TechnologyBusinessScience

Root Causes: A PKI and Security Podcast

Tim Callan and Jason Soroko

Digital certificate industry veterans Tim Callan and Jason Soroko explore the issues surrounding digital identity, PKI, and cryptographic connections in today's dynamic and evolving computing world. Best practices in digital certificates are continually under pressure from technology trends, new laws and regulations, cryptographic advances, and the evolution of our computing architectures to be more virtual, agile, ubiquitous, and cloud-based. Jason and Tim (and the occasional guest subject matter expert) will help you stay current on developments in this essential technology platform and to understand the whys and wherefores of popular Public Key Infrastructures.

Play

Open in

28 episodes
a few times a week
Avg 9 min
English

Episodes 28

Newest Oldest Longest

All20 Unplayed20 In progress0 Played0

Counted on this page — what you have heard stays on this device, so it is not something the list can be paged by.

#662
Yesterday · 10 min
Root Causes 661: What Will Happen with eIDAS and MTC?
TLS certificates from CA/Browser Forum CAs are not the only server certificates in the WebPKI. eIDAS QWACs are treated as server certificates by the major browsers. We see clear progress toward post quantum cryptography (PQC) for TLS by way of the Merkle Tree Certificate (MTC) architecture. But what is the path to PQC for eIDAS? We examine this question.
#661
Wednesday · 3 min
Root Causes 660: What Are Delegated Credentials?
As certificate lifespans become extremely short, new methods of delivery become functionally necessary. We explain RFC 9345 and how delegated credentials play a role in CDNs to deliver very short-lived certificates.
#659
Monday · 12 min
Root Causes 659: Should We Lengthen Certificate Lifespans?
With certificate lifespans shortening, we occasionally run into those who disagree with this trend and seek to lengthen maximum term once again. We examine regressive attitudes in PKI, why they occur, and the reasons that lessening security is generally a bad policy.
#658
August 26 · 13 min
Root Causes 658: The Trouble with X9 Certificates
X9 is a consortium certificate for interbanking applications. There is a common misunderstanding that X9 certificates are a public-trust surrogate for mTLS using WebPKI certificates. We clarify why this is not the case.
#657
August 24 · 1 min
Root Causes 657: What Is Chaos Engineering?
"Chaos engineering" describes the practice of injecting faults into a system to see what happens. This is a known strategy for deterministic systems, but with the advent of non-deterministic AI systems, chaos engineering has taken on greater importance.
#656
August 21 · 6 min
Root Causes 656: The Trouble with Recursive AI Training
Since frontier-model AIs have been trained on a large portion of published human knowledge, widespread publication of incorrect information can taint AI results. As more AI-generated slop finds its way onto the internet, this runs the risk of further poisoning AI results. This ultimately can result in completely unusable information.
#655
August 19 · 5 min
Root Causes 655: Why Not to Create Your Own Private CA
It is possible to use common tools like OpenSSL to create your own ML-DSA private CA. This is a great tool for development and research projects, but Jason explains the pitfalls with trying to do this for production systems.
#654
August 17 · 7 min
Root Causes 654: What's the Difference Between ML-DSA and ML-KEM?
We are replacing RSA with the combination of ML-DSA and ML-KEM. We explain the naming convention and specifically what these two algorithms do.
#653
August 14 · 7 min
Root Causes 653: Post Quantum Civilization
Jason explains de-quantization, which is the practice of using our knowledge of how to use a quantum computer to reframe problems for processing using traditional computing architecture.
#652
August 12 · 10 min
Root Causes 652: Choosing WebPKI Deprecation Dates
There is no CABF or root program rule preventing public CAs from implementing new requirements earlier than their assigned due dates. We discuss reasons to implement a rule early and how early it should be.
#651
August 10 · 5 min
Root Causes 651: Look at a Calendar
It is surprising that we continue to see root expirations occur at the most inopportune times. Weekends, public holidays, even New Year's Eve. In this episode we have simple advice to anybody setting up a new root, which is "look at a calendar."
#650
August 7 · 7 min
Root Causes 650: Is It Time to Stop Saying SSL?
SSL hasn't been a standard in use for nearly thirty years, but we still use the word. We discuss why that is, what else we might say, and the expected effect of Merkle Tree Certificates (MTC) on our technical vocabulary.
#649
August 5 · 11 min
Root Causes 649: Client Authentication Certificate Use Cases
With the upcoming deprecation of client authentication using publicly trusted TLS certificates, we go over the common use cases for these certificates. We discuss the reasons public trust is often chosen and how to transition away from it.
#648
August 3 · 21 min
Root Causes 648: Claude Mythos Discovers New HAWK and AES Attacks
Anthropic recently announced that Mythos has found mathematical weakness in the core algorithm for the third-round NIST PQC candidate HAWK, effectively halving its effective key strength. Mythos also developed a faster attack on a round-reduced version of AES-128. These are not implementation attacks but mathematical attacks on the core cryptography. We discuss the massive implications of these developments.
#647
July 31 · 19 min
Root Causes 647: AD CS "Certighost" Flaw Highlights Agentic Identity Risks
A newly revealed flaw in Active Directory Certificate Services (AD CS) allows an attacker to improperly obtain cryptographic credentials for an agent. We discuss the implications that this flaw Certighost (pronounced sert-uh-GHOST) has for agentic AI at large.
#646
July 29 · 5 min
Root Causes 646: Clarifying the Dates for clientAuth Deprecation
Because of a change in the drop-dead date, we have observed confusion in the timeline for deprecation of client authentication and mTLS for public TLS certificates. This is an inflexible deadline, and enterprises that are not ready risk outage. In this episode we spell out these dates very clearly.
#645
July 27 · 3 min
Root Causes 645: FAPI 2.0 Principles
In our series on digital identity for AI agents, we discuss FAPI 2.0 as an option.
#644
July 24 · 5 min
Root Causes 644: Cryptographically Bound Tokens
In our ongoing series on digital identity for agents, we have previous discussed use of certificates for authentication. In this episode we describe how cryptographic proof of possession can enable secure authentication using tokens.
#643
July 22 · 10 min
Root Causes 643: Certificates for Stronger Agent Authentication
We survey different strategies for securely authenticating agentic AI, including certificates and SPIFFE. We discuss Zero Trust and the Principle of Least Privileges as applied to agents.
#642
July 20 · 3 min
Root Causes 642: Anthropic to Support SPIFFE/SPIRE
Anthropic has announced its intentions to support SPIFFE/SPIRE with the SPIRE server rooted in an "upstream authority," which will require a root private CA rather than allowing self-attestation for agentic AI.

Showing 1–20 of 28 episodes