Skip to content
Sign in
Artwork for Root Causes: A PKI and Security Podcast
TechnologyBusinessScience

Root Causes: A PKI and Security Podcast

Tim Callan and Jason Soroko

Digital certificate industry veterans Tim Callan and Jason Soroko explore the issues surrounding digital identity, PKI, and cryptographic connections in today's dynamic and evolving computing world. Best practices in digital certificates are continually under pressure from technology trends, new laws and regulations, cryptographic advances, and the evolution of our computing architectures to be more virtual, agile, ubiquitous, and cloud-based. Jason and Tim (and the occasional guest subject matter expert) will help you stay current on developments in this essential technology platform and to understand the whys and wherefores of popular Public Key Infrastructures.

Play
Open in
  • 55 episodes
  • a few times a week
  • Avg 12 min
  • English

Episodes 55

NewestOldestLongest
All20Unplayed20In progress0Played0
Counted on this page — what you have heard stays on this device, so it is not something the list can be paged by.
  • #688
    Today · 14 min

    Root Causes 688: eMudhra Exits the WebPKI After Key Compromise

    In this episode about the key compromise at the public certificate authority eMudhra and its exit from the WebPKI, Jason and Tim discuss how a researcher found intermediate CA keys with only one byte of entropy and what eMudhra's incident report says went wrong. They walk through the move of keys between hardware security modules (HSMs), the scripting error that replaced the original keys outside the HSMs' safeguards, and the tighter key generation rules Tim expects from the CA/Browser Forum, an

  • #687
    Wednesday · 10 min

    Root Causes 687: Tim Joins Microsoft

    In this episode about Tim's move from Sectigo to Microsoft, Jason and Tim discuss why Microsoft runs a public certificate authority strictly for its own use, and what Tim's new compliance role there involves. They cover the scale of Microsoft's footprint (roughly 5% of the world's public servers, by Tim's estimate), compare Amazon, Google and GoDaddy running their own CAs, explain why the job is narrower than at a commercial CA yet faces the same Merkle Tree Certificates (MTCs), post-quantum cry

  • #686
    Monday · 9 min

    Root Causes 686: Why Merkle Trees Need Mirrors

    In this episode about Merkle trees and cryptographic mirrors, Jason and Tim discuss Jason's hands-on experiment building an RFC-compliant Merkle tree to log autonomous AI actions and keep AI systems tamper-evident. They explain how binary hash pairing works from leaf events up to the root hash, uncover how an attacker or misaligned agent could silently prune unpaired trailing branches without invalidating the root math, and show why independent mirrors run by CAs, browsers, and infrastructure pr

  • #685
    November 6 · 13 min

    Root Causes 685: A Phone Number Is Not an Identity

    In this episode about the security risks of treating a phone number as an identity, Jason and Tim discuss why a telephone number is merely a routing label for potential reachability rather than a proof of who is on the other end. They examine how silent SIM-swapping attacks, three-line mobile SMS redirection malware, low-entropy knowledge-based verification questions, and AI voice cloning render telephone-based authentication and SMS OTPs below an acceptable security threshold.

  • #684
    November 4 · 17 min

    Root Causes 684: What Is Certificate Agility?

    In this episode about certificate agility, Jason and Tim discuss what it takes to replace any or all digital certificates across an organization rapidly and reliably. They explain why browser root programs are driving shortened certificate lifespans (down to 47 days) and deprecating public clientAuth certificates as a forcing function for automation, why public WebPKI rules exist to protect everyday internet users, and how visibility and Certificate Lifecycle Management (CLM) prepare enterprises

  • #683
    November 2 · 30 min

    Root Causes 683: What Is a Turducken Certificate

    In this episode about "Turducken" (post-quantum opt-out) certificates and WebPKI downgrade attacks, Jason and Tim discuss why trusting even a single classical Certificate Authority leaves the entire web vulnerable to a cryptographically relevant quantum computer. They explain how wrapping classical RSA or ECC keys inside an ML-DSA post-quantum CA signature prevents global downgrade attacks during the transition to Merkle Tree Certificates (MTCs), and walk through the 2027–2028 browser root store

  • #682
    October 30 · 9 min

    Root Causes 682: ccTLD DNS Hijack Exposed by CT Logs

    In this episode, Jason and Tim discuss the recent compromise of DNS for several country-code top-level domains, including .gh (Ghana), .sl (Sierra Leone) and .as (American Samoa), which made domain control validation untrustworthy for every domain under them. Chrome blocked the unauthorized certificates that were found, thanks to certificate transparency logs, though it could not guarantee it found every affected domain. We explain why CAA records could not help, since CAA lives in the same DNS

  • #681
    October 28 · 25 min

    Root Causes 681: The Basis for Cryptographic Agility

    In this episode, Jason and Tim start from the P versus NP question and use a Sudoku puzzle to show the difference between problems that are easy to check and hard to solve. We discuss why RSA and ECC, which rest on factorization, fall to Shor's algorithm and the quantum Fourier transform, and why lattice-based post-quantum algorithms such as ML-DSA were chosen. Because it is impossible to know which hard problem will survive AI-accelerated cryptanalysis, we make the case that cryptographic agili

  • #680
    October 26 · 11 min

    Root Causes 680: Bugzilla Bloodbath Redux

    In this episode, Tim and Jason revisit the "Bugzilla bloodbath," the surge of public CA compliance incidents on Mozilla's Bugzilla, which has become the official WebPKI incident reporting platform. A normal year brings around 100 bugs, but there are now 138 open at once and several hundred opened this year. Almost all are reported by third parties, which suggests security researchers are using AI-assisted automation to scour public CA behavior in CT logs, CPS documents and root hierarchies. We d

  • #679
    October 23 · 15 min

    Root Causes 679: Chrome Plans to Remove All Non-MTC CAs

    As the WebPKI drives toward a Merkle Tree architecture for post quantum cryptography, we have seen a significant development. Google Chrome has announced its preliminary intention, as early as 2028, to remove all non-MTC CAs from its traditional root store. We give you the details.

  • #674
    October 12 · 19 min

    Root Causes 674: Cryptographic Agility on Both Axes

    Repeat guest Bruno Coulliard of Crypto4A joins us to discuss the accelerating pace of change in digital technology, which is going at a rate unprecedented in human history. How do we as people adjust to the hyperspeed of today's technology landscape? And how do we apply these ideas to cryptography?

Showing 1–20 of 55 episodes