Selective-Disclosure Credentials Need a Cryptographic Dependency Map
The latest SD-JWT VC draft shows why credential governance must map issuers, holder keys, verifier policy, metadata, type definitions, signing algorithms, caches,…
Vista Insights
Cryptography is becoming an operating discipline.
Practical analysis for leaders building cryptographic visibility, sequencing post-quantum migration, governing risk, and producing evidence that stands up to scrutiny.
The library
critical infrastructure insights
Analysis, field notes, and product thinking for this topic.
-
-
RFC 10073 Makes Composite Certificates a Component-Level Inventory Problem
The new composite ML-DSA standard makes each component algorithm, key, implementation, policy decision, certificate role, relying system, and test result part of…
-
Post-Quantum Evidence Records Turn Proof Preservation Into a Lifecycle
An experimental evidence-record proposal shows why long-lived proof needs an inventory of algorithms, witnesses, timestamps, links, verifiers, owners, locations, and renewal deadlines.
-
Post-Quantum Transport Makes Session State Part of the Cryptographic Inventory
A new experimental transport proposal highlights a broader operational truth: session identity, epochs, recovery state, paths, keys, authorization, and durable storage all…
-
Batched Privacy Pass Tokens Need Inventory, Not Just Protocol Support
The updated IETF batched-token draft shows why privacy protocols require governed records for token types, issuer keys, batch limits, software versions, service…
-
NIST’s KDF Review Shows Why Cryptographic Inventory Must Go Below the Algorithm Name
NIST’s planned SP 800-108 revision shows that KDF mode, PRF, initialization, context, implementation, and dependent service all belong in a usable cryptographic…
-
ACME Proof of Possession Makes Key Control a Verifiable Issuance Event
The ACME proof-of-possession draft separates key control from CSR construction. That makes order binding, challenge state, key custody, algorithm handling, device context,…
-
The CNSA 2.0 PKI Profile Makes Certificate Configuration Inventory Data
The updated CNSA 2.0 certificate and CRL profile shows why algorithm names are insufficient: organizations need governed records for certificate roles, required…
-
Post-Quantum DKIM Turns Email Authentication Into a Size-and-Coexistence Problem
A new post-quantum DKIM proposal shows why email-signing migration must inventory DNS limits, header size, algorithms, selectors, signing services, verifiers, forwarding paths,…
-
Certificate Discovery Makes Fallback Trust a Governed Relationship
The latest IETF certificate-discovery draft shows why multi-certificate agility needs governed links among certificates, retrieval locations, hashes, algorithms, relying parties, assets, owners,…