Java 27 Makes Hybrid PQC TLS a Runtime Inventory Question
Java 27 adds default-preferred hybrid ML-KEM key exchange for TLS 1.3. Organizations still need runtime, configuration, peer, and observed-session evidence before claiming…
Vista Insights
Cryptography is becoming an operating discipline.
Practical analysis for leaders building cryptographic visibility, sequencing post-quantum migration, governing risk, and producing evidence that stands up to scrutiny.
The library
cryptographic inventory insights
Analysis, field notes, and product thinking for this topic.
-
-
RFC 10033 Makes Backup State Part of Post-Quantum Signature Security
Stateful hash-based signatures can fail if a one-time signing key is reused. RFC 10033 shows why backups, VM cloning, concurrency, capacity, and…
-
Quantum-Secure Links Still Need Conventional Implementation Assurance
A peer-reviewed experiment found measurable leakage from a digital-to-analog conversion effect in continuous-variable QKD. The lesson is broader than one design: cryptographic…
-
A Federal Digital-Asset Bill Turns Key Material Into an Evidence-Custody Problem
H.R. 10317 would require federal agencies to discover, safeguard, inventory, and audit digital assets found in seized evidence. Its treatment of private…
-
A Draft ACME PQC Profile Asks Who Sets Certificate Policy
A new individual Internet-Draft proposes PQC posture fields for ACME certificate orders. It is not a standard, but it raises useful questions…
-
Post-Quantum DNSSEC Has a Packet-Size Problem—and a Trust-Chain Problem
Cloudflare now validates ML-DSA-44 DNSSEC signatures on 1.1.1.1. The deployment exposes transport, downgrade, and delegation-chain questions that every DNS operator should test.
-
A PQC-Ready HSM Is a Starting Point, Not a Migration Certificate
Thales has launched Luna 8 with support for current and post-quantum cryptography. Buyers should verify exact algorithms, firmware, integrations, certification status, and…
-
NIST’s Token Guidance Makes Signing-Key Governance a Living Control
NIST IR 8587 connects token security to key protection, verification, lifecycle controls, and provider-customer responsibility. Here is what cryptographic inventory teams should…
-
PQC Readiness Without Supply-Chain Control Can Preserve Cryptographic Dependence
New research separates PQC readiness from cryptographic sovereignty. The operational lesson is that migration inventories should capture who controls implementations, validation, hardware,…
-
Bouncy Castle 1.86 Shows Why PQC Readiness Must Track Library Versions
Bouncy Castle Java 1.86 adds PQC capabilities across protocols while fixing security flaws. The release shows why algorithm inventories must remain connected…