Java 27 Makes Hybrid PQC TLS a Runtime Inventory Question
Java 27 adds default-preferred hybrid ML-KEM key exchange for TLS 1.3. Organizations still need runtime, configuration, peer, and observed-session evidence before claiming…
Vista Insights
Cryptography is becoming an operating discipline.
Practical analysis for leaders building cryptographic visibility, sequencing post-quantum migration, governing risk, and producing evidence that stands up to scrutiny.
The library
crypto agility insights
Analysis, field notes, and product thinking for this topic.
-
-
A New IETF Draft Tests Whether Constrained Devices Can Carry PQC
A September 19 IETF working-group draft defines ML-KEM and ML-DSA cipher suites for LAKE, while warning that some constrained devices may not…
-
RFC 10033 Makes Backup State Part of Post-Quantum Signature Security
Stateful hash-based signatures can fail if a one-time signing key is reused. RFC 10033 shows why backups, VM cloning, concurrency, capacity, and…
-
Quantum-Secure Links Still Need Conventional Implementation Assurance
A peer-reviewed experiment found measurable leakage from a digital-to-analog conversion effect in continuous-variable QKD. The lesson is broader than one design: cryptographic…
-
A Draft ACME PQC Profile Asks Who Sets Certificate Policy
A new individual Internet-Draft proposes PQC posture fields for ACME certificate orders. It is not a standard, but it raises useful questions…
-
Post-Quantum DNSSEC Has a Packet-Size Problem—and a Trust-Chain Problem
Cloudflare now validates ML-DSA-44 DNSSEC signatures on 1.1.1.1. The deployment exposes transport, downgrade, and delegation-chain questions that every DNS operator should test.
-
A PQC-Ready HSM Is a Starting Point, Not a Migration Certificate
Thales has launched Luna 8 with support for current and post-quantum cryptography. Buyers should verify exact algorithms, firmware, integrations, certification status, and…
-
PQC Readiness Without Supply-Chain Control Can Preserve Cryptographic Dependence
New research separates PQC readiness from cryptographic sovereignty. The operational lesson is that migration inventories should capture who controls implementations, validation, hardware,…
-
Bouncy Castle 1.86 Shows Why PQC Readiness Must Track Library Versions
Bouncy Castle Java 1.86 adds PQC capabilities across protocols while fixing security flaws. The release shows why algorithm inventories must remain connected…
-
The EU’s PQC Feedback Reveals the Questions Migration Evidence Must Answer
The EU’s PQC-roadmap consultation found strong support for timelines and risk-based migration—but widespread requests for clarity on prioritization, hybrid schemes, and national…