Quantum-Secure Links Still Need Conventional Implementation Assurance
A peer-reviewed experiment found measurable leakage from a digital-to-analog conversion effect in continuous-variable QKD. The lesson is broader than one design: cryptographic…
Vista Insights
Cryptography is becoming an operating discipline.
Practical analysis for leaders building cryptographic visibility, sequencing post-quantum migration, governing risk, and producing evidence that stands up to scrutiny.
The library
Cryptographic Governance insights
Operating models for inventory, ownership, policy, remediation, and defensible evidence.
-
-
A Federal Digital-Asset Bill Turns Key Material Into an Evidence-Custody Problem
H.R. 10317 would require federal agencies to discover, safeguard, inventory, and audit digital assets found in seized evidence. Its treatment of private…
-
A Draft ACME PQC Profile Asks Who Sets Certificate Policy
A new individual Internet-Draft proposes PQC posture fields for ACME certificate orders. It is not a standard, but it raises useful questions…
-
Post-Quantum DNSSEC Has a Packet-Size Problem—and a Trust-Chain Problem
Cloudflare now validates ML-DSA-44 DNSSEC signatures on 1.1.1.1. The deployment exposes transport, downgrade, and delegation-chain questions that every DNS operator should test.
-
A PQC-Ready HSM Is a Starting Point, Not a Migration Certificate
Thales has launched Luna 8 with support for current and post-quantum cryptography. Buyers should verify exact algorithms, firmware, integrations, certification status, and…
-
NIST’s Token Guidance Makes Signing-Key Governance a Living Control
NIST IR 8587 connects token security to key protection, verification, lifecycle controls, and provider-customer responsibility. Here is what cryptographic inventory teams should…
-
PQC Readiness Without Supply-Chain Control Can Preserve Cryptographic Dependence
New research separates PQC readiness from cryptographic sovereignty. The operational lesson is that migration inventories should capture who controls implementations, validation, hardware,…
-
Bouncy Castle 1.86 Shows Why PQC Readiness Must Track Library Versions
Bouncy Castle Java 1.86 adds PQC capabilities across protocols while fixing security flaws. The release shows why algorithm inventories must remain connected…
-
The EU’s PQC Feedback Reveals the Questions Migration Evidence Must Answer
The EU’s PQC-roadmap consultation found strong support for timelines and risk-based migration—but widespread requests for clarity on prioritization, hybrid schemes, and national…
-
The G7’s PQC Call to Action Makes Migration a Shared Supply-Chain Obligation
The G7 says post-quantum migration cannot be solved by organizations in isolation. That makes shared inventories, supplier evidence, procurement requirements, and coordinated…