Sectigo today announced the acquisition of the Entrust public CA business. Entrust will go forward as a Sectigo reseller. Join us to learn the details.

Root Causes 460: The State of PQC with Michele Mosca Jan 28, 2025

In this episode we are joined by Dr. Michela Mosca. We discuss his pioneering work identifying the need for post-quantum cryptography, where PQC stands today, and what the future may hold.

Root Causes 459: 2024 Lookback - Shortening Certificate Lifespans & DCV Jan 24, 2025

2024 set in motion major changes for certificate lifespans and DCV. In this episode we discuss the Apple 47-day proposal, stepping down certificate term, public versus private CA use cases, DCV reuse periods, MPIC, WHOIS, and other topics.

Root Causes 458: Apple Extends Entrust Distrust to SMIME and VMC Jan 19, 2025

Apple has added itself to the Entrust distrust and has extended this distrust to S/MIME and VMC. We explain.

Root Causes 457: 2024 Lookback - Guests Jan 17, 2025

We had a remarkable year on the Root Causes podcast in terms of our guests. We look back at the extremely expert guests we were lucky to talk about in 2024.

Root Causes 456: 2024 Lookback - Bugzilla Bloodbath Jan 14, 2025

In this 2024 lookback episode, we give an overview of the firestorm of Bugzilla incidents that we refer to as the Bugzilla Bloodbath. The Bugzilla Bloodbath affected actions around the Entrust distrust, delayed revocation reform, 47-day SSL certificate maximum term, linting, and more.

Root Causes 455: PQC Standardization in IETF Jan 08, 2025

We talk with guest Sofia Celi of Brave Browser, who leads the IETF PQC standardization effort, about the process of setting standards for PQC-compatible digital certificates. We learn about expected timelines, hybrid strategies, the NIST PQC onramp's role, and more.

Root Causes 454: 2024 Lookback - Post quantum cryptography (PQC) Jan 02, 2025

2024 was an eventful year for post quantum cryptography (PQC). This includes FIPS standards, the PQC onramp, and the dawn of widespread interest among IT professionals.

Root Causes 453: It Turns Out Monkeys Couldn't Type Shakespeare After All Jan 02, 2025

The old adage states that a monkey in front of a keyboard, given enough time, could randomly type the works of Shakespeare. Apparently, someone ran the numbers and said not so much. We break it down and explain why we're discussing this on a PKI podcast.

Root Causes 452: 2024 Predictions Scorecard Dec 26, 2024

We go over our predictions for 2024 and score our ability as prognosticators.

Root Causes 451: A Year in CABF Ballots Dec 26, 2024

It was a crazy year for CA/Browser Forum activity, with nearly three times the normal number of ballots. Guest Martijn Katerbarg goes over the 32 CABF ballots from 2024.

Root Causes 450: 2025 Predictions Dec 23, 2024

We make our 2025 predictions. Topics include maximum certificate term, AI, post-quantum cryptography (PQC), deep fakes, and more.

Root Causes 449: What Is a Quantum-safe HSM? Dec 18, 2024

Repeat guest Bruno Coulliard of Crypto4A joins us to define a quantum-safe (or PQC enabled) hardware security module.

Root Causes 448: The Privilege of Being a Public CA Dec 17, 2024

We go over Tim's September 2024 keynote speech at ENISA CA Day, "The Privilege of Being a Public CA."

Root Causes 447: NIST Deprecates RSA-2048 and ECC 256 Dec 13, 2024

As part of its post-quantum cryptography (PQC) initiative NIST has released a draft deprecating RSA-2048 and ECC 256 by 2030 and disallowing them by 2035. We get into the details.

Root Causes 446: Sectigo Assumes Five CABF Offices Dec 12, 2024

Tim has stepped into the position of vice-chair of the CA/Browse Forum, and Sectigo now holds five chair or vice-chair positions in that body. We explain how leadership is chosen, the offices Sectigo holds today, and some of our vision for CABF in the next two years.

Root Causes 445: Seven Reasons to Shorten Certificate Lifespans Dec 09, 2024

We take a deep dive into the seven reasons shorter certificate lifespans are better.

Root Causes 444: What Happens to the WebPKI if Google Sells Chrome? Dec 05, 2024

We discuss how a potential break of Chrome from Google would affect the WebPKI. We look at product changes, resourcing, post-quantum cryptography (PQC), innovation, moonshot initiatives, and other public CAs.

Root Causes 443: Is MSCA Going Away? Dec 01, 2024

In this episode we discuss the challenges for enterprises using Microsoft Active Directory Certificate Services (ADCS).

Root Causes 442: Apple Proposal to Reduce SSL Lifespan Updated Nov 25, 2024

Apple has published an updated draft to its proposal for shortening the lifespan of SSL certificates, including a final maximum term of 47 rather than 45 days. We explain.

Root Causes 441: New White House Initiative Targets BGP Nov 22, 2024

A new White House initiative requires that federal agencies need to create plans to thwart BGP attacks. We discuss, including Resource PKI (RPKI) and Multi-Perspective Issuance Corroboration (MPIC).

Root Causes 440: Public Key Directories Nov 18, 2024

We talk about public key directories and complicating factors such as Tailscale, VPN, TOR, Cloudflare, and Zero Trust.

Root Causes 439: PQC Onramp Narrowed Down to 15 Candidates Nov 15, 2024

NIST has narrowed its PQC onramp contest to 15 candidates. We go over who remains and the makeup of the remaining candidates.

Root Causes 438: PQC Is an Existential Requirement Nov 12, 2024

Repeat guest Bruno Couillard argues that cryptography is part of the foundational fabric of our lives and that the transition to PQC is an existential requirement.

Root Causes 437: Don't Blame the Linter Nov 05, 2024

Linters are essential tools for maintaining quality of certificate issuance. Public open-source linters are available to help CAs assure compliance. As a result, CAs have begun attributing gaps in coverage by public linters as the root cause for misissuance events. We explain why this is faulty reasoning.

Root Causes 436: Formal Proofs Oct 29, 2024

Formal proofs are critical to cryptography. We discuss how better processes and AI can accelerate formal proofs of cryptographic concepts.

Root Causes 435: The PQC "Q Day" Is Not That Simple Oct 25, 2024

The PQC community likes to debate when crypto relevant quantum computers will be available, which is sometimes called "Q day." In this episode we explain how radically oversimplified this concept is and dive into the nuances of what a "cryptographically relevant quantum computer" really will be.

Root Causes 434: Did Researchers Break AES Using Quantum Annealing? Oct 22, 2024

News reports claim Chinese researchers broke AES with a quantum annealing computer. We clarify the details and talk about the implications of this reported discovery.

Root Causes 433: Will AI Eat All the Electricity? Oct 17, 2024

We explore the question of whether or not we have enough electricity to fuel AI's expected growth.

Root Causes 432: Apple Floats New Short-lived Certificate Proposal Oct 14, 2024

Apple recently floated a draft CABF ballot for commentary that steps down maximum term for SSL certificates starting next year and eventually landing at 45 days in 2027. We share the details.

Root Causes 431: New Mozilla Proposal to Combat Delayed Revocation Oct 11, 2024

Deliberate delay of mandatory revocations has plagued the WebPKI in 2024. A new proposed policy from Mozilla stands to eliminate most of this behavior. In this episode we go over the proposal and explain its potential consequences.

Root Causes 430: How Does a TLS Handshake Work? Oct 09, 2024

In this episode we give a high-level explanation of what happens in a TLS 1.3 handshake and then discuss what will happen when PQC is included.

Root Causes 429: ServiceNow Outage Due to Expired Root Certificate Oct 08, 2024

A ServiceNow private CA root expired, creating outages across hundreds of enterprises. We explain what appears to have gone on.

Root Causes 428: .MOBI Attack Puts WHOIS-based DCV into Question Oct 04, 2024

White hat researchers managed to take over WHOIS for the .mobi TLD. Among other things, this discovery foretells the death of WHOIS as a valid email source for Domain Control Validation (DCV).

Root Causes 427: Mapping CLM to NIST CSF 2.0 Oct 01, 2024

In this episode we map the contributions of Certificate Lifecycle Management into the new NIST Cybersecurity Framework 2.0.

Root Causes 426: Expired Certificate Takes Down Bank of England Sep 30, 2024

A certificate expiration is now known to have created July's outage of Bank of England. Join us as we shake our heads in amazement yet again.

Root Causes 425: PQC Requirements for Voting Systems Sep 27, 2024

In honor of the upcoming US elections, we describe the six main requirements for a post-quantum voting system.

Root Causes 424: Using LoRA IoT Protocol for Clandestine Communications Sep 25, 2024

In this episode we describe the LoRA protocol, which allows IoT devices to communicate securely without using a cellular network, and how it can be used for secret communications.

Root Causes 423: Is a Certificate Software or a Service? Sep 20, 2024

In this episode we discuss the dual nature of a public certificate as both a file and part of a holistic service that lasts until its expiration. We discuss revocation checking, CT logging, GAAP accounting, linters, certificate tracking tools, Certificate Lifecycle Management, standards bodies, post-quantum cryptography, and subscription models.

Root Causes 422: New Date for Entrust Distrust Sep 19, 2024

The Chrome root program has changed the date for the Entrust distrust. Join us to get the details.

Root Causes 421: FIDO 2 Implementation Problems Sep 16, 2024

White hat researchers have raised concerns about FIDO 2 (AKA WebAuthn). We explain.

Root Causes 420: New Side Channel Attack Against YubiKeys Sep 13, 2024

EUCLEAK, a newly revealed side channel vulnerability, can clone the contents of a YubiKey. We talk about the attack and its significance.

Root Causes 419: What Happens to Vendors Who Don't Support ACME When 90-day Certificates Come? Sep 08, 2024

Though it is the closest thing to an industry-standard API, there are still products and operating systems that don't support ACME. In this episode we explore what happens to these products once 90-day SSL certificates become the requirement.

Root Causes 418: Moving from Cryptographic Homogeneity to Cryptographic Heterogeneity Sep 06, 2024

One seldom discussed consequence of quantum computers and PQC is the move from cryptographic homogeneity to cryptographic heterogeneity, with multiple KEMs and DSAs eventually expected as ongoing standards. We examine the consequences of this change.

Root Causes 417: Introducing pkimetal, the PKI Meta-linter Sep 02, 2024

We introduce pkimetal, an open source project from Rob Stradling that allows CA to write to many popular linters with a single integration. We explain the importance and pitfalls of linters and how pkimetal improves linter implementation.

Root Causes 416: SSL Subscriber Uses a Restraining Order to Prevent Revocation Aug 29, 2024

An enterprise SSL subscriber recently used a Temporary Restraining Order to prevent the proper revocation of misissued certificates. We explain what happened, why it's deeply problematic, and how the industry might consider responding.

Root Causes 415: What Can I Do with These New FIPS PQC Standards? Aug 27, 2024

NIST recently released PQC algorithmic standards in FIPS-203, FIPS-204, and FIPS-205 (ML-KEM, ML-DSA, and SLH-DSA). We describe what is necessary for enterprises to begin using these algorithms.

Root Causes 414: What Are the Revocation Periods for Public Certificates? Aug 23, 2024

In this episode we detail the mandatory revocation periods for leaf certificates and intermediates and explain when a 24-hour versus a 120-hour revocation deadline applies.

Root Causes 413: NIST Releases Standards for First Three PQC Algorithms Aug 16, 2024

On August 13, 2024, NIST released its first three standards for PQC algorithms, ML-KEM, ML-DSA, and SLH-DSA. We tell you where to find them and talk about what happens next.

Root Causes 412: Google Throws in the Towel on Eliminating Cookies Aug 13, 2024

Cookies are incredibly useful but also pose grave privacy concerns. We have in the past covered Chrome's initiatives to replace cookies. Now Chrome has announced that for the foreseeable future cookies will remain. We explain.

Root Causes 411: PQC Security Levels Aug 09, 2024

A popular belief is that Grover's algorithm will require that we double our AES key sizes. Repeat guest Bas Westerbaan of Cloudflare explains why this myth is incorrect and talks through the concept of "security levels" in post-quantum cryptography.

Root Causes 410: CrowdStrike, Automatic Updates, and Walled Gardens Aug 06, 2024

We examine one specific aspect of the recent CrowdStrike flaw. Microsoft blames the problem on the fact that it must, by European law, allow kernel updates to Windows. We unpack the challenges this poses.

Root Causes 409: Mozilla Distrusts Entrust Aug 02, 2024

This week Mozilla chose to follow Chrome in deprecating the Entrust trusted roots. We give you the details and explain why this action matters.

Root Causes 408: Takeaways from Recent Conversations with PQC Experts Jul 29, 2024

In the past three months we featured far-ranging conversations about post-quantum cryptography (PQC) with experts Bas Westerbaan of Cloudflare, Dustin Moody of NIST, and Bruno Coulliard of Crypto4A. In this episode we recap important takeaways from these conversations.

Root Causes 407: Whatever Happened to Passkeys? Jul 25, 2024

WebAuthn arrived last year with great fanfare. But here we are in the latter half of 2024, and they are rarely used. In this episode we discuss why.

Root Causes 406: Certificate Discovery Is for Internal Certificates, Too Jul 22, 2024

When we discuss certificate discovery in CLM platforms, there is a common assumption that we're talking about public certificates exclusively. In this episode we explain the value of certificate discovery for internal PKI certificates also.

Root Causes 405: What Is an Adversarial Self-replicating Prompt? Jul 19, 2024

In this episode we explain what an adversarial, self-replicating prompt, otherwise known as a prompt worm.

Root Causes 404: SCOTUS Ruling Will Change IT Security Regulation Jul 16, 2024

The US Supreme Court has struck down the Chevron Deferment, which greatly expanded federal agencies' power to interpret and enforce statutes. This monumental ruling stands to shift power considerably from agencies to courts and will put more pressure on legislatures to determine precise laws around tech. We explore the consequences of this ruling.

Root Causes 403: NIST PQC Contest Round 4 and Onramp with Dustin Moody Jul 12, 2024

We are joined again by Dustin Moody, who leads the NIST search for PQC algorithms. In this episode Dustin describes going-forward efforts, including Round 4 of the NIST contest and the Onramp. We discuss some of the candidate algorithms and the consequences of having multiple algorithms available for use.

Root Causes 402: New Social Engineering Powershell Attack Jul 09, 2024

A new social engineering exploit instructs victims to enter command line prompts to hack themselves on behalf of the hacker. We explain and discuss potential responses.

Root Causes 401: New SSH Remote Code Execution Vulnerability Revealed Jul 05, 2024

A newly revealed OpenSSH vulnerability can open enterprises to remote code execution. We explain what is happening, why you should care, and what to do about it.

Root Causes 400: French Court Orders DNS Poisoning Jul 02, 2024

To combat piracy of sporting event transmissions, a French court has ordered major tech companies including Google and Cloudflare to poison DNS settings. In this episode we provide some detail and generally marvel at this strange decision.

Root Causes 399: Entrust Distrusted Jun 28, 2024

On June 27, 2024 Google Chrome announced it was distrusting Entrust as a public CA starting November 1, 2024. We explain what to expect, go over Google's stated reasons, and share some of what lead up to this.

Root Causes 398: History of the NIST PQC Contest with Dustin Moody Jun 27, 2024

In this episode we are joined by Dr. Dustin Moody, leader of the NIST post-quantum cryptography contest. Dustin gives us an inside view of the background behind NIST's decision to run the contest and how we got to where we are today.

Root Causes 397: All Post Quantum Systems Are Terrible Jun 24, 2024

In this new conversation with Bas Westerbaan of Cloudflare, we reveal that all existing PQC systems present significant problems for incorporation into our existing ecosystems. We explain the problems with existing systems and some options for what to do about it.

Root Causes 396: The Trouble with Microsoft Recall Jun 21, 2024

Microsoft has proposed a feature called Recall that uses screen images to fuel AI-assisted capabilities. This has raised fears about the security decisions around this capability. We talk about why and how the proposed technology has resultingly changed.

Root Causes 395: Is Y2Q Like Y2K? Jun 18, 2024

In this episode we compare the advent of cryptography relevancy of quantum computers (somestimes called Y2Q) to Y2K. We uncover similarities and differences and discuss how they govern decision making between now and Y2Q.

Root Causes 394: Snowflake, Ticketmaster, and MFA Jun 14, 2024

In this episode we drill down on one aspect of the loss of more than 500 million Ticketmaster users' data, which is the use of MFA for access to the Snowflake platform.

Root Causes 393: PQC-enabled Chrome Breaks Other Software Jun 11, 2024

Chrome's recent 124 release supports PQC algorithms from NIST. This has led to the discovery of software and systems that break under these circumstances. We explain what happened, why, and what to do about it.

Root Causes 392: Chromium Issues a Quality Ultimatum Jun 07, 2024

In the most recent CA/Browser Forum face-to-face meeting, the Google Chrome root program gave a presentation clearly defining its expectations for quality of incident reporting from CAs with an eye to where many CAs have been failing. We relate Chromium's statements and their significance.

Root Causes 391: 20 Percent of Web Visits Are PQC Enabled Today Jun 04, 2024

Cloudflare research engineer Bas Westerbaan joins us to share his observations about post-quantum cryptography and what it does in the real world. We talk about the pragmatic needs of moving the internet for PQC and speculate about timelines for availability of PQC certificates.

Root Causes 390: Chromium Boosts Its Distrust Agility with a New Root Trust Deprecation May 31, 2024

A root trust deprecation highlights new Chrome functionality that enables more agile and less disruptive distrust events. We explain the significant of this event.

Root Causes 389: 2024 RSA Conference Wrap Up May 28, 2024

Jason and I do our annual RSA wrap-up. Trending segments include AI, Trust Centers, MFA, PQC, and more.

Root Causes 388: What Is the WebPKI? May 22, 2024

These days we frequently discuss "the WebPKI." But what does that really mean? In this episode we define the term and explain how this definition evolved over time. We give an inventory of a main components of the WebPKI and discuss what's required to become a CA.

Root Causes 387: What Is the Post-quantum Readiness of HSMs? May 16, 2024

We take a deep dive with return guest Bruno Coulliard on HSMs and the role they play in post-quantum cryptography (PQC).

Root Causes 386: Meta Commits MITM Attack On Its Users May 13, 2024

Recent court documents reveal that in 2016 Meta (then Facebook) set up a system to get around encryption and spy on traffic between its users and competing social media platforms. We explain what happened.

Root Causes 385: Failed Revocation and Wildcard Certificates May 10, 2024

We discuss misuse of wildcard certificates, failure to revoke on time, and how these two failures magnify each other.

Root Causes 384: So What Is a Senior Fellow Anyway? May 07, 2024

Jason has a new title, Senior Fellow. In this episode Jason explains what his new focus will be and how this will be good for Root Causes.

Root Causes 383: Delayed Revocation Events by the Numbers May 02, 2024

An epidemic of delayed revocations has infected the public CA community. We track delayed revocations since the beginning of 2021, examine the trend line, and discuss root causes.

Root Causes 382: Mobile Phone Malware Steals Faces for Access Apr 29, 2024

New malware photographs users' faces to defeat authentication mechanisms. We explain the that biometrics are not "secrets" and discuss the continuing progression of attacks to steal biometrics.

Root Causes 381: Apple Chip Sideloading Attack Leaks Encryption Keys Apr 26, 2024

A newly revealed side channel attack enables theft of private keys from M-series Apple chips. We explain.

Root Causes 380: What If Quantum Supremacy Comes Earlier Than We Thought? Apr 22, 2024

Repeat guest Bruno Coulliard gives us an update on the US government's migration to post-quantum cryptography (PQC). We talk about the challenges to migration, the possibility of a black swan event in achieving quantum supremacy, and what happens if we all respond by pressing the "panic button" at the same time.

Root Causes 379: AI-generated Fake IDS for KYC Apr 18, 2024

Inexpensive and easily obtained deepfake photographs of IDs, generated by AI, are available online. These pose a problem for KYC initiatives.

Root Causes 378: Why Are Forced Revocations So Difficult? Apr 15, 2024

In the latest in our ongoing series of discussions of the Bugzilla Bloodbath, we delve deep into the problem of failure to revoke on time and the multiple causes that lead to this ongoing failure. And what to do about them.

Root Causes 377: Is CPS/Issuance Misalignment a Revocation Event? Apr 11, 2024

If you issue public certificates that are fully compliant except that they do not reflect what your CPS says, are they misissued? Do they require revocation? This is a question with real stakes as we see multiple current instances of a CA denying revocation for that reason. In this episode we explore this issue.

Root Causes 376: Gartner's New CLM Framework Apr 08, 2024

Gartner has released a new framework for Certificate Lifecycle Management, called the Seven Core Functions of Certificate Automation. We walk through this framework and answer how it fits in with our own Five Pillars of CLM.

Root Causes 375: What Is Name Space Lifecycle Management? Apr 05, 2024

In this guest episode we discuss name space hygiene with Geir Rasmussen, founder of NodeZro. CNAMEs, SPF, DMARC, name server entries, and other DNS identifiers, left unattended, can expose companies to identity-based attacks. We lay out the steps in addressing name space cleanup.

Root Causes 374: NIST Cyber Security Framework 2 Released Mar 31, 2024

NIST Cyber Security Framework version 2.0 is released. It includes guidance on identity management and authentication. In this first episode of a series, we describe this framework's basic structure and its effect on industry.

Root Causes 373: Massive Brand Hijack Subverts More Than 21,000 Domains and Subdomains Mar 29, 2024

A massive name space attack has hijacked more than 21,000 domains and subdomains, including a who's who list of major global brands. This huge and innovative attack takes advantage of inherited trust in abandoned domains. We explain what is happening.

Root Causes 372: Bugzilla Bloodbath Mar 26, 2024

It's a bloodbath on Bugzilla. Since March 9, more than 25 new Bugzilla bugs been written up, which is 10x the typical pace. And it's not over. In this episode we explain what is going on and why.

Root Causes 371: MPIC Rules Go to CABF Ballot Mar 22, 2024

A ballot for Multi-perspective Issuance Corroboration (MPIC), formerly known as MPDV, has entered a discussion period in the CA/Browser Forum (CABF). We explain the details of what it contains.

Root Causes 370: Drama on Bugzilla Mar 19, 2024

An evolving incident on Bugzilla has garnered a lot of attention and touches several important issues in the WebPKI ecosystem. We report what went on and unpack the issues involved.

Root Causes 369: iMessage to Be PQC Enabled Mar 14, 2024

Apple has announced that iMessage will employ post-quantum cryptography (PQC). We explain the implications of this announcement.

Root Causes 368: CRYSTALS-Kyber Is Now ML-KEM Mar 13, 2024

What has been known as CRYSTALS-Kyber now has the new official name of Module Lattice-based Key Encryption Module, or ML-KEM. We give an update on the state of the NIST round 3 winners.

Root Causes 367: Did an IoT Toothbrush Botnet Perform DDoS Attacks? Mar 07, 2024

A story circulated earlier this year about a botnet composed of millions of IoT toothbrushes, which later was debunked. We tell you the whole tale.

Root Causes 366: What Is eIDAS? Mar 04, 2024

eIDAS 2.0 has been making headlines recently with its proposed expansion to the European digital identity ecosystem. But what is eIDAS? What does it do, and why does it exist? In this episode we give you the basics.

Root Causes 365: What Is Subdomain Hijacking? Feb 26, 2024

In this episode we explain subdomain hijacking, including dangling subdomains and how they can constitute vulnerabilities.

Root Causes 364: Video Conference Deepfake Enables $25 Million Theft Feb 22, 2024

Deepfakes continue to show themselves as part of the standard criminal toolkit. A recent deepfake spear phish enabled a $25 million Business Email Compromise (BEC). We explain what happened.

Root Causes 363: Defending Yourself Against Use of Stolen Privileges Feb 18, 2024

CloudFlare recently published details of an attack it suffered as a downstream effect of a November 2023 breach against Okta and what it did to nullify its success. We discuss the steps enterprises can take to protect themselves against malicious use of stolen access credentials.

Root Causes 362: When You're Attacked by a State Actor Feb 12, 2024

In this episode we share the details of a recent nation state actor attack on Microsoft and some of the lessons learned.

Root Causes 361: The Premise of on Premise Feb 09, 2024

In this episode we examine commonly held belief that on-premise systems give system administrators greater levels of control and that that is better for security or other reasons. We explore the pros and cons of extra control, to what degree it is a benefit, and if it's worth it.

Root Causes 360: Joe Biden Deepfake Plays in New Hampshire Primary Feb 06, 2024

A deepfake of Joe Biden's voice made an appearance in robocalls leading up to the New Hampshire primary. We discuss this latest development and its implications.

Root Causes 359: 90-day SSL Won't Affect Organization Validation Periods Feb 02, 2024

With maximum 90-day term coming for public SSL certificates and DCV reuse also moving to 90 days, we explain why we do not expect a similar reduction in the reuse period for organization validation.

Root Causes 358: Security Questionnaire Sins Jan 30, 2024

In this episode we present a catalog of "security questionnaire sins," which are avoidable problems and errors that frequently occur in the security questionnaires enterprises send to vendors. Categories include difficulty of access, poor technical implementation, poor policies, and poor questions.

Root Causes 357: Signed Digital Photographs Jan 26, 2024

Three major camera manufacturers have joined to create a standard for signed digital images from their cameras.

Root Causes 356: Will MPDV Eliminate Email-based DCV? Jan 22, 2024

Multi-perspective Domain Validation (MPDV) is a necessary evolution of Domain Control Validation (DCV) to protect against Border Gateway Protocol (BGP) attacks. We explore how MPDV may affect accepted DCV methods, especially the email method.

Root Causes 355: Should a Managed PKI Provider Do Whatever the Customer Wants? Jan 19, 2024

In this episode we explore whether a managed PKI provider should give complete control over PKI decisions to the end customer or if it should enforce certain minimum standards and principles regardless of what the customer asks for.

Root Causes 354: CyberSlash Attack Against CRYSTALS-Kyber Jan 16, 2024

A newly published attack against common implementations of CRYSTALS-Kyber illustrates how cryptographic implementations can be vulnerable even if the cyphers themselves remain sound.

Root Causes 353: Why Isn't PKI Everywhere? Jan 09, 2024

Our hosts firmly believe that PKI is a necessary component of all digital interactions. And yet there are still gaps in PKI implementation. We discuss these gaps and why they persist.

Root Causes 352: FBI Vs. End-to-end Encryption in Meta Apps Jan 04, 2024

Meta is finally rolling out end-to-end encryption across its messaging apps. This is the latest chapter in the long story of government versus encryption. We rant a little about this.

Root Causes 351: 2024 Predictions Dec 27, 2023

We look forward to 2024 and predict trends for PKI, certificates, and digital identity. We discuss shortening certificate lifespans, Multi-perspective Domain Validation (MPDV), eIDAS 2.0, OCSP, post-quantum cryptography (PQC), Certificate Lifecycle Management (CLM), passwords, root stores, and government versus encryption. Plus, will Jason be sent to the gulag for not being Canadian enough?

Root Causes 350: Public Certificates and the GDPR Right to Be Forgotten Dec 21, 2023

GDPR provides a "right to be forgotten," whereby individuals can demand the removal of PII from IT systems. This can run directly contrary to the transparency and permanence built into the DNA of public PKI systems. We explore this conundrum.

Root Causes 349: 2023 Lookback - Overall Trends Dec 18, 2023

We look back at PKI in 2023. Trends include artificial intelligence, enterprise crypto agility, the fall of OCSP, PKI everywhere, the weakness of passwords, and government versus the internet. We also look at last year's predictions and compare them to the year's events.

Root Causes 348: What Is a Merkle Tree? Dec 15, 2023

One foundational element of modern cryptographic systems is the Merkle tree. Merkle tree is an enabler of blockchain and CT logs, among other things. We explain this data structure, its properties, and its use cases.

Root Causes 347: 2023 Lookback - Shortening Certificate Lifespans Dec 11, 2023

90-day SSL certificates is only part of it! 2023 has been a year of certificate lifespans getting shorter. We review these trends.

Root Causes 346: Private Credentials In Public Code Dec 08, 2023

In this episode we uncover the epidemic of private credentials in public-facing code repositories, including why it occurs and what do to about it.

Root Causes 345: Apple Versus European Sideloading Dec 05, 2023

The European Union is applying pressure to Apple to allow sideloading of applications. We go over why this is occurring, the potential dangers, and Apple's response.

Root Causes 344: Introducing the PQC Onramp Nov 29, 2023

NIST's Round 3 competition has yielded winners for standardization. But NIST wants to continue finding additional potential algorithms, especially those using non-Lattice schemes. We explain the PQC "onramp" and what we should expect.

Root Causes 343: The EIDAS 2.0 Controversy Nov 22, 2023

ETSI is preparing to release specifications for eIDAS 2.0. One controversial aspect of this new standard is that it limits browsers' ability to determine their own trusted roots. In this episode we explain this limitation and the concerns surrounding it.

Root Causes 342: Don't Change Your Password for Two Years Nov 17, 2023

The CA/Browser Forum rules stipulate how often forced password changes for CA employees are to occur. They don't, however, specify a frequency at which these forced changes must occur. Rather, they set the MINIMUM time before forced password changes can happen. Join us to learn why.

Root Causes 341: The Trouble with Security Questionnaires Nov 13, 2023

The practice of sending security questionnaires to technology vendors is exploding, and with it dysfunctional behavior is on the rise. In this episode we describe how security questionnaires are changing and the pitfalls associated with this emerging practice.

Root Causes 340: Is This Podcast Canadian Enough? Nov 06, 2023

Canada's Online Streaming Act will require internet content providers to provide a minimum percentage of content produced by Canadians or face fines. We explore this latest episode in the theme of governments attempting to control the free flow of information on the internet.

Root Causes 339: The ROI of CLM Oct 31, 2023

In this episode we describe at a high level how to calculate the Total Cost of Ownership (TCO) of CLM as opposed to manual installation and management of certificates.

Root Causes 338: CLM and Your Career as an IT Professional Oct 23, 2023

In this follow up to our episode on CLM and the IT skills gap, we now discuss how CLM matters to individual IT professionals and can help progress careers and improve work life.

Root Causes 337: CLM and the IT Skills Gap Oct 10, 2023

For decades industry has had more need for skilled IT employees than the workforce could provide. In this episode we discuss how Certificate Lifecycle Management and certificate automation can help mitigate the challenges posed by the IT skills gap.

Root Causes 336: Digitally Signing Images on Cameras Oct 03, 2023

A recent press release discusses efforts of camera manufacturers and the digital imagery supply chain to create an ecosystem for digitally signed images. We describe what such an ecosystem would do, where it could do in the future, and the advantages and limitations of these schemes.

Root Causes 335: When MFA Is Not MFA Sep 29, 2023

In this episode we describe a social engineering attack to steal a one-time password (OTP) to enable unauthorized access. This incident further exploited a cloud backup feature to extend the scope of the breach. We explain.

Root Causes 334: What Is Attestation on the Web? Sep 26, 2023

Most people hate dealing with CAPTCHA, but it offers great benefits for web site operators. In this episode we discuss alternatives to CAPTCHA, how they work, and their pros and cons. Plus, the Get-Off-My-Lawn! browser returns.

Root Causes 333: Intel Side Channel Attack Steals Private Keys Sep 20, 2023

A newly revealed side channel attack can capture AES encryption keys from Intel chips. We explain this significant and powerful attack.

Root Causes 332: Acoustic AI-based Key Logging Attack Sep 14, 2023

Researchers have built an AI model that can interpret keystrokes based on the sound of keyboard use over a phone or video call. Among other things, this technique can be used to steal passwords when the sound of logging in can be overheard. Join us as we learn about this new breed of credential harvesting.

Root Causes 331: Microsoft Restores Trust to VeriSign Code Signing Root Sep 13, 2023

Recent erroneous behavior for certain applications on Windows has drawn attention to the Microsoft trusted root store. It turns out that Microsoft removed - and then re-added - a legacy VeriSign root in its trusted roots list. We give you the details of what went on and why.

Root Causes 330: End-to-end PQC in Use Today Sep 05, 2023

Our hosts are joined by IronCap CEO Andrew Cheung as he discusses commercially available PQC solutions today, including VPN, email, and crypto currency.

Root Causes 329: What Is Messaging Layer Security? Aug 29, 2023

The recently published Messaging Layer Security (MLS) protocol establishes key exchange protocols for participants in a simultaneous communication session for three or more participants. We explain its significance and possible futures for this standard.

Root Causes 328: What Is the Debian Weak Key Flaw? Aug 23, 2023

In 2008 the world of SSL was shocked by the discovery of a flaw in a popular operating system that limited the total set of possible private keys on this OS to about 32,000. We explain what happened, industry response, and its consequences.

Root Causes 327: What Is Multi-perspective Domain Validation? Aug 18, 2023

In this episode we explain Border Gateway Protocol (BGP) attacks and how multi-perspective domain validation (MPDV, also known as multi-vantage point domain validation) can defeat them.

Root Causes 326: The Difference Between .ml and .mil Aug 15, 2023

A recent Financial Times article reveals that mistyped email addresses aimed at the US military frequently are sent to email addresses in Mali instead, to the tune of hundreds of thousands per year. Some of this includes sensitive military content.

Root Causes 325: Certificate Error Causes Sharepoint Outage Aug 11, 2023

A recent outage in Microsoft Sharepoint was caused by an error in certificate installation. We explain what happened and the lessons to be learned.

Root Causes 324: Apple Vs New UK Surveillance Bill Aug 07, 2023

The battle between government and encryption continues. The UK is attempting to build secret back doors into end-to-end encrypted services. In response, Apple has threatened to remove Apple services from the UK, including FaceTime and iMessage.

Root Causes 323: Update on Microsoft Key Compromise Aug 02, 2023

In this follow up to our episode 320, we describe Microsoft's actions to mitigate this attack and explain new understanding that shows its impact to be broader than originally thought. Anyone using the Microsoft stack needs to understand this new threat.

Root Causes 322: RIP Kevin Mitnick Jul 31, 2023

In July famous security researcher Kevin Mitnick passed away. We briefly pay tribute to Kevin and talk about his contributions to white hat hacking as a practice.

Root Causes 321: CABF Moratorium on New Certificate Consumer Members Jul 26, 2023

The CA/Browser Forum recently passed a temporary moratorium on new members of the Certificate Consumer class. We explain how Certificate Consumers have been admitted in the past and the pros and cons of creating stricter rules for Certificate Consumers.

Root Causes 320: Microsoft-signed Root Kit Attack Jul 24, 2023

A new root kit attack in the wild is code signed by a Microsoft certificate. We explain kernel-level attacks, how powerful they are, and how this attack occurred.

Root Causes 319: EU Digital Wallets Jul 21, 2023

A new agreement mandates that European countries will make digital wallets available to their citizens in 2024. We explain what's coming and some of its implications.

Root Causes 318: What Is ACME Renewal Information (ARI)? Jul 18, 2023

ACME is a functional and widely supported protocol for certificate provisioning and installation. A new extension to the protocol will help automate renewals. In this episode we explain ACME Renewal Information (ARI).

Root Causes 317: New Automotive CAN Bus Attacks Demand PKI Jul 13, 2023

In this episode we describe how physically accessing the CAN bus wires in a modern automobile can allow a thief to take over key fob functionality to unlock the doors, start the engine, and ultimately steal the vehicle. We explain how PKI can defeat this attack and what is necessary to get there.

Root Causes 316: SquareSpace Acquires Google Domains Jul 11, 2023

SquareSpace recently acquired Google's domain registry business. We discuss what this move says about large technology trends.

Root Causes 315: Will the SEC Sue SolarWinds Executives? Jul 07, 2023

The SEC has sent "Wells notices" to two senior executives from SolarWinds, with regard to the 2019 supply chain attack. In this episode we explain these notices and their implication.

Root Causes 314: AI-based Deepfakes in Real Crimes Jul 05, 2023

We have spoken in previous episodes about the potential for deepfakes in real-world crimes. In this episode we discuss a variety of real-world attacks in which deepfakes have played a role. These include fake kidnapping, "sextortion," and a range of spear phishing attacks and social media scams.

Root Causes 313: SSL Revocation Reason Codes Jun 22, 2023

In 2022 Mozilla added a root program requirement that CAs include Reason Codes when revoking public TLS certificates. In this episode we explain the reason codes, along with some explicitly forbidden reason codes, and go into the backstory behind this requirement.

Root Causes 312: You Shouldn't Roll Your Own Crypto Jun 20, 2023

Don't roll your own crypto. In this episode we describe the findings from 2021 research that investigating the root causes of problems in cryptographic systems. The results may surprise you.

Root Causes 311: What Is CCADB? Jun 16, 2023

We describe CCADB, the Common CA Database. We explain the role of CCADB in the WebPKI and how this role is evolving.

Root Causes 310: Another AI Episode Jun 13, 2023

In this episode we continue to explore the capabilities of AI to replicate known people in deep fakes with AI-generated content.

Root Causes 309: What Is Key Attestation for Code Signing? Jun 07, 2023

On June 1, 2023 new rules for delivery of code signing certificates went into effect, requiring the certificate be delivered by secure HSM. In addition to shipping a token by mail, certificates can be electronically delivered to Subscriber-owned hardware that supports key attestation. In this episode we explain key attestation, supporting hardware, and the pros and cons of this method.

Root Causes 308: E-Tugra Root Deprecation Jun 05, 2023

For the second time in under twelve months, a major browser is deprecating a CA's public trust. This time it's E-Tugra. Learn about the concerns raised about this CA, investigation of these concerns, and the ultimate deprecation decision.

Root Causes 307: OT Red Teaming Leads to Malware Attack May 31, 2023

In this episode we describe how tools from operational technology red team exercises are being repurposed for malware attacks.

Root Causes 306: Certificate Transparency Logs and Privacy May 26, 2023

Certificate Transparency (CT) logs do a lot of good for the WebPKI. They also, however, carry with them some privacy concerns. In this episode we explain those concerns.

Root Causes 305: The Fifth Pillar of Certificate Lifecycle Management May 22, 2023

In our episode 143 we introduced the Four Pillars of Certificate Lifecycle Management. Now, two years later, we introduce a fifth pillar of CLM.

Root Causes 304: Your 90-day SSL Certificates Checklist May 18, 2023

90-day maximum term for SSL certificates is coming. In this episode expert guest Henry Lam details his four-point checklist for preparing enterprises for these shorter-lived certificates.

Root Causes 303: A Return to Chrome and the Address Bar May 16, 2023

In our recent episode 300 we discussed Chrome's upcoming removal of the lock icon from its interface. In this follow up, we catch the listener up on Chrome's longstanding program to minimize the URL in its interface, even to the point of contemplating removing the address bar entirely.

Root Causes 302: Intel Secure Boot Private Key Leak May 12, 2023

Resulting from a recent ransomware attack, a private key from Intel has been exposed, affecting more than a hundred OEM components and an unknown number of end user products. We explain what happened and its possible implications.

Root Causes 301: The Difference Between Certificate Automation and CLM May 09, 2023

This podcast frequently discusses the concepts of certificate automation and Certificate Lifecycle Management (CLM). In this episode we discuss how CLM does not always entail automation and vice versa -- along with where this distinction occurs and why it matters.

Root Causes 300: Chrome Eliminates the Lock Icon May 04, 2023

Google Chrome has announced that it will eliminate the lock icon in September. We explain what Google will be doing, its stated rationale, and the pros and cons of this decision.

Root Causes 299: 2023 RSA Recap May 02, 2023

The 2023 RSA Conference just concluded. This week Tim recaps what he saw at the show and how it reflects on security industry trends. Our hosts discuss Zero Trust, PQC, blockchain, artificial intelligence, post-COVID tradeshow behavior, and more.

Root Causes 298: Moving Forward, Together - Promoting Automation Apr 28, 2023

The Google Chrome root store has communicated its plans for promoting automation. In this episode we explain Chrome's public plans for this initiative, which is anchored around ACME.

Root Causes 297: Certificate Expiration Creates Starlink Outage Apr 26, 2023

A recent outage in the Starlink internet service was caused by an unexpected certificate expiration. We discuss this ongoing problem and how 90-day maximum certificate term will exacerbate it.

Root Causes 296: SHOULD We or MUST We? Apr 21, 2023

The CA/Browser Forum guidelines contain many prescribed requirements, with language containing the word SHOULD or MUST. In this episode we explain the specifying power of these two words, why they are used, and what they signal about the intent behind a guideline and how the rules might evolve.

Root Causes 295: Genesis Criminal Marketplace Taken Down Apr 17, 2023

A large, public criminal marketplace for stolen logins and other information was rolled up by law enforcement across seventeen countries. Genesis Marketplace offered not only traditional login credentials but also associated data needed to defeat MFA.

Root Causes 294: Root Causes Honored by Webby Awards Apr 13, 2023

The Root Causes podcast has received a Webby Honoree award. Jason and Tim briefly celebrate and discuss the challenge of operating a niche, homemade podcast while being directly compared to professionally produced podcasts on mainstream topics from media companies. Plus, Tim's new Root Causes t-shirt.

Root Causes 293: What Is Certbot? Apr 10, 2023

Certbot is an important part of the ACME standard. This open source tool makes it easier for many IT administrators to use ACME to automate provisioning and installation of SSL / TLS certificates.

Root Causes 292: Validation Data Reuse for 90-day Certificates Apr 06, 2023

As the industry explores the expected consequences of 90-day maximum term for SSL / TLS certificates, some are wondering if the allowed validation data reuse period stands to go down also. We explain today's data reuse rules and what the evidence indicates will be required for both domain control validation (DCV) and organization information validation.

Root Causes 291: CLM and SIEM Apr 03, 2023

We discuss how Certificate Lifecycle Management (CLM) interacts with Security Incident and Event Management (SIEM). The certificate world is chock full of events such as renewals, revocations, admin logins, and provisioning and removal of employee access. We talk about expected behaviors in the CLM and monitoring them.

Root Causes 290: What Are QGIS and QIIS? Mar 29, 2023

In this episode we define Qualified Government Information Source (QGIS) and Qualified Independent Information Source (QIIS), which are critical to CABF-compliant organization validation. We explain how they fit into validation and the criteria for a reliable information source.

Root Causes 289: What Is a Cryptographic Center of Excellence? Mar 27, 2023

In this episode we dig into an emerging idea, which is the cryptographic center of excellence. We discuss how such a center of excellence would work and the benefits it can bring to an enterprise.

Root Causes 288: ISARA Releases Patents on Hybrid Certificates Mar 22, 2023

In this episode we are joined by Atsushi Yamada, CEO of ISARA. He explains how ISARA has put its patents on hybrid certificates into the public domain and why. We explain the role of hybrid certificates in PQC and ongoing crypto agility.

Root Causes 287: GoDaddy Private Key Breach Mar 20, 2023

In this episode we describe an incident in which a GoDaddy breach exposed customer private keys. We explain the expectations surrounding private key exposure and get into the interesting question of when an incident is or is not part of a large company's CA business.

Root Causes 286: PKI and PQC in New White House Cybersecurity Initiative Mar 16, 2023

A new White House cybersecurity initiative specifically calls out digital identity and post quantum cryptography (PQC) among its focal areas. We discuss what it says and the potential implications.

Root Causes 285: Can ChatGPT Write Malware? Mar 14, 2023

In our ongoing exploration of the security implications of AI, in this episode we examine the suitability of ChatGPT as a malware-writing tool and possible future directions for AI in software creation.

Root Causes 284: 90-day SSL Certificates Are on the Way Mar 10, 2023

The Google Chrome root program recently announced its intention to reduce the maximum term for public SSL certificates to 90 days. In this episode we explain this announcement and its implications and speculate on timing for this reduction.

Root Causes 283: Google Optional OCSP Proposal Clarified Mar 06, 2023

In our episode 281 we reported on Google's proposal for optional OCSP. In this episode we correct some of our earlier reporting in that episode, including the use of CRL and the removal of any revocation requirement for SSL certificates of not more than ten days in term.

Root Causes 282: HSMs and Post Quantum Cryptography Mar 02, 2023

Repeat guest Bruno Couillard of Crypto4A joins us to explain where Hardware Secure Modules (HSMs) fit into the world of PQC. We discuss the issues surrounding how HSMs will work with post quantum algorithms and hybrid certificates and the process (and timelines) for defining how HSMs will incorporate PQC.

Root Causes 281: Google Proposes Optional OCSP Feb 26, 2023

In response to concerns about OCSP and privacy, Google has proposed removing the requirement for OCSP revocation checking for public SSL certificates meeting certain specific conditions. In this episode we go into the details of this proposal.

Root Causes 280: Did an AI Break CRYSTALS-Kyber? Feb 24, 2023

Recent news reports might suggest that an AI-enhanced side attack has defeated the CRYSTALS-Kyber PQC algorithm. In this episode we clarify that Kyber has not been defeated to date and exactly what did occur. We define side channel attack, discuss the broader implications of this attack, and speculate on what would happen if Kyber actually were broken.

Root Causes 279: ChatGPT Watermarking Feb 19, 2023

ChatGPT presents the potential problem of ChatGPT content being used and attributed to another source, such as a professional writer or a student. In this episode we discuss the idea of "watermarking" ChatGPT content, including stenography, randomness, entropy, and how to destroy the watermarks.

Root Causes 278: Microsoft on Certificates and FIDO Feb 17, 2023

Recent public discussion of FIDO and digital certificates reveal details of Microsoft's approach to consumer digital authentication. We discuss secure elements, Windows Hello, and the differences between B2C, B2B, and B2E.

Root Causes 277: Privacy Sandbox Feb 13, 2023

In the latest continuation of the effort to create better protections for consumer privacy while still enabling targeted advertising, Google has announced the Privacy Sandbox. In this episode we describe this latest foray, including concepts like k-anonymity and differential privacy.

Root Causes 276: ChatGPT and Identity Reputation Feb 09, 2023

ChatGPT and similar AI tools are dominating the public's mind these days. In this episode we discuss the potential for people to attempt to use ChatGPT as a source of reputational analysis, KYC, and other information about individuals, companies, and other entities. These activities are potentially subject to both error and deliberate misdirection. In this episode we explain why.

Root Causes 275: No Fly List Stolen Feb 06, 2023

In a recently revealed security breach, an attacker gained a copy of the full 2019 TSA No Fly list, including subject PII. This breach was enabled by failures in digital identity and encryption. Join us in unpacking what happened and the lessons to be learned.

Root Causes 274: New Quantum Readiness Law Feb 03, 2023

The U.S. government has a new law requiring that government agencies create plans for migrating to post-quantum cryptography in response to impending threats from quantum computers. In this episode we are joined by guest Bruno Couillard of Crypto4A to discuss the law and its implications.

Root Causes 273: A Deep Dive on CA Agnostic Jan 30, 2023

The industry is seeing more and more attention spent on the idea of CA agnosticism. As with any buzzy technology term, it can be used to mean a variety of things. Join us as we catalog the various ways a Certificate Lifecycle Management (CLM) system can be "CA agnostic."

Root Causes 272: OCSP's Privacy Problem Jan 27, 2023

Concerns recently have been raised about OCSP real-time certificate checking and its potential to violate privacy. In this episode we unpack these concerns and discuss the alternatives to OCSP.

Root Causes 271: A Whole Fleet of Identity-based Automotive Hacks Jan 23, 2023

A white hat security researcher recently revealed a large number of identity-based vulnerabilities across many automotive manufacturers. In this episode we explain how a group of white hats exploited these manufacturers' dependence on non-secret "secrets" such as VIN or email address to force a raft of unacceptable behaviors across a large number of automotive brands.

Root Causes 270: What Is the Difference Between KEM and PKE? Jan 20, 2023

One of the little known changes that has come to the world of TLS is that the secret handshake and key exchange updated from Public Key Exchange (PKE) to Key Encapsulation Methods (KEM). In this episode we explain the difference between the two methods and why this change is taking place.

Root Causes 269: Did a Patent Dispute Nearly Derail Post Quantum Cryptography? Jan 16, 2023

On July 5, 2022 NIST announced its Round 3 PQC winners. What most people don't realize is that same day, the interested parties cleared a patent dispute that had the potential to prevent several of the winning primitives from moving forward. Join us as we explain who held that patent, what the potential impediment was, and how everything was resolved.

Root Causes 268: WAFs Subverted by JSON Bypass Jan 12, 2023

In this episode we discuss rising attacks that overcome the protections of Web Application Firewalls (WAF). We explain these attacks, why this bypass might effective against you even if think it doesn't, and what you should do to ensure you're safe.

Root Causes 267: Can Quantum Computers Break RSA Today? Jan 09, 2023

Much has been made of Schor's algorithm and the inevitable defeat of RSA using quantum computers. But a new research paper suggests a quantum computer may be applied to the problem in a fundamentally different way, hastening RSA's demise beyond even our current expected timelines. In this episode we discuss this new research, reactions to it, and its potential implications.

Root Causes 266: End-to-end Encryption in the Apple Technology Stack Jan 04, 2023

Recent announcements from Apple lay out a set of expansions in the scope and capability of encryption throughout the Apple ecosystem. In this episode we detail the announced changes and some of their implications.

Root Causes 265: A Banner Year for Post-quantum Cryptography Dec 28, 2022

2022 was post-quantum cryptography's biggest year so far. Our hosts are joined by guest Bruno Couillard, CEO and CTO of Crypto4A. We go over many developments in PQC, including the announcement of the NIST round 3 winners, the defeat of several late candidate algorithms, isogeny-based cryptography, hybrid certificates, and the significance of April 14, 2030.

Root Causes 264: Crypto Agility for 2023 Dec 23, 2022

We define the important needs and initiatives that are changing the crypto agility landscape. We discuss topics including CA independence, cryptography in public clouds, post-quantum cryptography (PQC) agility, hybrid certificates, and FIDO 2/WebAuthn.

Root Causes 263: Secure Connection Methods Roundup Dec 20, 2022

In this episode we discuss the three methods a user might choose for secure remote communications: VPN, SSH, and TOR. For each we discuss the reasons you might choose them and the pros and cons of each.

Root Causes 262: The Continuing Erosion of Online Identity Dec 14, 2022

In one of our 2022 wrap up episodes, we look back at the continued erosion of the idea of reliable online identity throughout the year. We discuss the rise of deep fakes, celebrity phishing, voice biometrics, AI-generated art, trust models, and the failure of Twitter blue check marks.

Root Causes 261: Why I Don't Say Spoof Dec 12, 2022

The word spoof is a security industry term used in the context of social engineering attacks. In this episode we explore the word's connotations in different walks of life and why its connotations may not serve us well when applied to security concerns.

Root Causes 260: CA TrustCor Deprecated Dec 08, 2022

Public CA TrustCor has had its roots deprecated by Microsoft and Mozilla, following a public dialog about TrustCor's suitability as a public CA. This entire investigation was prompted by a Washington Post article articulating a series of connections between this CA and spyware purveyors. In this episode we explain these connections, the public dialog and investigation that occurred, and the ultimate deprecation of TrustCor.

Root Causes 259: What Went Wrong with the Twitter Blue Check Marks Nov 30, 2022

The Twitter authenticated identity blue check marks made a big splash and then quickly went away. In this episode we explore the intent of these check marks and why they failed. In particular, we detail the challenges involved in authenticating and vouching for the identity of an individual or organization.

Root Causes 258: New S/MIME Baseline Requirements Ratified Nov 21, 2022

The CA/Browser Forum has passed new Baseline Requirements for S/MIME certificates, in effect late 2023. In this episode we explain the broad stipulations of the new S/MIME BRs, including the multiple available levels of authentication and use case profiles that will be allowed.

Root Causes 257: FTX Crypto Exchange Collapses Nov 17, 2022

"If you don't hold the keys, you don't hold the cheese." Crypto exchange giant FTX recently collapsed, causing ripples through the cryptocurrency world. In this episode we focus on the cryptographic difference between cryptocurrency exchanges and other exchanges and how specific FTX user experience decisions led to the loss of valuable digital assets for investors.

Root Causes 256: What Is Harvest and Decrypt? Nov 16, 2022

As we prepare for the reality of quantum computers breaking RSA and ECC, a keenly important concept to understand is "Harvest and Decrypt." The practical impact of Harvest and Decrypt is that for secrets with a reasonable lifespan, the quantum computer threat is much closer than you might think, including as early as today. In this episode we explain why that's the case and how this attack is likely to roll out.

Root Causes 255: What Is a Privacy Browser? Nov 11, 2022

In this episode we describe privacy browsers, which quite simply are browsers designed to pay special attention to the user's privacy, including some of the strategies they use to protect privacy and the pros and cons of this approach.

Root Causes 254: Toyota Symmetric Key Exposed on GitHub Nov 08, 2022

In a recently exposed error, key material for a popular automobile manufacturer's PKI has been discovered on GitHub, resulting in exposure of sensitive information. In this episode we explain the dual errors that led to this breach.

Root Causes 253: OpenSSL Vulnerability Explained Nov 04, 2022

Last week the OpenSSL project announced an upcoming critical patch, leading to a great deal of speculation about this flaw and its implications for SSL certificates. We explain what the flaw was, what you should do, and why it is that certificates are unaffected.

Root Causes 252: Sidestepping Microsoft Email Encryption Oct 30, 2022

A recently revealed vulnerability in Microsoft Exchange encryption can be used potentially to break the encryption on stored emails. In this episode we explain ECB (Electronic Code Book encryption and how this attack can occur.

Root Causes 251: What's Next for the NIST PQC Primitives? Oct 27, 2022

NIST has announced its new post-quantum cryptography primitives. So now what? In this episode we discuss the next steps required by the technology industry for widespread adoption of these algorithms and what the enterprise can do starting today to ready itself for quantum-safe encryption.

Root Causes 250: 250 Episodes of Root Causes! Oct 26, 2022

It's Root Causes episode 250! In this episode Tim and Jason indulge themselves in podcasting about podcasting. Hear about setting up a podcast, choosing topics, why we don't rehearse, why we have so few guests, and how we reacted the first time someone asked us for a media kit.

Root Causes 249: What Is MFA Exhaustion? Oct 21, 2022

Recent months have seen several high profile attacks that were enabled by defeating the MFA accompanying user name and password login. In this episode we explain the concept of MFA fatigue and why it is an enabler for these attacks.

Root Causes 248: Azure Code Signing Announced Oct 18, 2022

Microsoft has announced the upcoming availability of a Microsoft-run code signing solution inside the Azure platform. We explain this approach's advantages and what to expect from it.

Root Causes 247: Uber Breach Unpacked Oct 13, 2022

A recent high-profile breach of Uber's systems led to widespread data loss. Join our experts as we unpack the specifics of how this attack came about.

Root Causes 246: Google Chrome Root Program Announced Oct 03, 2022

Google Chrome recently announced the formation of its trusted root program. It may be surprising to learn that the world's most popular browser has existed for more than a decade without its own root program. In this episode we explain why that is the case, why Chrome is launching a root program now, and the implications of this announcement.

Root Causes 245: One Time Passcode as a Liability Sep 29, 2022

A recent article from Brian Krebs advances the idea that using OTP MFA may actually be a liability to security. In this episode we explain the reasoning behind this characterization.

Root Causes 244: PwC Survey Reports Cyber Security as Biggest Risk to Companies Sep 26, 2022

A recent survey from PwC reports that cyber threats are no longer solely the domain on the CISO but instead have become every senior executive's concern. We dive deep into these survey results and talk about they correlate with our own experiences, IT skills gaps, and feeding the podcasting beast.

Root Causes 243: Which Came First, the BRs or the EVGs? Sep 20, 2022

Many people don't realize that the CA/Browser Forum's Baseline Requirements actually came LATER THAN the Extended Validation Guidelines. In this episode we explain how this seemly backward turn of events came about and what it says about how online trust has evolved over the past few decades.

Root Causes 242: Let's Encrypt Founder Peter Eckersley Passes Sep 16, 2022

Electronic Frontier Foundation member and Let's Encrypt co-founder Peter Eckersley passed away recently at a young age. In this episode we pay respect to Peter's memory and his many contributions, including ACME, Certbot, and Let's Encrypt.

Root Causes 241: Is China Outspending the West in Quantum Computing? Sep 12, 2022

A December 2021 report appears to indicate that China as vastly outspending Western countries in quantum computing. In this episode we examine this claim, including the role of private industry as opposed to government funding, the importance of international cooperation, and the vast implications of winning the race for quantum computing.

Root Causes 240: Hyundai Production Private Key Found in How-to Manual Sep 06, 2022

A white hat researcher recently defeated a production automobile's PKI by searching for the private key on Google. Join us as we describe the implementation error making this possible and how it might have come about.

Root Causes 239: Post-quantum Cryptography Candidate SIKE Defeated Aug 28, 2022

NIST's round four post-quantum crypto candidate SIKE (Supersingular Isogeny Key Encapsulation) has been defeated and is now out of consideration. In this episode we explain isogeny cryptography, why NIST is seeking additional candidates, and why failures of this kind are expected and healthy for PQC.

Root Causes 238: Tim's Big Phishing Adventure Aug 15, 2022

In a personally unprecedented occurrence, Tim's identity as a Sectigo executive is being used in a "waterholing" phishing scam intended to raid job seekers' bank accounts. We describe what is going on, how we found out, and the challenges in combatting such an attack.

Root Causes 237: Why Mozilla Is So Important to CAs Aug 10, 2022

Mozilla is a highly important to the world of public certificates, with influence beyond what the Firefox browser market share would suggest. In this episode we examine the historical reasons for this influence and the mechanisms that maintain that influence today.

Root Causes 236: Active Directory Patch Knocks Out Non-MS Identity Consumers Aug 04, 2022

A recently revealed vulnerability in Active Directory made it possible for an attacker to escalate privileges inappropriately. Microsoft's responded with a patch in May 2022, which unfortunately has forced a difficult workaround for many common software components beyond Active Directory that will otherwise be incapable of working with AD identities. In this episode we explain what his happening, how it came about, and the broader lessons for PKI owners.

Root Causes 235: What Is Lattice-based Cryptography? Jul 26, 2022

The recent winners of the NIST post-quantum cryptography contest are strongly focused on lattice-based encryption. In this episode we explain at a high level what this cryptographic approach entails and why lattice-based algorithms fared so well in the NIST search.

Root Causes 234: Report from the 2022 RSA Conference Jul 22, 2022

The RSA Security Conference is back. In this episode we talk about what happened in 2020 and how the first post-COVID RSAC compared to earlier years, along with some of the major themes this year.

Root Causes 233: CISA Recommendations for Post-Quantum Crypto Jul 12, 2022

In coordination with NIST's announcement of its new post-quantum cryptographic algorithm contest winners, the Cybersecurity and Infrastructure Security Agency released a bulletin listing six key actions for IT to commence now. We read out these six actions and put them in context.

Root Causes 232: NIST Announces Post Quantum Crypto Selections Jul 08, 2022

NIST has announced its winning algorithms for round 3 of its post-quantum cryptography "contest." Join us as we name the winning algorithms and why they were chosen. We discuss the continuing effort to arrive at additional algorithms, and we talk about the next steps coming out of this announcement.

Root Causes 231: What Is FIDO? Jul 06, 2022

Recent announcements about consumer passwordless authentication build on standards like FIDO and WebAuthn. In this episode we explain device-centric authentication, the FIDO Alliance, and how it all works.

Root Causes 230: What Is Apple Passkey? Jun 30, 2022

Apple recently announced its Passkey functionality, which will allow passwordless authentication between Apple devices and supporting web services through key exchange. In this episode we discuss how this works, the user experience, the significance of FIDO and WebAuthn, and implications for consumer-facing sites.

Root Causes 229: Browsing Collectives and the 80/20 Rule of Browser Privacy Jun 08, 2022

In this follow-on to our two previous podcasts, we elucidate additional potential schemes for preserving consumer privacy. We discuss data aggregation, the power of the default, decentralized blockchain identities, the death of cookies, browsing collectives, privacy browsers, and the 80/20 rule of browser entropy.

Root Causes 228: Getting the FLoC out of Here May 31, 2022

In a follow-up to our recent episode on cookies and browser tracking, we discuss Google's Federated Learning of Cohorts (FLoC) initiative, why it failed as a response, and other directions the industry is looking in.

Root Causes 227: Let's Talk About Cookies May 27, 2022

In this episode we explain the fundamentals of cookies and why, despite their obvious benefits, they present troublesome privacy concerns. We discuss the many ways web users can be tracked including cross-site cookies, tracking pixels, and browser fingerprinting.

Root Causes 226: The Six Benefits of SSH Certificates May 24, 2022

In this third episode in our series on SSH keys, we identify the six main benefits of SSH certificates and how they mitigate the problems with SSH identified in earlier episodes.

Root Causes 225: The Difference Between Relying Parties and Certificate Consumers May 19, 2022

Despite the similarity in their names, in the world of digital certificates a Relying Party and a Certificate Consumer are very different things. In this episode we define the four main roles in the public trust ecosystem: CA, Subscriber, Certificate Consumer, and Relying Party, with real-world examples.

Root Causes 224: The Five Problems with SSH Keys May 17, 2022

In this follow-on to our earlier episode explaining SSH keys, we discuss the five problems SSH keys present to organizations using them. And we give a peek at how to solve these problems.

Root Causes 223: CT Log-Enabled Attacks on WordPress Sites May 11, 2022

Attackers are using CT logs to identify brand new WordPress sites and install malware before upcoming security measures are in place. This attack is novel in how it exploits Certificate Transparency information to identify likely targets. In this episode we explain what is happening and why it's noteworthy.

Root Causes 222: Consolidation and PKI Solutions May 11, 2022

Vendor consolidation is an important topic in IT security. As the scope and variety of threats continues to increase, we have seen a proliferation of point solutions and features, and a resulting desire to reduce that vendor footprint or at least facilitate using them together. In this episode we discuss this trend and how it specifically affects PKI and digital certificates.

Root Causes 221: What Are SSH Keys? May 04, 2022

SSH (Secure Shell) keys are ubiquitous for authenticated access to Linux systems. In this first of three episodes we explain what these keys are and how they're used.

Root Causes 220: The Difference Between OTP and Passwordless May 02, 2022

"Passwordless" is a hot term in the industry, and as a result many technology vendors are attaching their solutions to this term. In this episode we clarify the difference between OTP services and passwordless authentication.

Root Causes 219: New Quantum Cryptography Legislation Introduced Apr 26, 2022

New proposed legislation in the US House of Representatives mandates that federal agencies must begin preparation for using the new quantum resistant cryptographic algorithms selected by NIST. This represents a major development in building a quantum safe digital world. In this episode we explain the proposed legislation and it's consequences.

Root Causes 218: PKI Nomenclature Oddities Apr 20, 2022

Every technology space has its jargon. In this episode we go over some of the interesting, ambiguous, or amusing terms that are specific to the PKI and digital certificates industry.

Root Causes 217: What's the Deal with the Recent Okta Security Breach? Apr 14, 2022

In March the LAPSIS$ hacking group convincingly announced a breach of Okta systems, potentially exposing Okta customers to additional compromise. Despite Okta's initial statements to the contrary, it ultimately turned out that up to 366 Okta customers may be affected. Our hosts walk through the events of the attack, how it unfolded over time, and how this breach was revealed.

Root Causes 216: What Is crt.sh? Apr 10, 2022

One of the foundational tools for monitoring and understanding public SSL certificates is crt.sh, created and maintained by Sectigo's own Rob Stradling. In this episode our hosts explain what crt.sh does and why it is so popular among SSL industry watchers.

Root Causes 215: Passwordless Authentication and Legacy Systems Apr 08, 2022

Organizations seeking to use passwordless authentication frequently must deal with legacy systems that cannot support this scheme. In this episode we explain why that occurs and detail the steps organizations can take to mitigate the effect of legacy systems.

Root Causes 214: New DUO MFA Flaw Explained Apr 05, 2022

A recent FBI warning cautions organizations about exploits based on misconfigured DUO MFA, which exploits weaknesses in Active Directory to provision credentials on DUO for malicious parties. This is an unusual story in several ways, including the fact that the exploit is based on a configuration error and that it's specific to a single, popular SaaS offering. Our hosts explain this exploit and why it is noteworthy.

Root Causes 213: 600-domain Phishing Attack Mar 28, 2022

In this episode we describe a recent phishing campaign noteworthy for its scale, encompassing a total of 600 unique domains. We discuss the implications of a campaign of this scale and high level of organization.

Root Causes 212: S/MIME Limited to Three Years Mar 28, 2022

On April 1 new root program requirements from Apple for S/MIME certificates go into effect, including a limitation of the allowable term to three years. This is contrary to Apple's stated intentions last year. In this episode the explain this change in policy and what certificate users can expect for the future.

Root Causes 211: Does CLM Make Wildcard and MDC Irrelevant? Mar 12, 2022

Wildcard and multi-domain certificates have traditionally made administration easier for IT departments. In this episode we weigh the degree to which Certificate Lifecycle Management (CLM) renders these benefits obsolete and if these certificate types continue to be worth the increased risk they carry.

Root Causes 210: Living off the Land Mar 07, 2022

Microsoft has deprecated support for the popular sysadmin tool WMIC. Join our hosts as they explain the security reasons behind this development and broader lessons we can learn.

Root Causes 209: One-Day Deployment of Certificate Lifecycle Management (CLM) Platforms Feb 28, 2022

For any Certificate Lifecycle Management platform to succeed, effective deployment is essential. Our hosts are joined by Sectigo SVP of Global Sales Jennifer Binet who describes the optimal onboarding process, step by step. Jennifer discusses adding use cases over time, streamlining the contracting process, and getting to full automation for all certificates.

Root Causes 208: Automotive Information Systems Bricked by HD Radio Error Feb 24, 2022

A major automobile manufacturer recently had a problem where its infotainment systems were permanently "bricked" by a flaw in local HD radio broadcasts. Our hosts describe what happened and explore the lessons we can learn from this incident.

Root Causes 207: Former Gartner Analyst David Mahdi Jumps on the Playing Field Feb 21, 2022

Gartner analyst David Mahdi recently left the analyst space for Sectigo. In this episode he joins our hosts to explain the reasons for his optimism about digital trust, including NFTs, Web3, blockchain, PKI, and Zero Trust.

Root Causes 206: What Is Web3? Feb 13, 2022

Web3 refers to the concept that online content can be attributed to specific known publishers, regardless of web site or online channel. In this episode we discuss the fundamentals of Web3, including self-signing protocols, authorization of content, blockchain, definitive authorship, consensus algorithms, and meat from space.

Root Causes 205: Anatomy of an Encrypted Peer-to-Peer Mesh Network Feb 09, 2022

Secure online collaboration poses logistical and technical challenges under the best of circumstances. Now imagine you have no designated IT staff, no designated hardware, a small budget, and remote participants who are not deeply technical. In this episode Jason Soroko explains how he was able to quickly and easily create an encrypted communications mesh for use by him and his collaboration team.

Root Causes 204: PKI's Role in Passwordless Feb 02, 2022

In previous episodes we have defined passwordless identity authentication. In this episode our hosts explain PKI's specific role in passwordless authentication, along the way clarifying the difference between password-masking and true passwordless technologies.

Root Causes 203: What Is a Credential Vault? Jan 31, 2022

Credential vaults are necessary for secure and functional secrets management for automated systems like DevOps or Robotic Process Automation (RPA). This episode explains how credential vaults work and details their benefits.

Root Causes 202 : What Is Certificate Transparency? Jan 27, 2022

Certificate Transparency (CT) is essential to monitoring the public SSL certificates that are issued. In this episode we explain what CT logs are, how they work, and the uses we can put them to.

Root Causes 201: What Are the Baseline Requirements? Jan 24, 2022

The CA/Browser Forum Baseline Requirements (BR) are hugely influential in the world of public-trust certificates. In this episode we explain what the Baseline Requirements are, how they are created, and why they matter.

Root Causes 200: Why Not to Copy and Paste Commands from Web Pages Jan 19, 2022

This episode describes newly revealed vulnerabilities where copying and pasting text from a web page can open the site visitor up to attack. Our hosts explain how this attack can occur and its potential consequences, along with how to defend yourself against this threat.

Root Causes 199: What Is Privileged Access Management? Jan 13, 2022

In this episode we explain Privileged Access Management (PAM). We go on to explain some of the ways that networks using these techniques are still vulnerable to attack and what to do about it.

Root Causes 198: Deep Voice Fakes Jan 11, 2022

We are all familiar with phishing in its various forms. Many people feel that they can protect themselves from fraud by verbally confirming apparent commands from senior executes. In this episode our hosts explore deep voice fakes, computer generated audio that successfully passes for the voice of a known associate, and the risks they pose.

Root Causes 197: Tim's Digital Haircut Jan 07, 2022

In this episode our hosts describe the extreme degree to which all business has become digital business, even the most offline businesses you can think of, including food delivery, in-restaurant dining, bricks-and-mortar retail, and naturally, haircuts. We discuss the disparate, interconnected systems required to make this happen and the fragility of this new digital world.

Root Causes 196: What Is Certificate Agnostic? Jan 03, 2022

In 2021 the certificate industry saw the emergency of the concept of "CA agnostic." However, that is only part of the story. In this episode our hosts build on this concept to define the idea of certificate automation platforms being "certificate agnostic," meaning these platforms should handle all certificates regardless of type, configuration, physical location, environment, use case, and origin.

Root Causes 195: iOS App Privacy Audits Dec 27, 2021

The latest update of iOS includes new capabilities for app privacy auditing and permissions. Our hosts explain the controls available on iOS and Android and how a mobile device privacy audit can be beneficial.

Root Causes 194: Crypto Versus Cryptocurrency Dec 20, 2021

Exploding interest in cryptocurrency has caused the word crypto to take on new meanings that were not part of the public dialog even a few years ago. In this episode our hosts explore both the overlap and difference between today's cryptocurrency (and blockchain) and more venerable forms of cryptography.

Root Causes 193: 4 Positive Security Trends for 2022 Dec 16, 2021

Our hosts look back at four positive security trends in 2021 that industry should continue in 2022.

Root Causes 192: 14 Security Fallacies We Still Have in 2021 Dec 13, 2021

In this year-end lookback episode, our hosts describe 14 common fallacies that still haunt IT professionals in 2021 - and the negative effects those fallacies bring.

Root Causes 191: What Is Robotic Process Automation (RPA)? Dec 08, 2021

An important trend sweeping enterprise IT is Robotic Process Automation. Our hosts define RPA and explain the importance of cryptographically secured digital identity in safely implementing RPA.

Root Causes 190: Phishing Coinbase Nov 29, 2021

In continuation of our ongoing exploration of blockchain and cryptocurrency, our hosts describe a recently discovered exploit where attackers use weaknesses in one-time-password-based MFA to steal Coinbase accounts.

Root Causes 189: What Is CA Agnostic? Nov 17, 2021

Certificate Lifecycle Management (CLM) platforms can deal with certificates from a number of sources. A CLM that can provision certificates of all types from all CAs, private and public, would be described as "CA agnostic." In this episode we explain this idea and its significance along with the key criteria for choosing a CA agnostic CLM platform.

Root Causes 188: Introduction to Web Security Nov 11, 2021

Malware and other web site attacks are a frequent problem for small businesses and can result in reputational damage and site access being blocked or hindered by end user software and services. We are joined by web site protection expert JP Armenta, who explains how these attacks occur, their effects, and how site operators can protect themselves.

Root Causes 187: Apple Limits Term for S/MIME Certificates Nov 07, 2021

Apple recently announced that it would be limiting the allowable term for public S/MIME certificates to 825 days. Our hosts explain the implications of this declaration.

Root Causes 186: Digital Signature SNAFU Costs Swiss Company 3 Billion Euro Contract Nov 04, 2021

In this episode our hosts explain how an esoteric digital signature error rendered a 3 billion Euro manufacturing contract with the Austrian government invalid.

Root Causes 185: EU Covid Passport Root Key Stolen Nov 01, 2021

The root certificates of the EU's Covid Passport program have suffered a private key compromise and counterfeit passports are now for sale on the black market. We explain the implications of this shocking revelation.

Root Causes 184: Popular College WiFi Vulnerability Revealed Oct 26, 2021

Recent research reveals that certificate misconfiguration in a commonly used college WiFi platform that can lead to exposure and theft of users' login credentials. Our hosts discuss WiFi authentication and the EAP protocol and explain how this vulnerability occurs.

Root Causes 183: New MSCA Attack Toolkits Oct 21, 2021

At this year's BlackHat, a talk and white paper detailed the threat of MSCA root key attacks, which can be used to create unauthorized certificates. This release includes a pair of offensive toolkits and a defensive toolkit. We explain the importance of this release and provide a clear action list for IT professionals in charge of Microsoft CA.

Root Causes 182: Let's Encrypt Root Expiration Oct 18, 2021

Let's Encrypt's recent root expiration caused widespread service outages and other hassles for online services and sites. Our hosts discuss this expiration, why so many problems resulted, and the recipe for avoiding these problems in the future.

Root Causes 181: Limitation of DCV Through Web Site Changes Aug 29, 2021

This December will see a meaningful change in how CAs are allowed to conduct Domain Control Validation (DCV) using the method known as https token or file authentication or agreed up on change to web site. This method will be removed as an option for "domain spaces" including wildcards and subdomains. Join our hosts as they explain how DCV works and how the rules are changing and why. And we clarify the available options for those changing their preferred DCV methods.

Root Causes 180: PetitPotam MSCA Attack Aug 26, 2021

The PetitPotam attack against Microsoft CA has garnered a lot of attention. Our hosts describe this attack and define related terms like Mimikatz, pass-the-hash, and NTLM Relay. The episode goes on to give a roadmap for mitigating this attack , including free resources available to help defend against PetitPotam.

Root Causes 179: Standards for Certificates Apart from SSL Aug 23, 2021

Regular followers of this podcast hear a great deal about SSL, the CA/Browser Forum, and the standards governing public SSL. But SSL is not the only regulated type of public digital certificate. There are also things like S/MIME, eIDAS, code signing, document signing, and SSH certificates. In this episode our hosts discuss these "other" certificate types and the rules and regulations governing them.

Root Causes 178: Stealing Cryptocurrency Aug 20, 2021

In this episode our hosts go through the various ways in which cryptocurrency can be stolen or lost, including private key compromise, security failures at cryptocurrency brokers, and theft of login credentials. Our hosts also discuss how manipulation of the public ledger could also lead to unfair distribution of cryptocurrency value.

Root Causes 177: What Is Passwordless? Aug 09, 2021

A hot, new topic in the identity space is passwordless. Join our hosts as they explain credential form factors and offer a specific definition of passwordless, including the difference between PINs and passwords.

Root Causes 176: Introducing State-Locality Exclusivity Aug 05, 2021

Sectigo is implementing an important change to its public-facing SSL certificate business, which we call State-Locality Exclusivity. This change removes a the localityName field, a very common field in SSL certificates. In this episode our hosts explain what the localityName field is, why we are removing it, and how this change is to the benefit of SSL Subscribers and Relying Parties.

Root Causes 175: What Is a Linter? Aug 02, 2021

Linters have been a standard programming tool for more than four decades. This venerable coding tool has recently taken on new significant in the world of public certificates. In this episode our hosts explain linters and how they are applied to SSL certificates.

Root Causes 174: Windows 11 and TPMs Jul 27, 2021

Microsoft has announced that its upcoming Windows 11 release will require TPM 2.0 support at a minimum. TPM 2.0 enables more modern hashing and encryption algorithms than previous versions. Our hosts discuss the implications of this announcement.

Root Causes 173: Whitelisting and Blocklisting Jul 22, 2021

Whitelisting and blocklisting are tried and true elements of the computer industry. In this episode our hosts define whitelisting and blocklisting and the pros and cons of either, with lots of examples from the real world. We discuss fuzzy entities, the scaling problem, layered defenses, and the trouble with active attackers.

Root Causes 172: What Is an NFT? Jul 13, 2021

If you have paid any attention at all to popular media in the past few months, you will have heard about non-fungible tokens, or NFTs. NFTs are a method of uniquely identifying a digital asset using blockchain technology, and they are big news in the art and media world. Join our hosts as they explain the difference between fungible and non-fungible tokens, how NFTs work, and the significance of publicly asserting ownership for digital files.

Root Causes 171: The Off-by-One-Second Problem Jul 08, 2021

Today our hosts explore an esoteric but important error in public certificates that we call the off-by-one-second problem. We explain this problem, how it occurs, and its broader implications.

Root Causes 170: Why Is Canada So Good at Cryptography? Jul 01, 2021

In celebration of Canada Day, our hosts discuss why Canada in particular offers a disproportionately large contribution to cryptography. We examine historic reasons and the real-world consequences of Canada being a center for cryptographic excellence.

Root Causes 169: Bitcoin and the Anonymity Fallacy Jun 25, 2021

In the developing story of the Colonial pipeline ransomware attack, the FBI recently recovered the ransom money, which had been paid in Bitcoin. In this episode we talk about how this recovery might have occurred.

Root Causes 168: The Difference Between e-Signing and Digital Signing Jun 21, 2021

In our technology discussions we frequently run into confusion about the relationship between electronic document signing and digital document signing. Despite the similarity in names, they are entirely different technological approaches to providing trustworthy electronic signed documents. In this episode we explain the two terms, their distinct definitions, and some of the pros and cons of each approach.

Root Causes 167: Colonial Pipeline Ransomware Attack Jun 15, 2021

The recent ransomware attack against the Colonial pipeline has captured the news cycles in recent weeks. In this first episode of two our hosts begin to unpack what it known about this attack and how digital identity and PKI fit in.

Root Causes 166: The Trouble with OU Fields Jun 07, 2021

Of all aspects of public SSL certificates, few are as controversial as the OU field. Standing for Organizational Unit, this field is beloved by a few enterprises and hated by security watchers. It's also under fire in the CA/Browser Forum. Join our hosts as they explain the history of the OU field and why it's an industry flashpoint, including their predictions for the future of the OU field.

Root Causes 165: Blockchain - Proof of Work Versus Proof of Stake Jun 02, 2021

In our ongoing examination of blockchain, we define proof of work and proof of stake as consensus algorithms for updating the public ledger. We explain their differences and get into the problems with proof of work and the reasons proof of stake is emerging as a promising new consensus algorithm. We touch on the consequences of these algorithms on other aspects of society as well.

Root Causes 164: Examining MFA Through out-of-Band Phone Calling May 20, 2021

In our ongoing series of episodes on MFA, we explore the plusses and minuses of out-of-band phone calling. Our hosts explain how this form of MFA works, what attacks it defends against successfully, and what attacks can circumvent it.

Root Causes 163: What Puts the I in PKI? May 12, 2021

PKI stands for Public Key Infrastructure. In this episode we focus on the word infrastructure. Our hosts discuss the key qualities of credential form factors, how they are separate and distinct from the infrastructure surrounding them, and the minimum capabilities necessary to refer to a public-private key system as PKI.

Root Causes 162: What Is Sideloading? Apr 21, 2021

In a recent interview Tim Cook took a strong stance against application sideloading as a danger to mobile devices. In this episode we explain sideloading, its potential dangers, and the underlying motivators behind the sideloading debate.

Root Causes 161: Consensus Algorithms and the Byzantine Generals Problem Apr 15, 2021

If you pay attention to blockchain and crypto currency, you are sure to hear the phrase consensus algorithm. This concept is fundamental to distributed trust systems like blockchain. In this episode our hosts explain consensus, proof of work, and the Byzantine Generals problem.

Root Causes 160: Purpose-built Quantum Computers for Breaking RSA Apr 08, 2021

A new academic paper has described how a purpose-built quantum computer could break RSA encryption in fewer qbits than commonly are thought necessary possible. In this episode our hosts summarize the basic argument in this highly technical paper and its potential implications on the Quantum Apocalypse.

Root Causes 159: Encrypted Communication Provider Indicted for Drug Trafficking and Money Laundering Mar 31, 2021

The CEO of Sky Global, a provider of encrypted data devices and services, has been indicted on RICO charges related to drug trafficking and money laundering. Our hosts discuss this highly unusual development and where it fits into the ongoing battle between law enforcement and encryption technology.

Root Causes 158: Exchange Server Vulnerabilities Mar 23, 2021

The ongoing Microsoft Exchange vulnerability is huge news in the IT world. In this episode our hosts discuss the reasons why on-premises services might present greater risk than providing the same capabilities in the cloud.

Root Causes 157: New Revocation Research Mar 19, 2021

A recently published study of public revocation information takes a numerical approach to revocation behavior from CAs. Our hosts give their first take on this paper and the idea of "revocation transparency."

Root Causes 156: Kazakhstan Root Attack Revisited Mar 16, 2021

In the summer of 2019 the Kazakh government attempted to force its citizens to trust its private root, enabling MITM attacks for a variety of potentially nefarious purposes. A recent research paper goes into previously unknown detail about who was targeted and how the regime sought to abuse this short-lived exploit.

Root Causes 155: What’s Good for Subscribers Is Good for Relying Parties Mar 11, 2021

In this episode we explore the relationship between Relying Parties (aka users of online services) and Certificate Subscribers (aka providers of these services). We discuss the common attitude that certificate requirements that negatively impact Subscribers are inconsequential. We explain the downstream effects of certificate incidents and why unthinkingly forcing rules on service providers without considering the full consequences is detrimental to everyone.

Root Causes 154: Did Claus Peter Schnorr Just Break RSA? Mar 08, 2021

A recently published paper by a reputable German mathematician and cryptographer has garnered widespread attention for its claim to have destroyed the RSA algorithm. However, many people are skeptical. Join us as we discuss the paper's content, the proposed methodology, and the public discussion it has generated.

Root Causes 153: Too Many Roots Mar 05, 2021

Trust models in multi-vendor environments can be particularly tricky. We are joined once again by Tom Tansy, Chairman of the SunSpec Alliance for a deep dive in the challenges and best practices in maintaining trusted roots in complex, global supply chain ecosystems.

Root Causes 152: Digital Certificates and the SunSpec Alliance Mar 02, 2021

The SunSpec Alliance is an important source of standards for clean energy infrastructure including solar and electric vehicles. To protect our electrical infrastructure and ensure proper functioning, digital identity and certificates are a necessity. Join us and guest Tom Tansy as we discuss how SunSpec employs PKI to this end.

Root Causes 151: What Is Rustls? Feb 22, 2021

Rustls is an important emerging alternative to OpenSSL. In this episode we discuss the Rust programming language and the implications of the fact that is was designed with security in mind from the ground up. This includes how Rustls is protected against attack vectors that have been effective in the past, including Heartbleed. Join us to learn more.

Root Causes 150: This Podcast Is Not About Alan Turing Feb 14, 2021

Recent news of the discovery of abandoned Enigma machines on the ocean floor inspires our hosts to discuss history's most famous code system, how it was broken, and how that relates to cryptography today.

Root Causes 149: Municipal Water Poisoning Through Cyber Attack Feb 11, 2021

In past episodes we have discussed the possibility of cyber attack against civil infrastructure like utilities. That possibility recently became real with the attempted poisoning of a Florida city's water supply through online security breach. Learn more on this episode.

Root Causes 148: Can Australia Force Sites to Pay for Linking to Content? Feb 08, 2021

A proposed law in Australia would require sites linking to news articles to pay for the right to link to these articles. While this law appears to be aimed at Google and Facebook, it has implications that are much bigger than these two news aggregators. Google has upped the ante by offering to cease operations in Australia before doing so. In this episode we discuss this ongoing development and where things go from here.

Root Causes 147: Google Titan Secure Key Attack Feb 05, 2021

Recent research reveals a possible attack that would allow the cloning of the Google Titan secure key. Join our hosts and guest Alan Grau as they describe this attack and its implications for Titan and other secure keys.

Root Causes 146 : Congolese ccTLD Takeover Feb 01, 2021

A white hat researcher recently took over .cd, the Democratic Republic of the Congo's ccTLD. The implications of taking over a top-level TLD are of course staggering. Join our hosts as we describe how this feat was accomplished and the many malicious activities that could occur under such circumstances.

Root Causes 145: Google Chrome to Distrust CA Camerfirma Jan 28, 2021

A few days ago Google announced that Chrome will distrust Spanish public CA Camerfirma in its upcoming build 90. Our hosts go over the history of browsers distrusting public CAs and explain the reasons for (and implications of) this decision.

Root Causes 144: Whatever Happened to the Green Address Bar? Jan 25, 2021

For more than a decade browsers displayed the "green address bar" on sites that had undergone the high authentication required for EV SSL certificates. But in recent years the identity information in the browser has has shrunk, lost its color, and in some cases disappeared entirely. In this episode our hosts walk you through the history of how the green address bar came to be and how browsers gradually reduced and then removed it.

Root Causes 143: The Four Pillars of Certificate Automation Jan 21, 2021

In this episode our hosts explain the Four Pillars of Certificate Automation: deploy, discover, revoke/replace, and renew. They detail what these pillars entail and why they're important. They also discuss the umbrella capability of visibility, which affects all four pillars.

Root Causes 142: Removing Street Address and Postal Code from Public Certificates Jan 18, 2021

On March 1 Sectigo will remove street address and postal/zip code information from its public certificates of all types. Our hosts explain the reasons for and advantages of this upcoming change, along with answers to some of the common questions we receive.

Root Causes 141: The Case for Shorter Certificate Lifespans Jan 11, 2021

Recent years have seen multiple reductions in the maximum term for public SSL certificates. Our hosts are joined by guest Nick France to discuss the benefits of shorter certificate lifespans for both public and private CAs.

Root Causes 140: SSL Attacks Using BGP (Border Gateway Protocol) Jan 06, 2021

BGP, or Border Gateway Protocol, controls traffic routing on the internet. Real and theoretical attacks over the years have been revealed against BGP with varying levels of success, including recent research on how BGP attacks can be used to improperly obtain DV certificates. Our hosts explain them along with recent industry actions intended to thwart such attacks.

Root Causes 139: Exposed Private Keys in CSR Submissions Jan 03, 2021

Public CAs recently have discovered a repeated error whereby certificate subscribers accidentally include the private key along with CSR submissions. Our hosts break down this phenomenon and its implications.

Root Causes 138: IoT Cybersecurity Improvement Act of 2020 Dec 27, 2020

A new US law called the IoT Cybersecurity Improvement Act of 2020 creates security requirements for IoT devices sold into the US government. Join us as we explain these new requirements and why this law's reach is likely to extend further than the US governmental procurement process.

Root Causes 137: SolarWinds Supply Chain Attack and Digital Identity Dec 21, 2020

The SolarWinds Orion supply chain attack is making headlines throughout the tech press. This sophisticated attack includes some unusual manipulations of digital identity and certificates. In this episode we explain how certificates, keys, and identity play into the SolarWinds exploit.

Root Causes 136: 2020 Lookback - Quantum Safe Certificates Dec 17, 2020

In the third of our year-end lookback episodes, we discuss 2020's progress in the quest for quantum-safe encryption. This includes narrowing the NIST candidate list down to fifteen algorithms, the availability of test hybrid certificates, and the trouble with long-lived IoT devices. Our hosts predict what 2021 will look like for quantum-safe certificates.

Root Causes 135: The Heartbleed Vulnerability Dec 14, 2020

In April 2014 a software vulnerability called Heartbleed was discovered in OpenSSL. Heartbleed made it possible for attackers to send commands to web servers and steal their private keys. Certificate subscribers around the world had to scramble to patch their servers and replace certificates by the millions. Guest Nick France joins us to explain this vulnerability, its consequences, and whether or not a Heartbleed-like vulnerability could occur today.

Root Causes 134: 2020 Lookback - SASE and Zero Trust Architecture Dec 09, 2020

2020 was a big year for SASE (Secure Access Service Edge). Our hosts define SASE, ZTNA (Zero Trust Network Architecture), and SDP (Software Defined Perimeter). Our hosts discuss how these technology principles gained momentum in 2020 and why they are poised for continued growth in 2021.

Root Causes 133: 2020 Lookback - COVID-19 Dec 07, 2020

In 2020 the COVID-19 pandemic changed the way we work. IT departments had to gear up for near-ubiquitous work-from-home (WFH) requirements while maintaining productivity and security. Our hosts talk about the pandemic's affect on employee authentication and access, Zero Trust, IT enablement of retail, immunity passports, and more.

Root Causes 132: Examining MFA Through Soft Tokens Dec 04, 2020

In our ongoing examination of MFA, our hosts examine authentication through soft-token OTP (one-time passcode). They go over the potential benefits and pitfalls of soft tokens, and compare them to SMS tokens and hard tokens.

Root Causes 131: Apple OCSP Slowdown Explained Nov 29, 2020

The recent release of Apple's Big Sur OS appears to have driven a temporary slowdown in the company's OCSP responders, affecting code updates across all Apple operating systems. Guest Nick France joins us to explain what appears to have happened and why.

Root Causes 130: How to Get Rid of Password Breaches Nov 24, 2020

Massive password breeches have been so repeatedly prevalent for so many years that as an industry and a society we've just started to accept them as a fact of life. In this episode we discuss the weaknesses of passwords as a strategy and why they nonetheless are so common even today. We describe the roadmap for eventually weeding out passwords from most systems.

Root Causes 129: Examining MFA Through Hard Tokens Nov 19, 2020

Hard tokens are one of the oldest multi-factor authentication (MFA) form factors there is, and still in use today. In the latest in our series of explorations of MFA strategies, we examine the strengths and weaknesses of hard tokens as an MFA strategy.

Root Causes 128: What Is Total Certificate Agility? Nov 12, 2020

First we had crypto agility, which is how we ensure our cryptography stays current with the needs of security. Expanding on this concept, industry leaders are now looking at certificate agility, which is building our systems so that all certificates are known, current, and immediately replaceable. Our hosts explain certificate agility, why it's important, and what you need to do to achieve it.

Root Causes 127: What Does a Chief Compliance Officer at a Public CA Do? Nov 05, 2020

Our co-host Tim Callan has changed his title to Chief Compliance Officer. Join him and co-host Jason Soroko as they discuss what compliance means at a public Certificate Authority (CA) like Sectigo and what the Chief Compliance Officer does.

Root Causes 126: IoT Ransomware Oct 28, 2020

New research shows how ransomware attacks could be launched against IoT devices. Our hosts are joined by Alan Grau to understand these attacks and what can be done to defend against them, including technical controls such as strong identity and embedded firewalls.

Root Causes 125: Digital Identity Versus IAM Oct 08, 2020

Digital certificates and PKI provide digital identity and access. Identity and Access Management (IAM) is a huge technology category featuring major players like Okta, DUO, and Ping Identity. And despite the fact that they feature a lot of the same words in their descriptions, these two categories are entirely different spaces that do entirely different things. In this episode we explain the difference between digital identity certificates and IAM platforms and how they fit in together.

Root Causes 124: Biometric MFA Oct 05, 2020

As part of our ongoing series on the pros and cons of various forms of multi-factor authentication (MFA) in this episode we explore biometrics. Our hosts discuss their strengths and weaknesses and the idea that biometrics are more about proof of possession than identity authentication.

Root Causes 123: Asymmetric Versus Symmetric Encryption Oct 01, 2020

One of the cornerstones of the success of PKI and digital certificates is their dependence on an asymmetric encryption model. In this episode our hosts explain the difference between asymmetric and symmetric secrets and how they fit into encryption.

Root Causes 122: Passwordless Authentication for Apple OS Sep 28, 2020

Our hosts are joined by Joel Rennich of Jamf to talk about passwordless authentication and access for various Apple platforms. Joel explains the variety of user experiences that can qualify as passwordless access, with an eye to the specific needs and opportunities for Apple devices.

Root Causes 121 : What Is a Hardware Security Module? Sep 21, 2020

A Hardware Security Module, or HSM, is a piece of hardware that securely stores secret material such as cryptographic keys. Join our hosts as they explain terms like HSM, Trusted Platform Module (TPM), Secure Enclave, TrustZone, and Hardware Secure Element (SE).

Root Causes 120: PKI and SASE Sep 18, 2020

SASE (Secure Access Service Edge) is a new term to describe the complexity of authenticating access across today's diverse and heterogeneous computing environments. Join our hosts as they discuss the role of digital identity and certificates in this paradigm.

Root Causes 119: What Is Crypto Agility? Sep 14, 2020

Security industry insiders sometimes use the phrase "crypto agility." In this episode our hosts define crypto agility - or cryptographic agility. They explain why crypto agility is more important than ever, why the pace of cryptographic change is going up, and what certificate subscribers can do to improve their crypto agility.

Root Causes 118: Quantum Apocalypse - What Is a Hybrid Certificate? Sep 07, 2020

As part of its quantum safe initiative, Sectigo is now offering its Quantum Safe Kit, which enables the creation of hybrid TLS certificates. In this episode our hosts are joined by guest Alan Grau to explain what hybrid certificates are, how they are essential to transitioning to quantum-safe crypto, and the ways enterprises can begin using them today.

Root Causes 117: Why Default Deny Matters to the CA/Browser Forum Sep 04, 2020

This year the CA/Browser Forum has put considerable discussion into the concept of "default deny." It's a philosophy for how to interpret potential ambiguities in existing guidelines for public certificates, and how you land on the default-deny question can have a significant impact on how you interpret the rules. Join our hosts as they describe this debate and its potential impact on public certificates.

Root Causes 116: Ripple20 Exposes TCP/IP Vulnerabilities for IoT Aug 30, 2020

Ripple20 is a recently announced set of documented vulnerabilities in the early Treck TCP/IP stack, a popular choice for early IoT devices. Our hosts are joined by guest Alan Grau, who explains the significance of these vulnerabilities, the difficulties in dealing with them, and how we can improve to avoid these problems in the future.

Root Causes 115: Signed HTTP Exchange (SXG) Certificates Aug 27, 2020

Accelerated Mobile Pages, or AMP, is a Google standard for packaging web content for consistent and usable display on mobile devices. SXG certificates enable the display of the original publisher's authenticated URL in the mobile reader. Join us as we explain the potential benefits of SXG to readers and content publishers.

Root Causes 114: Is Quantum Computing a Threat to SHA-2? Aug 21, 2020

Quantum computers' threat to standardized encryption algorithms RSA and ECC has been much discussed. But what about our hashing algorithms? Do quantum computers pose a similar threat to SHA-2? Join our hosts as they discuss the difference between Shor's Algorithms and Grover's Algorithm, which applies to each part of cryptography, and how significant quantum computing will be for each.

Root Causes 113: What Is Certificate Pinning? Aug 18, 2020

Certificate pinning is the practice of coding software to demand the presence of a specific certificate brand or root in order to function correctly. Though once considered a legitimate security option, certificate pinning is widely discredited because it carries unacceptable certificate agility costs. Join our hosts as they explain what certificate pinning is, how it came about, and why nearly all developers should avoid certificate pinning today.

Root Causes 112: Introducing Sectigo Quantum Labs Aug 13, 2020

For more than a year Sectigo has been providing the market with information to understand what we all must do to change our cryptography to prepare for quantum computers. Now Sectigo has announced Sectigo Quantum Labs, a destination for education on quantum-safe certificates (QSC) and our Quantum-Safe Kit, which allows enterprises to create their own hybrid quantum-safe certs. Join us as we articulate what Sectigo Quantum Labs has to offer you.

Root Causes 111: Secure Data Interconnects Aug 10, 2020

Distributed data centers are extremely common in today's computing environments. Unencrypted replication of data across these centers leaves data open to theft. Nonetheless, existing systems and software leave that possibility open, and sometimes data replication occurs in the clear. Our hosts explain how this situation can come about and what to do about it.

Root Causes 110: Single-domain, Multi-domain, and Wildcard SSL Certificates Aug 06, 2020

When you obtain an SSL certificate, you can choose between single-domain, multi-domain, and wildcard certificates. Join our hosts as they explain the different domain spaces available with TLS certificates and the pros and cons of each approach.

Root Causes 109: Examining MFA Through Phone-based SMS Jul 29, 2020

SMS-based one time password (OTP) is a very commonly used form of multi-factor authentication (MFA). That's because it's fast and inexpensive to roll out to users. Unfortunately it is deeply vulnerable to a set of well-defined attacks. In this episode our hosts explain why SMS MFA became so popular and how this outdated MFA scheme fails to provide the security expected by those who use it.

Root Causes 108: Why Do Certificates Expire? Jul 24, 2020

Root expirations occasionally make headlines by breaking systems, but it's a fact that certificates are expiring every day, each a potential outage waiting to happen. So why do certificates expire in the first place? Join our hosts as they discuss the reasons for expiration, its advantages over other mechanisms like revocation, and the right amount of time for a certificate to last.

Root Causes 107: IoT Security Baseline Requirements from ETSI Jul 20, 2020

ETSI has published its new Baseline Requirements for consumer IoT device security, which includes a number of provisions directly related to encryption, strong identity, and device software integrity. Join our hosts as they describe the PKI-related portions of the new ETSI requirements and why they are valuable for security.

Root Causes 106: Massive Intermediate Certificate Distrust Is on the Way Jul 14, 2020

A recently identified and widespread configuration error has created a situation where, with the wrong attack on certain public roots, certificates could become essentially unrevokable. As a consequence, 14 public CAs will have to revoke their OCSP certificates, many of which are also intermediates, and permanently discontinue use of their keys. That leaves millions of active TLS, S/MIME, code signing, and document signing certificates in need of immediate replacement or they will be distrusted. Join our hosts as they explain what the problem is and what messy cleanup will be required to address these problems.

Root Causes 105: TOR, How and Why Jul 08, 2020

Many people know that TOR is a browser used for anonymous online activity, but most of us don't know much more than that. In this episode our hosts explain how the TOR network operates, what its potential value is, and how TOR compares to a VPN.

Root Causes 104: 21 PKI Pitfalls to Avoid Jul 06, 2020

Our hosts often discuss the idea of errors in PKI implementations and the potential negative consequences for organizations. In this episode they categorize twenty-one PKI pitfalls to avoid according to five main categories of error: certificate problems, deployment problems, systemic security problems, governance problems, and visibility problems. Join us for a crisp description of these twenty-one pitfalls so you can be on the lookout for them.

Root Causes 103: Work-from-Home IT Impact Study Jun 29, 2020

The need to suddenly enable nearly 100% of information workers for secure, productive work-from-home was a curve ball for IT departments to deal with around the world. Sectigo recently released the results of a commissioned survey of 500 IT professionals about the impact of widespread WFH requirements on IT departments, roadmaps, security, and employee productivity. In this episode our hosts go over the biggest findings from this study.

Root Causes 102: Lawful Access to Encrypted Data Act Jun 26, 2020

A newly proposed US Senate bill called the Lawful Access to Encrypted Data Act would require service providers and device manufacturers to provide access to encrypted data based on a valid warrant. In this episode our hosts explain the bill's contents and some of the opportunities and pitfalls it presents.

Root Causes 101: Google RCS Chat with End-to-End Encryption Jun 21, 2020

Google has just announced the coming availability of end-to-end encryption for its chat service. In this episode our hosts describe the spectrum of potential protection within the capabilities we call end-to-end encryption, including forward secrecy and durability of keys.

Root Causes 100: OpenSSH Deprecates SHA-1 Jun 15, 2020

Once widely used, SHA-1 is considered insecure today and has been deprecated from the most common PKI use cases. OpenSSH recently provided a roadmap to its eventual deprecation of SHA-1. Join our hosts as they discuss the long, complex process of sunsetting a widely used cryptographic practice, the factors that contribute to these practices continuing beyond their secure lifespans, and the importance of crypto agility.

Root Causes 99: AddTrust Root Expiration Explained Jun 12, 2020

The recent expiration of Sectigo's AddTrust legacy root caused some systems to stop working and forced some admins to keep working over the weekend until all was fixed. In this episode we explain roots, root expirations, why they are a non event for most users, and why sometimes an expiration can be more impactful.

Root Causes 98: DMARC and Verified Mark Certificates for Email Jun 08, 2020

A new kind of identity certificate is coming that will enable businesses to include their logos in official email they send in order to improve customer confidence and protect against phishing. It is called a Verified Mark Certificate (VMC) and is built upon the DMARC standard, which controls which senders are allowed to send email using any given From address. In this episode our hosts explain VMCs and DMARC and how they will be used and then discuss where they fit in with S/MIME email certificates.

Root Causes 97: Firefox to Deprecate Support for FTP Jun 04, 2020

Mozilla has announced its intention to remove support for FTP from the Firefox browser, citing concerns about security and the degree of effort required to keep this functionality current. Join our hosts as they discuss this announcement and its potential effects as well as the considerations that go into choosing when to drop support for outdated, unpopular, or sub-optimal capabilities in technology products.

Root Causes 96: Signal May Leave the USA to Protect Its End-to-End Encryption Jun 01, 2020

Congress's proposed EARN IT act has many industry observers worried about its potential effect on the integrity of encrypted communication. In recent news, secure communication app Signal has floated the idea of relocating outside the United States if that's what's required to retain its ability to offer end-to-end encryption without spying eyes interfering. In this week's episode, we discuss this announcement and related issues surrounding the keeping of digital secrets and encryption.

Root Causes 95: Cryptographic Key Vaulting May 28, 2020

For PKI to be secure, private keys need to remain private. In this episode we explain "vaulting" for keys or other shared secrets. We touch on the vulnerabilities that secrets vaulting fights against and the common use cases for vaulting.

Root Causes 94: Revocation Checking Through OCSP and CRL May 26, 2020

One essential portion of the certificate lifecycle is the ability to revoke certificates. Public SSL certificates use a pair of mechanisms to communicate this revocation status to client machines, CRL and OCSP. In this episode we explain how these mechanisms work and some of their strengths and challenges.

Root Causes 93: Videoconferencing Phishing May 21, 2020

With the global workforce's massive shift to work-from-home, a clever new set of opportunistic social engineering attacks has sprung up to take advantage of our unfamiliarity with our new communication and collaboration applications and processes. In this episode our hosts describe these new attacks and what IT departments can do to combat them.

Root Causes 92: COVID-19 Immunity Passports May 18, 2020

As we plan our societal return to normalcy, a number of people and groups are discussing the concept of an electronic "immunity passport" that individuals can possess if they are known to be immune to COVID-19 (possibly through vaccination or prior infection). Today our hosts discuss the requirements for such an immunity passport, some of the opportunities and challenges in putting this kind of system in place, and how existing schemes and systems may fit into an immunity passport initiative.

Root Causes 91: Rabobank Banking App Outage May 13, 2020

Australia's Rabobank recently experienced an outage preventing its Android banking app from connecting to its servers. The root cause? An expired certificate. In this episode our hosts explain what happened and how it could have been avoided. They also discuss certificate pinning, how it came to be used with apps like this one, and its disadvantages.

Root Causes 90: An Analysis of Distributed PKI May 10, 2020

Distributed PKI is a new approach, with advocates saying it will eliminate many weaknesses they perceive with traditional, hierarchical PKI architecture. Guest Alan Grau joins our hosts at they explain how distributed PKI works, describe its proclaimed benefits, and take a hard look at whether or not these claims hold up.

Root Causes 89: PKI's Role in Zero Trust May 07, 2020

"Zero Trust" is an IT security philosophy that maximizes protection from threats by tightly controlling access and permissions for every individual, device, and process in the organization's environment. Learn how digital identity and certificates play a key role in operating a secure Zero Trust strategy.

Root Causes 88: PKI and Blockchain May 04, 2020

Many observers notice similarities between PKI and blockchain, including their applicability to secure digital systems and their ability to enable authentic information and non-repudiation in an electronic environment. Join our hosts and expert guest Alan Grau as they go over the similarities and differences between PKI and blockchain, explain the qualities of a good use case for each, and describe how they can complement each other.

Root Causes 87: Zoom's (Not) End-to-End Encryption Apr 30, 2020

With lockdowns and working from home the norm, a great deal of attention has been paid to video conferencing technology. In particular, Zoom has claimed to offer end-to-end encryption while in fact it does not, making headlines across media of all sorts. In this episode our hosts explain what end-to-end encryption is and why the distinction is important for a service like Zoom.

Root Causes 86: SSH Keys Apr 27, 2020

SSH keys are essential for controlling access to production infrastructure. Our hosts are joined by repeat guest David Colon to discuss how SSH keys are used in contemporary computing environments, what risks they carry with them, and tips for IT professionals to use SSH keys easily and securely.

Root Causes 85: Automotive Key Fobs and Cryptography Apr 23, 2020

Recent headlines have unveiled high profile attacks against automobile key fobs. Such an attack is potentially huge since successfully mimicking these fobs can yield complete access to an automobile's capabilities. Our hosts are joined by repeat guest Alan Grau as they describe the cryptographic architecture of a modern automotive key fob, how these attacks take place, and what automobile manufacturers can do about it.

Root Causes 84: What Is DNS over HTTPS? Apr 20, 2020

DNS over HTTPS is a capability whereby DNS lookups can be encrypted to defend against certain man-in-the-middle attacks as well as protecting information about web usage from being revealed to third parties. In this episode our hosts explain DNS over HTTPS, it potential uses, and how it works. They also explain some of the controversy and potential concerns that have been raised with this approach.

Root Causes 83: Quantum Apocalypse - Does COVID-19 Change the Z Date Apr 16, 2020

Lock downs and work-from-home requirements have disrupted the efficiency of operations in all walks of industry, including academics and advanced computing research. In this episode our hosts debate if and how the pandemic's disruptive nature might change the date on which quantum computers are able to defeat today's encryption.

Root Causes 82: The Death of the Hard Token Apr 13, 2020

People are working from home in unprecedented numbers, which means that companies need to find ways for them to connect securely. Some will consider hard tokens as an option. In this episode our hosts give a frank assessment of the difficulty that hard tokens present for the modern remote workforce, along with some of the other available options that are likely to serve the enterprise better.

Root Causes 81: What Is Embedded Firewall? Apr 06, 2020

Security for IoT devices depends not only on establishing strong identity mechanisms for devices and the services they connect to but also in ensuring the ongoing integrity of device operations. In this episode our hosts are joined by guest Alan Grau to explain what an embedded firewall is and how it aids security for connected devices.

Root Causes 80: The Pros and Cons of VPNs Apr 02, 2020

With the sudden, meteoric increase in remote workers, many IT professionals are looking at VPN as a method of keeping them secure. Join our hosts as they discuss the advantages and disadvantages of VPNs, and what to look out for.

Root Causes 79: Firefox Reinstates Support for Deprecated TLS Versions Mar 30, 2020

To enable broadest possible access to valuable information about the COVID-19 epidemic, Firefox has chosen to reinstate support for web sites using TLS 1.0 and 1.1. Join us to learn about this move, why Firefox has made it, and what that says about the state of web site security today.

Root Causes 78: Extended Validation Certificates and the Dark Web Mar 26, 2020

New research presented at RSA Security Expo indicates that at least one party is using online criminal marketplaces to sell a package of a newly-created business and at least one Extended Validation SSL certificate to go with it. Join our hosts as they explain what the research says and talk about the potential criminal use cases for a bundle like this one.

Root Causes 77: Certificates for Public Cloud Mar 23, 2020

As a convenience to customers and a competitive differentiator, public cloud services such as AWS offer TLS certificates for use in their environments. Join our hosts as they explain this practice, how these certificates can be used, and which use cases and environments will not work with TLS certificates from public cloud vendors.

Root Causes 76: Implications of COVID-19 for PKI Mar 20, 2020

COVID-19 is rocking all aspects of our daily and business lives. So what are the implications of lock-downs, office closures, and high employee absenteeism on the PKI world? Our hosts explore the implications of our new post-pandemic work culture on business continuity and security, and how PKI fits into this new way of working

Root Causes 75: Sectigo's COVID-19 Readiness Mar 18, 2020

As measures move into place throughout society to flatten the curve of COVID-19's spread, it is important to understand the potential effects of lock downs, school closures, and work-from-home mandates on the critical systems that keep our digital world running. Sectigo has conducted an internal audit of its business continuity and disaster recovery plans in light of the specifics of the ongoing pandemic, and we remain confident in our ongoing operation without material disruption through the present crisis. In this episode our hosts go over the results of Sectigo's COVID-19 readiness audit and what customers can expect in the months to come.

Root Causes 74: Device and Network Access Mar 17, 2020

Certificates can play a critical role in enabling and controlling access for users and devices to our sensitive business processes and data. Our hosts are joined once again by David Colon as we explore the role certificates play in providing network access and permissions, including some best practices.

Root Causes 73: Apple to Drop Support for Two-year SSL Certificates Mar 13, 2020

At the most recent Face-to-Face meeting of the CA/Browser Forum, Apple announced that as of September 1 it will distrust public TLS certificates issued with terms longer than thirteen months for all its technology products. Join our hosts as they discuss this change, its affect on the ecosystem, and what you need to do to prepare for one-year SSL certificates.

Root Causes 72: Future-proofing Your PKI Mar 09, 2020

Former CableLabs CIO and Kyrio President and General Manager Mitch Ashley joins our hosts to discuss how to set up a PKI system that will meet your needs for many years to come. Mitch is now CEO of Accelerated Strategies Group, a disruptive analyst firm focused on cybersecurity, devops and cloud. We discuss the differing attitudes, pain points, and processes of device manufacturers versus service providers. Mitch explains how the overall qualities of the ecosystem affect PKI, ensuring extensibility and auditability, and how to project your PKI needs into the future ten or twenty years from today.

Root Causes 71: Short Lived DevOps Certificates Mar 06, 2020

Repeat guest and DevOps expert David Colon joins us again to discuss identity for microservices, including the use of very short-lived TLS certificates. David and our hosts explore the unique properties of PKI in these environments and describe how to find the optimal term for a container certificate.

Root Causes 70: Identity Is the New Perimeter Mar 04, 2020

Modern architectures and development processes have shattered the old concept of an IT perimeter for the enterprise. In this world, attaching strong identity to every device, user, and process is essential to security. In this episode our hosts describe this challenge and discuss the pros and cons of various identity schemes.

Root Causes 69: Fundamentals of DevOps and PKI Feb 28, 2020

In our ongoing series on DevOps and PKI, DevOps practitioner David Colon joins us to help describe the intersection of DevOps security and PKI. We explore how PKI fits in with orchestration engines like Kubernetes and some of the practical considerations in securely using keys in such environments.

Root Causes 68: Why SHA-1 Is No Longer Secure Feb 23, 2020

SHA-1 was a cornerstone of the early secure web. Now, 25 years later, this hashing function is no longer secure. Join our hosts to hear the history of SHA-1, its common use cases, and the properties of an effective hashing function. Learn about collision attacks and why they matter. Find out the reasons SHA-1 is still in use and why it is no longer secure in today's computing world.

Root Causes 67: Definition of DevOps and DevSecOps Feb 21, 2020

Our hosts are joined by senior DevOps engineer David Colon to explore what DevOps means in today's enterprise. They cover diverse aspects of the DevOps phenomenon, including cultural implications, "configuration drift," definition of release velocity, and DevSecOps. Plus of course how DevSecOps intersects with PKI.

Root Causes 66: Functional Versus Homomorphic Encryption Feb 18, 2020

Traditionally, file encryption is an all-or-nothing affair where data cannot be gleaned from the encrypted file without fully decrypting its contents. A new brand of cryptography called homomorphic encryption makes it possible for specific types of data to be read from a file while the rest of it remains encrypted. Join our hosts as they explain this new technology approach and its possible implications and use cases.

Root Causes 65: Quantum Key Distribution Feb 10, 2020

Quantum key distribution is a new technology that uses the principles of quantum physics to generate and distribute truly random keys for encrypted communication. Join us as we explain how quantum key distribution works, why it is not the same as quantum safe cryptography, and which cases it may be useful for.

Root Causes 64: What Is Digital Identity? Feb 04, 2020

The phrase "identity is the new perimeter" has gained in use of late, reflecting the reality that today's modern enterprise architecture is a mix of traditional and cloud, owned and rented and BYOD, all together in a complex mix. Under those circumstances identity is key to determine which digital entities have which permissions. But what do we mean when we say identity? Join our hosts as they explain the concepts behind digital identity, how they compare to our offline ideas around identity, and how these ideas shape computer security.

Root Causes 63: What Is CAA? Jan 27, 2020

CAA, which stands for CA Authentication, is the capability for the domain name owner to specify in DNS which CAs are allowed to issue SSL certificates for a specific domain. Join us to learn more about CAA, including how it works and its potential benefits to businesses.

Root Causes 62: Windows CryptoAPI Spoofing Vulnerability Explained Jan 22, 2020

On January 14 Microsoft announced a sweeping vulnerability that makes it possible to defeat the authentication of Elliptic Curve Cryptography (ECC) on Windows 10 and Windows Server systems, making it possible to create fake certificates on trusted roots that will fool these systems. Join our hosts and guest Nick France, CTO of SSL at Sectigo, as we explain this vulnerability, how it could be used in exploits, and what must be done to address it.

Root Causes 61: Anatomy of a Cryptocurrency Jan 10, 2020

In our ongoing series about blockchain, we explore the technology, process, and ecosystem needs for a successful cryptocurrency. Join our hosts along with expert guest Alan Grau as we discuss the technology and ecosystem specifics of cryptocurrencies, including blockchain and PKI.

Root Causes 60: Fundamentals of Blockchain Jan 06, 2020

Widely understood to be the technology behind popular crypto currencies, blockchain has become a household word. But what it blockchain really, and how does it work? Join our hosts and returning guest Alan Grau as they explain how blockchain functions, its strengths and weaknesses, and some of the other potential applications for this technology.

Root Causes 59: What Is Certificate Transparency? Dec 28, 2019

Certificate Transparency (CT) is a recent and important development in the world of SSL certificates. Popular browsers require trusted CAs to log all SSL certificates to publicly available CT Logs. Join our hosts to find out how various parties are using CT Logs to learn about CA behavior and SSL usage patterns and to improve the overall quality of public trust.

Root Causes 58: 2019 Lookback - One Year of Podcasting Dec 14, 2019

Nearly a year ago our hosts launched Root Causes to provide a forum for discussion of the issues surrounding the critically important PKI technology. Now at the end of 2019 we discuss how this podcast has taken shape, how that compares to our original expectations, and what we are looking forward to in 2020.

Root Causes 57: Quantum Random Number Generation Dec 10, 2019

Random number generation is an essential part of successful cryptography. Quantum computers offer to improve this niche technology industry. Join our hosts to learn what quantum random number generators (qRNGs) are, how they stand to improve cryptography and other computing functions, and how they tie into post-quantum cryptography (or don't).

Root Causes 56: 2019 Lookback - Evolving Cryptography Dec 08, 2019

2019 saw important changes in the world's cryptographic standards, including changes in browser treatment of SSL certificates, the removal of a public CA from trusted root stores, widespread serial number entropy problems across many CAs, and progress in building quantum-resistant PKI. Join our hosts as they detail these going-on and others and talk about what 2020 may hold in terms of evolving cryptography.

Root Causes 55: California's New IoT Security Law Dec 04, 2019

California Senate Bill 327 (SB-327) goes into effect January 1, 2020. This groundbreaking ordinance requires basic security measures for devices deployed in California. Join us to learn what SB-327 requires from device manufacturers, which threats it protects against, and how this ordinance is leading the way toward stronger IoT security practices.

Root Causes 54: 2019 Lookback - Infrastructure and IoT Security Dec 01, 2019

2019 was a highly eventful year for infrastructure and IoT security. The year saw the emergence of wholesale attacks on the world's energy infrastructure, an epidemic of ransomware incidents against municipalities, heightened attention to automotive identity and security, and a number of legislative measures to try to secure this whole set of systems and devices. Join our hosts as they talk about the trends in IoT and infrastructure security in 2019 and where these trends may go in 2020.

Root Causes 53: 2019 Lookback - Governments Try to Control PKI Nov 23, 2019

2019 has been an eventful year for PKI. In this episode, first in a series of four lookbacks at the year, our hosts discuss how governments sought to control encryption, certificates, and public trust in 2019.

Root Causes 52: New TLS Certificate Incident Research Nov 21, 2019

New research out of Indiana University Bloomington reviews nearly 400 "incidents" with public SSL certificates over the course of more than a decade. Join us as we go through the main findings from this piece of original research, including methodology, incident types and causes, and rogue certificates.

Root Causes 51: Blockchain vs. PKI Nov 18, 2019

In our industry interactions we frequently run into questions about how PKI and blockchain compare with each other. How do they work similarly or differently? Are they surrogates for each other? Are they complimentary? Join us this episode as we explain the details of how blockchain and PKI work, similarities and differences between them, and what use cases are appropriate for each.

Root Causes 50: Energy Infrastructure Cyber Attacks Nov 07, 2019

Global energy infrastructure continues to find itself under cyber attack from Advanced Persistent Threats (APTs). Join our hosts as we discuss recent attacks on power plants, why these attacks persist, and possible responses.

Root Causes 49: California Consumer Privacy Act Nov 05, 2019

The California Consumer Privacy Act (CCPA) has been described by some as California's GDPR. This act provides broad protections to consumers in California, and businesses must comply starting January 1, 2020. Join us as we discuss this act, what protections it provides, and what businesses must do to comply.

Root Causes 48: Weaknesses in MFA Authentication Oct 30, 2019

A recent FBI warning cautions of attacks that circumvent Multi-Factor Authentication (MFA). Join us as we describe contemporary attacks against MFA and how to defend against them.

Root Causes 47: Quantum Apocalypse - Quantum Resistant Cryptography for IoT Oct 24, 2019

Expert consensus states that we will need to update cryptography before quantum computers break our existing algorithms in the next ten or fifteen years. But what do we do about IoT devices, which may lack updating mechanisms and live in the field for decades with little available access. Our hosts are joined by repeat guest Alan Grau as we explore how IoT has specific requirements and challenges for quantum resistant crypto.

Root Causes 46: Criminals Are Patching Browsers for TLS Fingerprinting Attacks Oct 21, 2019

In a new variant on a known attack, a Russian Advanced Persistent Threat has begun applying patches to Chrome and Firefox to enable TLS fingerprinting even after the malware is removed from a system. To learn more about this new development, join our hosts as they explain how this attack works, its significance, and where the criminals may go from here.

Root Causes 45: What Is the CA/Browser Forum? Oct 16, 2019

SSL certificate practices are governed by the rules of the CA/Browser Forum. But what is the CA/Browser Forum, who is in it, and where do they get their authority? If you've ever wondered about questions like these join our hosts as they describe the origins of the CA/Browser Forum and how it operates.

Root Causes 44: Automotive Device Security Oct 14, 2019

The automobile is undoubtedly among today's most complex, commonplace, and security-sensitive IoT devices. Our hosts describe the cyber threats facing connected cars, including real attacks that already have been proven, new challenges that will come with increasingly advanced capabilities, and what manufacturers can do to protect drivers from harm.

Root Causes 43: Quantum Apocalypse - More on Mosca's Inequality Oct 10, 2019

In episode 35 our hosts explained Mosca's Inequality, a formula for calculating when we need to have post-quantum encryption in place to prevent the Quantum Apocalypse. In this episode our hosts embark on a nuanced exploration of the factors influencing this calculation and test whether popular estimates are credible.

Root Causes 42: Anatomy of a Botnet Oct 07, 2019

We talk about botnets a lot, but not everyone understands how they are built and used by the criminals who control them or how headless IoT devices have greatly added to their power. Expert guest Alan Grau (VP of IoT and Embedded Security, Sectigo) joins us to help dissect today's botnets.

Root Causes 41: What Is Blockchain's Killer App? Oct 02, 2019

Our hosts frequently run into the assumption that blockchain and PKI are extremely similar technologies and are possibly even competitive to each other. While the two approaches accomplish some related goals, they are very different in how they work and ultimately accomplish different ends. Join us as we explain what blockchain actually does and how it compares to PKI, including some examples of use cases that are appropriate for each of these technologies.

Root Causes 40: The Reports of RSA's Death Are Greatly Exaggerated Sep 28, 2019

Recently at Black Hat and on public YouTube videos security newcomer Crown Sterling has claimed to factor the RSA algorithm. It turns out the breathlessly discussed feats were already accomplished as early as 1999. Join our hosts as they debunk this fundamentally misleading rumor and discuss the reality of RSA encryption today.

Root Causes 39: New University Research on Phishing and Certificates Sep 25, 2019

The majority of all phishing sites now use SSL certificates to more closely imitate the behavior of legitimate sites. New research from RWTH Aachen, a large, German technical university, investigates the patterns behind this certificate usage. Join our hosts as we dig into the details of these findings to learn specifically which certificate types are more or less likely to appear on phishing sites - and some thoughts on why.

Root Causes 38: Interesting Breaches in August Sep 22, 2019

The month of August saw some unusual criminal activity when it comes to PKI and malware. Our hosts explain four August news stories including a SHA-1 enabled breach, stolen certificates and keys, and some interesting developments with malware-driven botnets.

Root Causes 37: Quantum Apocalypse - Will Quantum Annealing Break Cryptography? Sep 09, 2019

Quantum annealing is a special case of quantum computing for which the engineering challenges are lessened - and therefore we expect computers of this sort to achieve stability sooner. In this episode we examine the potential for the quantum annealing approach to break RSA-based cryptography sooner than most people have been expecting, and the difficulty of predicting the "Z date" at all.

Root Causes 36: Quantum Apocalypse - The Search for Quantum Resistant Crypto Sep 02, 2019

Finding the new quantum-resistant cryptography we will need to replace RSA and ECC is a difficult task requiring the coordinated effort of academics, industry, and government. NIST has stepped in to lead this volunteer community. Join us to learn about this project to discover and vet going-forward crypto candidates, where we stand in the process, and where we go from here.

Root Causes 35: Quantum Apocalypse - Mosca's Inequality, Mad Max, and Mohawks Aug 27, 2019

Quantum computers have the potential to defeat the RSA and ECC encryption underlying our digital world. We must swap out these algorithms before quantum computers reach that stage of maturity. But how long to we have? Join our hosts Tim Callan and Jason Soroko as they explain how to calculate the ominously named "Z date," the possible consequences of missing that deadline, and potential hairstyles for a post-apocalyptic world.

Root Causes 34: Shadow IT and PKI Aug 24, 2019

Shadow IT has become a fact of the modern enterprise. SaaS, BYOD, outsourced development, embedded IT, DevOps, and public cloud have all chipped away at the CIO's ability to oversee and control the enterprise's technology systems. This fragmentation leads to identity and access challenges that can affect security, governance, auditability, and compliance. Join our hosts as they discuss these challenges and what IT departments can do to address them.

Root Causes 33: Prepare for One-year Limits on SSL Certificates Aug 17, 2019

The CA/Browser Forum faces a proposed ballot to limit the maximum duration of an SSL certificate to 13 months. Even if this ballot fails, browsers such as Google Chrome have the ability to simply distrust certificates of longer duration, creating the same de facto situation. Our hosts discuss the trend to shorter certificates, the pluses and minuses of decreased maximum term, and automation as the only solution to fill the gap.

Root Causes 32: Why Do Browsers and Academic Research Say Different Things About EV SSL? Aug 14, 2019

Breaking research from two esteemed universities shows that sites with Extended Validation SSL certificates are much less likely to be engaged in criminal behavior like malware and phishing. And yet, leading browsers are reducing or removing EV information from the interface. Join our hosts as they explore the research results, this paradoxical browser behavior, and the effect it's likely to have on consumer security.

Root Causes 31: Using PKI to Authenticate Phone Callers Aug 11, 2019

Few people know that caller ID numbers have no identity value as they are completely self-reported. This fact enables the plague of robocalling scams sweeping our society right now. Join our hosts as they discuss public telephony systems and other environments that suffer from this problem, where this situation creates vulnerabilities, and what can be done about it.

Root Causes 1-30: When a Whole Country Has Its PII Stolen - Giant Breach Fines - Phishing with SSL Aug 05, 2019

Recently we have seen major news items in some of the common Root Causes themes. Join our hosts as they discuss new whopping breach fines from GDPR and the FTC, what happens when an entire country has its PII stolen, and phishing sites with SSL.

Root Causes Special Bulletin: Kazakhstan Weaponizes the Public CA Jul 29, 2019

The Kazakhstan government is taking measures to force citizens to trust its own root, enabling the widespread persecution of dissidents, journalists, and human rights advocates. Join our hosts to learn the long history of Kazakhstan's weaponization of PKI, what its effects may be, and the opportunities and challenges the browser community faces in fighting it.

Root Causes 29: Vulnerabilities in Cisco Routers and Other Device Integrity Controls Jul 23, 2019

Security flaws in the device integrity modules of Cisco routers and other devices have lately filled the headlines. Join our hosts and guest Alan Grau as they discuss what is happening with these flaws, why, and what to do about it.

Root Causes 28: SSL Certificate Automation Through ACME Jul 21, 2019

ACME is a new SSL certificate automation standard that is taking the world by storm. With support by 150 million web sites and more than 130 open source tools, ACME is a key tool in your digital certificate bag. Join our hosts and guest Abul Salek as they discuss this ACME, why it's important, and what's next for this hugely popular standard.

Root Causes 27: Pending Safe Browser Guidelines from Germany Jul 17, 2019

The German government has published a draft of its latest guidelines for safe browsers, which include requirements for how SSL certificates are supported and treated. Join our hosts as they discuss the German safer browser requirements and their potential impact on Germany, other governments, and industry worldwide.

Root Causes 26: The White House Wants to Prohibit End-to-end Encryption Jul 11, 2019

The White House is the latest government entity seeking to defeat widespread encryption technology through legislated "back door" access. Join our hosts as they explain why such an idea is essentially unworkable and would endanger the confidential online business and personal services upon which we all depend.

Root Causes 25: Entropy and Random Numbers Jul 01, 2019

One cornerstone of successful cryptography is entropy, or the ability to create genuinely unpredictable values. But it turns out that generating truly random numbers is harder than you might think. Join our hosts as they discuss the need for randomness, the lengths companies go to to generate random numbers, and the bad things that can happen when they fail.

Root Causes 24: Certificate Revocation Jun 26, 2019

Occasional certificate revocation is an essential part of the digital certificate lifecycle and any secure PKI scheme. Not only do certificate owners need the revoke their own certificates, but also CAs sometimes need to revoke certificates to keep trust high. Join our hosts as they discuss the whys and wherefores of revocation by the CA, especially as it relates to code signing and malware.

Root Causes 23: Global Energy Grids Under Cyber Attack Jun 17, 2019

The world's energy grids and other utilities have increasingly become targets for cyber attack, both state-sponsored and otherwise. Join our hosts as they discuss the latest developments, possible consequences of cyber war against energy grids, and what we can do about it.

Root Causes 22: Attacks on US Cities with EternalBlue Cyber Weapon Jun 07, 2019

A recent spate of ransomware attacks against US municipalities is noteworthy for being enabled by the stolen US cyber weapon EternalBlue. Join our hosts as we explain this attack, its similarities to earlier incidents, and the whole syndrome of government-sponsored cyber war.

Root Causes 21: New Texas Energy Grid Security Regulation Jun 05, 2019

The state of Texas is leading the way with new legislation requiring cyber protections for its energy grid. Join our hosts as we explain this legislation, why it comes now, and its potential impact on the greater energy industry.

Root Causes 20: 885 Million First American Financial Customer Docs Exposed May 31, 2019

It was recently revealed that First American Title Corporation had 885 million confidential customer financial documents discoverable in the clear on its online site. These documents contain all the most sensitive information necessary for identity theft, spear phishing, and other exploits against individuals. Join our hosts as they discuss the details of this exposure, how it may have come about, and its potential consequences.

Root Causes 19: Death of a Public CA May 28, 2019

Mozilla has decided to remove a public CA from its trusted root store. By doing so Mozilla renders public certificates from this CA essentially valueless for almost all use cases. Join our hosts as the examine the reasons for this decision, how CA rules are made and maintained, and why an action like this one ultimately is healthy for the internet as a whole.

Root Causes 18: SHA-1 Collisions - TLS Fingerprinting - Cisco Trust Anchor Flaw May 22, 2019

Recent news has revealed several important developments in PKI and cyber trust. Our hosts cover the latest SHA-1 collision attack and why it signals the inevitable death of this hashing algorithm. We explain TLS fingerprinting and how it enables malware to defeat firewall AI protections. And we walk through reports of a flaw in the implementation of secure elements on Cisco routers.

Root Causes 17: Sectigo Acquires Icon Labs May 16, 2019

Sectigo's recent acquisition of Icon Labs expands the company's capabilities in embedded OEM and device identity. Jason and Tim are joined by Icon Labs co-founder Alan Grau as our podcasters explore the needs and potential vulnerabilities for connected devices and the suite of technologies that can address these security requirements.

Root Causes 16: PKI for DevOps Environments May 11, 2019

DevOps as a software development and deployment methodology has radically transformed enterprise computing. This approach brings with it new architectures and tools such as containerization, Kubernetes, and multi-cloud. Learn how PKI plays a critical role in DevOps environments and how enterprises can best use certificates to keep their platforms safe.

Root Causes 15: Architecture for Enterprise Certificate Automation May 07, 2019

Automation of certificate deployment and management is a must for today's enterprise. Complexity, changing environments, fast time to market, and simply scale all dictate that the old manual management methodology is dying away. Join our hosts as they detail the whys and hows of enterprise certificate automation. A must-listen for anyone seeking to understand this rapidly emerging technology space.

Root Causes 14: P2P Vulnerability in IoT Devices May 02, 2019

Recent research reveals millions of consumer IoT devices that lack any level of authentication or encryption at all. Join our hosts as we discuss the nature of IoT-based botnets and their negative consequences on enterprises, consumers, and the internet at large, including DDoS, phishing, and more.

Root Causes 13: PKI for IoT Apr 25, 2019

The proliferation of Internet of Things (IoT) devices in many cases has outpaced security for those devices, leaving enterprises, end users, and the general public exposed. Learn how identity is an essential part of protecting any service involving IoT devices and how PKI is positioned to provide that identity.

Root Causes 12: PKI in the News Apr 13, 2019

It was a busy news week for PKI and authenticated identity, and our hosts run through four current stories to clarify them. Tune in to learn the latest about the Dragonblood WPA3 vulnerability, Russian spoofing of GPS/GNSS navigation signals, Know Your Customer (KYC) for social media sites, and a Chinese national's apparent attempt to install a USB rootkit somewhere in Mar-a-Lago.

Root Causes 11: Authentication Is Not for the Authenticated Apr 09, 2019

With so much debate about the role and importance of authentication in digital systems, it is important to remember the purpose of authenticated identity in our cyber interactions. Join us for a discussion of who benefits from known identity, what can go wrong when identity is obscured, and why ecosystems must include incentives for members to participate in identity authentication.

Root Causes 1-10: S/MIME Automated Deployment Apr 03, 2019

S/MIME certificates indicate the authentic identity of the sender and enable encryption for message content and attachments - providing strong defenses against a variety of email-based attacks. Nonetheless, adoption today is extremely small. Find out what the challenges to past adoption have been for this underutilized security technology and what the industry is doing to help enterprises secure their email today.

Root Causes 09: 63-bit Serial Numbers Mar 25, 2019

A recently discovered flaw in common practices reveals that potentially millions of active SSL certificates fall short of cryptographic requirements. Learn how it is that 64-bit certificate serial numbers might offer only 63 bits of entropy and what CAs have to do about it.

Root Causes 08: Free PKI Is Not Free Mar 19, 2019

The promise of a "free" Microsoft CA was alluring to enterprises in the 2000s, but today's increasingly open computing architectures and agile development methodology have outgrown your old fashioned Microsoft CA. Learn about the seven common use cases where your traditional CA no longer does the job.

Root Causes 07: Russian Disconnection from the Internet Feb 25, 2019

Russia has stated that it will disconnect from the internet as a trial exercise for full-blown cyber warfare. This idea presents many problems for Russian services, systems, and businesses, especially since they depend on global systems such as DNS and public Certificate Authorities. Join us to learn some of the problems facing Russia will face if indeed it disconnects.

Root Causes 06: Quantum-Resistant Cryptography Feb 18, 2019

The pending cryptographic Quantum Apocalypse requires that we replace the hashing and encryption algorithms used through the internet, enterprise networks, mobile service, and popular devices. Join our experts to learn more about the requirements for quantum-resistant algorithms to survive the Quantum Apocalypse.

Root Causes 05: Cryptographic Quantum Apocalypse Feb 06, 2019

As quantum computing continues to progress, the world's widespread cryptographic schemes are in danger. To prepare for the cryptographic "Quantum Apocalypse" we will need to replace our RSA- and ECC-based schemes with a new set of ciphers.

Root Causes 04: Australia's New IT Security Back Door Jan 24, 2019

Australia now requires a back door to IT systems. Our hosts are skeptical that this idea will work. Join our PKI experts to learn about the dangers and pitfalls of such a system - and why they have failed in the past.

Root Causes 03: US Government Shutdown and Security Vulnerabilities Jan 15, 2019

The US government shutdown has taken its toll on IT systems. Services are going offline, and we are ill equipped to deal with a major security or service crisis. Tune in to learn more about the risks of the ongoing shutdown to the government's technical infrastructure.

Root Causes 02: O2 Outage and Equifax Breach Jan 07, 2019

In December users of O2, Softbank, and other mobile services experienced a day-long data outage affecting as many as 40 million people. In the summer of 2017 148 million Americans lost their personal data in the Equifax breach. The common thread? Both occurred due to certificate expirations. Join our hosts to learn more about this trending vulnerability.

Root Causes 01: Introduction Jan 03, 2019

Intro to the leading PKI and security podcast. Learn your hosts' qualifications and reasons for creating this podcast.

Our TOPPODCAST Picks

Follow Us

Stay Connected

Root Causes: A PKI and Security Podcast

Related Podcasts

Links

Stay Connected