Selective-Disclosure Credentials Need a Cryptographic Dependency Map
The latest SD-JWT VC draft shows why credential governance must map issuers, holder keys, verifier policy, metadata, type definitions, signing algorithms, caches,…
Vista Insights
Cryptography is becoming an operating discipline.
Practical analysis for leaders building cryptographic visibility, sequencing post-quantum migration, governing risk, and producing evidence that stands up to scrutiny.
The library
Latest insights
Analysis, field notes, and product thinking
-
-
RFC 10073 Makes Composite Certificates a Component-Level Inventory Problem
The new composite ML-DSA standard makes each component algorithm, key, implementation, policy decision, certificate role, relying system, and test result part of…
-
Post-Quantum Evidence Records Turn Proof Preservation Into a Lifecycle
An experimental evidence-record proposal shows why long-lived proof needs an inventory of algorithms, witnesses, timestamps, links, verifiers, owners, locations, and renewal deadlines.
-
Post-Quantum Transport Makes Session State Part of the Cryptographic Inventory
A new experimental transport proposal highlights a broader operational truth: session identity, epochs, recovery state, paths, keys, authorization, and durable storage all…
-
Batched Privacy Pass Tokens Need Inventory, Not Just Protocol Support
The updated IETF batched-token draft shows why privacy protocols require governed records for token types, issuer keys, batch limits, software versions, service…
-
NIST’s KDF Review Shows Why Cryptographic Inventory Must Go Below the Algorithm Name
NIST’s planned SP 800-108 revision shows that KDF mode, PRF, initialization, context, implementation, and dependent service all belong in a usable cryptographic…
-
ACME Proof of Possession Makes Key Control a Verifiable Issuance Event
The ACME proof-of-possession draft separates key control from CSR construction. That makes order binding, challenge state, key custody, algorithm handling, device context,…
-
The CNSA 2.0 PKI Profile Makes Certificate Configuration Inventory Data
The updated CNSA 2.0 certificate and CRL profile shows why algorithm names are insufficient: organizations need governed records for certificate roles, required…
-
Post-Quantum DKIM Turns Email Authentication Into a Size-and-Coexistence Problem
A new post-quantum DKIM proposal shows why email-signing migration must inventory DNS limits, header size, algorithms, selectors, signing services, verifiers, forwarding paths,…
-
Certificate Discovery Makes Fallback Trust a Governed Relationship
The latest IETF certificate-discovery draft shows why multi-certificate agility needs governed links among certificates, retrieval locations, hashes, algorithms, relying parties, assets, owners,…
-
Post-Quantum COSE Makes Object Metadata Part of the Migration Boundary
A new IETF COSE working-group draft for post-quantum KEMs shows why migration inventories must connect object headers, KEM parameters, recipient keys, libraries,…
-
Key Transparency Turns Identity-Key History Into Security Evidence
The latest IETF Key Transparency architecture shows why an identity-key inventory needs verifiable history, client observations, monitoring evidence, ownership, and recovery context—not…
-
One-Signature Certificates Redefine What Certificate Lifecycle Means
An IETF proposal for certificates tied to one signature replaces familiar renewal and revocation assumptions with event-bound keys, long-term evidence, and a…
-
DANE Client Authentication Makes DNS Part of the Cryptographic Inventory
The latest IETF DANE client-authentication draft shows why TLS identity governance must connect certificates, public keys, DNSSEC-protected TLSA records, applications, hosts, owners,…
-
ACME Certificate Profiles Turn Issuance Policy Into Inventory Data
The IETF ACME Profiles draft makes certificate issuance choices explicit. Organizations should preserve the requested profile, returned profile, policy meaning, deployment, owner,…
-
The New HPKE Draft Shows Why “Uses Encryption” Is Not an Inventory Record
The IETF’s updated HPKE draft shows why cryptographic inventory must capture complete ciphersuites, modes, context, implementation, key relationships, and deployment evidence—not just…
-
IBM’s Quantum Safe Launch Confirms PQC Is an Estate-Wide Operations Program
IBM’s new unified PQC suite reflects a market shift from algorithm tools to estate-wide migration operations. Success depends on canonical inventory, contextual…
-
NIST’s PQC Road Map Makes Algorithm Status an Inventory Field
NISTIR 8547 turns post-quantum transition dates into operational data. Organizations need to connect every algorithm to its use case, host, data lifetime,…
-
Hybrid MLS Makes Group Messaging Migration a State-Management Problem
A new experimental IETF proposal for hybrid post-quantum Messaging Layer Security shows that migration depends on ratchet-tree state, membership changes, rotation windows,…
-
Australia’s LATICE Framework Turns PQC Planning Into an Operating Cycle
Australia’s new cyber threat report frames PQC migration as locate, assess, triage, implement, communicate, and educate—a repeatable operating cycle that needs inventory,…
Talk to Vista
Bring your questions to the Vista team.
Ask about inventory, post-quantum planning, governance, and evidence.