Root Causes: A PKI and Security Podcast

Latest Episodes:

Root Causes 287: GoDaddy Private Key Breach Mar 20, 2023

Show notes

In this episode we describe an incident in which a GoDaddy breach exposed customer private keys. We explain the expectations surrounding private key exposure and get into the interesting question of when an incident is or is not part of a large company's CA business.

Root Causes 286: PKI and PQC in New White House Cybersecurity Initiative Mar 16, 2023

Show notes

A new White House cybersecurity initiative specifically calls out digital identity and post quantum cryptography (PQC) among its focal areas. We discuss what it says and the potential implications.

Root Causes 285: Can ChatGPT Write Malware? Mar 14, 2023

Show notes

In our ongoing exploration of the security implications of AI, in this episode we examine the suitability of ChatGPT as a malware-writing tool and possible future directions for AI in software creation.

Root Causes 284: 90-day SSL Certificates Are on the Way Mar 10, 2023

Show notes

The Google Chrome root program recently announced its intention to reduce the maximum term for public SSL certificates to 90 days. In this episode we explain this announcement and its implications and speculate on timing for this reduction.

Root Causes 283: Google Optional OCSP Proposal Clarified Mar 06, 2023

Show notes

In our episode 281 we reported on Google's proposal for optional OCSP. In this episode we correct some of our earlier reporting in that episode, including the use of CRL and the removal of any revocation requirement for SSL certificates of not more than ten days in term.

Root Causes 282: HSMs and Post Quantum Cryptography Mar 02, 2023

Show notes

Repeat guest Bruno Couillard of Crypto4A joins us to explain where Hardware Secure Modules (HSMs) fit into the world of PQC. We discuss the issues surrounding how HSMs will work with post quantum algorithms and hybrid certificates and the process (and timelines) for defining how HSMs will incorporate PQC.

Root Causes 281: Google Proposes Optional OCSP Feb 26, 2023

Show notes

In response to concerns about OCSP and privacy, Google has proposed removing the requirement for OCSP revocation checking for public SSL certificates meeting certain specific conditions. In this episode we go into the details of this proposal.

Root Causes 280: Did an AI Break CRYSTALS-Kyber? Feb 24, 2023

Show notes

Recent news reports might suggest that an AI-enhanced side attack has defeated the CRYSTALS-Kyber PQC algorithm. In this episode we clarify that Kyber has not been defeated to date and exactly what did occur. We define side channel attack, discuss the broader implications of this attack, and speculate on what would happen if Kyber actually were broken.

Root Causes 279: ChatGPT Watermarking Feb 19, 2023

Show notes

ChatGPT presents the potential problem of ChatGPT content being used and attributed to another source, such as a professional writer or a student. In this episode we discuss the idea of "watermarking" ChatGPT content, including stenography, randomness, entropy, and how to destroy the watermarks.

Root Causes 278: Microsoft on Certificates and FIDO Feb 17, 2023

Show notes

Recent public discussion of FIDO and digital certificates reveal details of Microsoft's approach to consumer digital authentication. We discuss secure elements, Windows Hello, and the differences between B2C, B2B, and B2E.

Our TOPPODCAST Picks

Follow Us

Stay Connected

Root Causes: A PKI and Security Podcast

Related Podcasts

Links

Stay Connected