Our hosts firmly believe that PKI is a necessary component of all digital interactions.  And yet there are still gaps in PKI implementation.  We discuss these gaps and why they persist.

Root Causes 353: Why Isn't PKI Everywhere?

On August 13, 2024, NIST released its first three standards for PQC algorithms, ML-KEM, ML-DSA, and SLH-DSA.  We tell you where to find them and talk about what happens next.

Root Causes 413: NIST Releases Standards for First Three PQC Algorithms

Apple has published an updated draft to its proposal for shortening the lifespan of SSL certificates, including a final maximum term of 47 rather than 45 days.  We explain.

Root Causes 442: Apple Proposal to Reduce SSL Lifespan Updated

It was a crazy year for CA/Browser Forum activity, with nearly three times the normal number of ballots.  Guest Martijn Katerbarg goes over the 32 CABF ballots from 2024.

Root Causes 451: A Year in CABF Ballots

Changing root store requirements mean CAs must separate their root hierarchies for different certificate types. We explain why enterprises should consider private CA for some use cases.

Root Causes 493: Disentangling Public and Private Certificate Use Cases

We explain the basics of trust models and compare various models including WebPKI, private CA, and consortium models.

Root Causes 494: Introduction to Trust Models

Guest Sofia Celi (IETF, Brave) returns to talk about important developments in post quantum cryptography. Sofia tells us about her candidate algorithm MAYO and what is happening with the NIST PQC onramp.  We learn about KEM TLS and the status of PQC initiatives in IETF.

Root Causes 497: PQC Update with Sofia Celi

In this brief episode we explain why the problem that Shor's Algorithm poses to RSA and ECC can't be solved simply by increasing key size.

Root Causes 501: Why Increasing RSA Key Size Won't Solve the Quantum Problem

In this episode Jason explains the fallacy of "playing chicken" with the Quantum Apocalypse.  We discuss stack ranking and "eyes open" PQC risk decisions.

Root Causes 502: The PQC Game of Chicken

Jason describes his recent experience using Amazon Braket.

Root Causes 504: Jason Programs a Quantum Computer

In this episode we explain the potential for future quantum computers to break files signed  today with RSA or ECC, called "Trust now, forge later."

Root Causes 505: Trust Now, Forge Later

For the first time ever, Jason and I record an episode from the floor of the CA/Browser Forum face-to-face meeting.  We recap the themes of this meeting, and Jason gives his first impressions of a CABF Face-to-face.

Root Causes 506: Recap of CABF Face-to-face #65

The first CA distrust event of 2025 comes with two simultaneous CA distrusts. We give you the details.

Root Causes 507: First Distrust of 2025

"Code vibing" is using generative AI to create or improve working code. We share Jason's adventure using code vibing to create his own web browser. 

Root Causes 508: What Is Code Vibing?

We define CPS (Certificate Practices Statement) and explain the role it plays in both the WebPKI and private CAs.

Root Causes 509: What Is a CPS?

We discuss Jason's code vibing journey to create the Get Off My Lawn! (GoTM) browser. We discuss SSL certificate information, EV indicators, and cookie handling.

Root Causes 510: Introducing the GoML Browser

We follow up on our discussion of the Get off My Lawn (GoTM) browser with Jason's adventure in creating his own custom root store.

Root Causes 511: The GoML Root Store

We examine the circumstance where otherwise allowed practices are out of alignment with the stated practices in the relevant CPS. We discuss CA transparency and accountability, increased scrutiny of the CPS, and mass revocation.

Root Causes 512: CPS Versus Practices Misalignment

We continue our discussion of CPS misalignment by discussing the reasons for revocation as a remedy, its disadvantages, and the possibility of another solution that provides the same benefits at less cost.

Root Causes 513: Is Revocation the Best Remedy for CPS Misalignment?

Tim describes how the addition of an item to the CABF face-to-face meeting agenda blew up into a panicked and outraged online thread.  We discuss what a more functional response would have looked like.

Root Causes 514: Diary of an Online Firestorm

Jason coins the term "entropy-aware governance" to describe the idea of using the degree of entropy it contains to measure the strength of any given secret. This could be an objective, consistent metric that could be applied to standard practices and requirements.

Root Causes 515: What Is Entropy-aware Governance?

Microsoft has finally announced that it will offer an update to Active Directory Certificate Services (ADCS, formerly MSCA) to support post quantum cryptography. We discuss Microsoft's checkered support for ADCS and offer some questions users should be asking. 

Root Causes 516: PQC for ADCS

Jason walks us through an important recent paper from Google tracking the cost of quantum factoring.

Root Causes 517: The Cost of Quantum Factoring

Britain's National Cyber Security Centre recently issued a lukewarm verdict on passkeys as an authentication solution.  We explore the problems with WebAuthn, including account recovery, spotty availability, inconsistent implementation, and lack of Linux support. 

Root Causes 518: NCSC Lukewarm on FIDO WebAuthn

AI is not the elephant in the room. It is the room itself.  Jason explains what he means by that.

Root Causes 519: AI Is the Room

Sectigo has released the results of its survey of IT professionals in charge of certificates to measure their readiness and preparation for 47-day maximum certificate term.  We go over the results.

Root Causes 520: How Prepared Are IT Teams for 47-day Certificates?

We begin to go over the results of Sectigo's recent survey of enterprises and their preparedness and plans for adopting Post Quantum Cryptography (PQC).

Root Causes 521: How Prepared Are Enterprises for PQC? (Part 1)

We complete our description and commentary on the results of Sectigo's survey of enterprise preparedness for Post Quantum Cryptography (PQC).

Root Causes 522: How Prepared Are Enterprises for PQC? (Part 2)

MPIC (Multi-perspective Issuance Corroboration) is soon to move into enforcement phase. In this episode we describe three configuration decisions that can force Domain Control Validation (DCV) to fail and tell you what to do about them before you have a problem.

Root Causes 523: Will Your Configuration Block MPIC DCV?

Three major changes are coming to the world of public certificates, all of which require major changes in how organizations deploy, renew, and manage their certificates.  These are 47-day SSL, PQC, and the deprecation of mTLS.  We describe the overlap between these efforts and how to combine them for better efficiency and project management.

Root Causes 524: How to Kill Three Birds with One Stone

Digital certificate industry veterans Tim Callan and Jason Soroko explore the issues surrounding digital identity, PKI, and cryptographic connections in today's dynamic and evolving computing world. Best practices in digital certificates are continually under pressure from technology trends, new laws and regulations, cryptographic advances, and the evolution of our computing architectures to be more virtual, agile, ubiquitous, and cloud-based. Jason and Tim (and the occasional guest subject matter expert) will help you stay current on developments in this essential technology platform and to understand the whys and wherefores of popular Public Key Infrastructures.

Tim Callan

Popular tracks