Every story tagged Cryptography, curated for CIOs and IT leaders — ranked by source credibility, engagement, and freshness.
37 stories · open in the command center
Anthropic's LLM research demonstrates that while AI can discover novel cryptanalytic techniques (such as attacks on reduced-round AES and post-quantum signature schemes), established symmetric cryptography remains secure due to its deliberately messy, non-mathematical structure designed to resist pattern-based attacks. This finding significantly reduces CIO concerns about quantum-era threats to current encryption standards, though it highlights the value of LLM-assisted security research for identifying subtle vulnerabilities in new cryptographic schemes and formalizing cryptanalysis methodologies.
FIPS 140-3 certification validates only that a cryptographic module implements approved algorithms correctly in a specific configuration—it does not guarantee the security of the product, its deployment, or key management practices. Despite widespread reliance on FIPS certification, multiple certified modules have shipped with critical exploitable flaws (ROCA, EUCLEAK, Dual_EC_DRBG) that persisted undetected for years, and certified configurations sometimes prove less secure than uncertified alternatives, creating a dangerous gap between what procurement teams believe the certificate covers and what it actually guarantees.
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 49.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of *.example.com, python-cryptography's verifier accepts which allows escaping outside of the permitted names. The core issue is in DNSConstraint::matches, where a wildcard pattern was treated as matching a more-specific permitted constraint even though *.example.com can expand to sibling names such as bar.example.com outside foo.example.com. This allows acceptance of an invalid certificate chain. This issue is fixed in 49.0.0.
In Bouncy Castle for Java before 1.85, S/MIME validator trusts signer-asserted signingTime for path validation. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcmail-fips and bcjmail-fips 1.0.7 (1.0.X series), 2.0.7 (2.0.X series) and 2.1.7 (2.1.X series).
In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite documented opt-in. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bctls-fips 1.0.24 (1.0.X series), 2.0.24 (2.0.X series) and 2.1.24 (2.1.X series).
In Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via length-dependent KDF split. This issue also affects Bouncy Castle for Java LTS before 2.73.12.
Certisfy's cryptographic signature technology enables organizations to establish trusted URLs that can be cryptographically verified, addressing the critical challenge of distinguishing authentic content from fraudulent links in an AI-saturated digital landscape. This shift from secrecy-based security to usage authentication creates significant opportunities for IT organizations to reduce phishing attacks, fraud, and social engineering while building verifiable trust infrastructure across digital communications. The implications extend beyond security—enabling verified web experiences that enhance brand credibility and user confidence in an era of increasing misinformation and deepfakes.
Anthropic has published a practical key-recovery attack against HAWK-256, a cryptographic algorithm, demonstrating a significant vulnerability that could compromise encrypted data security. This disclosure highlights the importance of cryptographic algorithm validation and poses potential risks to IT organizations using HAWK-256 in their security infrastructure or data protection systems. Technology leaders should immediately assess their cryptographic dependencies and consider transitioning to vetted, peer-reviewed alternatives to mitigate exposure to this weakness.
Anthropic's Claude AI model demonstrated the ability to discover novel cryptographic attacks against weakened versions of encryption standards (AES and HAWK), raising critical concerns about AI-assisted threat actors potentially compromising encryption systems that protect financial transactions and communications. This capability signals that AI systems may accelerate the discovery of cryptographic vulnerabilities, requiring IT organizations to urgently reassess encryption strategies and prepare for potential threats to current security infrastructure. Technology leaders must recognize that as AI becomes more sophisticated, traditional cryptographic protections may face accelerated compromise timelines, necessitating faster migration to post-quantum cryptography and enhanced threat modeling.
Anthropic's Claude AI model has demonstrated the ability to discover mathematical flaws in cryptographic algorithms themselves—not just implementation errors—identifying improved attacks against HAWK (a post-quantum signature scheme candidate) and AES variants that could have significant implications for cryptographic security standards. While these specific findings do not impact production systems today, they signal a critical shift in how advanced AI models can be leveraged to stress-test and potentially compromise the fundamental cryptographic foundations that protect billions of users' data globally. This capability raises urgent questions about the security of current and future cryptographic deployments and the need for organizations to reassess their cryptographic strategy in an era of increasingly powerful AI models.
AI-powered security auditing successfully identified a critical cryptographic vulnerability in OpenVM's zkVM pairing library that could allow malicious actors to forge proofs, demonstrating that specialized AI tools can outperform standard approaches when analyzing complex interdependent systems. This finding underscores the emerging role of AI-assisted security auditing as a complementary layer to traditional code review, with significant implications for organizations relying on zero-knowledge proof infrastructure. Technology leaders should recognize that as cryptographic systems grow more complex, conventional auditing approaches may miss vulnerabilities at module boundaries, and strategic investment in AI-powered security scanning could become essential for maintaining the integrity of critical infrastructure.
AI-driven security auditing identified seven real vulnerabilities in Cloudflare's CIRCL cryptography library, including critical bugs in threshold RSA, attribute-based encryption, and signature verification schemes—all now patched upstream. This demonstrates that continuous AI-powered code analysis can systematically uncover cryptographic implementation flaws that traditional tools and manual review may miss, with significant implications for securing cryptographic infrastructure at scale. For IT organizations, this validates AI-assisted security as a complementary strategy to conventional audits, particularly for critical open-source dependencies and cryptographic libraries that power enterprise security.
Web-based end-to-end encryption is fundamentally incoherent because the server operator distributes the client code, enabling them to silently push compromised versions—making claims of security against the service provider itself impossible. Rather than providing genuine cryptographic security, these services function primarily as 'cryptography theatre,' a legal strategy to claim inability to comply with warrants and law enforcement requests, which carries significant regulatory and liability risks across different jurisdictions. IT leaders must recognize that adopting or trusting web-based E2E encryption solutions creates false security postures while exposing organizations to potential legal challenges and government enforcement actions.
zkGolf is a competitive platform for optimizing zero-knowledge circuits with formal verification in Lean 4, enabling organizations to develop more efficient cryptographic proofs at reduced computational cost. This addresses a critical business need as ZK circuits power privacy-preserving applications, blockchain scalability, and confidential computing—making circuit efficiency directly tied to operational expenses and performance. For IT leaders, this represents both an opportunity to build competitive advantage in ZK applications and a strategic shift toward formally verified, cost-optimized cryptographic infrastructure.
Google has open-sourced Zero-Knowledge Proof (ZKP) libraries that enable privacy-preserving identity verification—allowing users to prove attributes like age without sharing personal data—creating a strategic opportunity for organizations to build compliant digital identity solutions ahead of the EU's 2026 eIDAS Regulation deadline. This release democratizes access to advanced cryptographic tools, reducing development barriers for enterprises and government entities while establishing a competitive advantage for early adopters implementing privacy-by-design digital services. IT leaders should recognize this as both a compliance enabler for regulated industries and a foundational technology for building customer trust in an increasingly privacy-conscious regulatory environment.
Indistinguishability obfuscation (iO) represents a cryptographic breakthrough with transformative potential for creating trustless systems—enabling secure voting, privacy-preserving applications, and decentralized protocols without traditional intermediaries—but current implementations require impractical computational resources (λ^10+ operations), forcing IT organizations to prepare for either significant performance improvements in the coming years or alternative cryptographic approaches. CIOs should recognize iO as a critical emerging capability that could fundamentally reshape security architecture and third-party trust models, while acknowledging that production deployment remains years away pending major efficiency breakthroughs. This technology's maturation directly impacts long-term strategies for zero-trust architecture, blockchain integration, and regulatory compliance in privacy-sensitive domains.
The U.S. government's recent export controls on Anthropic's advanced AI models (Fable and Mythos) represent the first major test of whether export restrictions can effectively contain frontier AI technology, mirroring decades of largely unsuccessful attempts to control encryption and spyware proliferation. Historical precedent—from the failed PGP encryption crackdown to the ineffective Wassenaar Arrangement on spyware—demonstrates that export controls are easily circumvented through publication, international jurisdictional gaps, and non-compliant regimes, suggesting similar challenges will limit the practical effectiveness of AI export restrictions. IT leaders should anticipate that export controls will create fragmented global technology markets, compliance complexity, and potential competitive disadvantages, requiring organizations to develop strategies for operating across multiple regulatory regimes rather than relying on export restrictions to provide lasting competitive or security advantages.
Researchers discovered hundreds of cryptographically weak RSA and DSA keys in production systems caused by implementation bugs in CompleteFTP and other software that generated keys with non-random bit patterns, enabling rapid factorization through polynomial-based attacks rather than traditional brute-force methods. This vulnerability affects systems that generated keys between 2016-2023, and demonstrates that even minor implementation flaws in cryptographic libraries can create exploitable weaknesses at scale across the internet. IT organizations must audit their cryptographic key generation practices, validate that critical systems use properly generated keys, and understand that independent implementations may share similar vulnerability patterns.
Hash functions, originating from Arnold Dumey's 1956 work on mathematical data transformation, have evolved from simple memory indexing techniques to critical security mechanisms that protect sensitive data through irreversible one-way functions. Cryptographic hashing—which stores transformed data rather than plaintext—is fundamental to modern security practices like password protection, but its effectiveness depends on mathematical properties like preimage resistance and finite field operations that make reversal computationally infeasible. For IT organizations, understanding hash function implementation and staying current with cryptographic standards is essential to protecting organizational data and meeting compliance requirements in an increasingly threat-aware environment.
Researchers have discovered that GPS satellites have been broadcasting encrypted military cryptographic keys to authorized receivers via a public signal for nearly two decades, effectively operating as a global 'numbers station' hidden in plain sight. This Over-the-Air Distribution (OTAD) system, while operationally efficient for the military, creates a significant security risk as the encrypted traffic is accessible to any observer with standard GPS equipment and represents a potential target for cryptanalysis. For IT organizations managing critical infrastructure dependent on GPS timing and positioning, this revelation highlights the importance of understanding hidden dependencies on military systems and assessing vulnerabilities in globally deployed cryptographic networks.
A critical vulnerability discovered in Zcash's Orchard shielded pool in 2022 could have enabled undetectable counterfeiting of ZEC tokens, raising serious questions about the security and auditability of privacy-focused blockchain systems that IT organizations may be evaluating for enterprise use. This incident demonstrates that even sophisticated cryptographic systems require rigorous, continuous security assessments and transparent disclosure practices, with significant market and trust consequences when vulnerabilities are revealed. For technology leaders considering blockchain or privacy-preserving technologies in their infrastructure, this underscores the importance of vendor security track records, third-party audits, and the risks inherent in emerging or experimental technologies.
Current public key infrastructure for individuals relies on custodial intermediaries (email providers, social platforms, CAs) that can be compromised, coerced, or revoked, creating a fundamental security gap despite end-to-end encryption claims—most users never verify key bindings anyway. Self-sovereign PKI using blockchain-based systems like Spaces offers an alternative where cryptographic identities are permanently bound to names without requiring trust in any operator, platform, or certificate authority. IT organizations must recognize this emerging architecture as it challenges traditional identity models and will likely influence how enterprise security, authentication, and encryption frameworks evolve.
Shamir's Secret Sharing is a cryptographic technique that splits sensitive secrets (like master keys or recovery credentials) into shares where a minimum threshold of shares can reconstruct the secret, but any fewer shares reveal zero information—addressing critical governance and disaster recovery needs without single points of failure. For IT organizations, this mathematical approach enables secure credential management, compliance with multi-person authorization requirements, and resilient backup strategies that prevent both unauthorized access and catastrophic loss. Modern implementations like Ente's Legacy Kit layer this technique with additional server-mediated controls to balance security, recoverability, and revocability—a pattern CIOs should consider for protecting high-value secrets across identity management, privileged access, and business continuity scenarios.
Quantum computing poses an emerging but increasingly credible threat to blockchain security infrastructure, with the potential to compromise cryptographic protocols that protect Bitcoin and other digital assets. CIOs must recognize this as a strategic risk requiring immediate planning for cryptographic migration and post-quantum security standards, as quantum computers could retroactively compromise historical transactions and undermine trust in digital asset infrastructure. Organizations with blockchain exposure or cryptocurrency holdings should begin evaluating post-quantum cryptography solutions and developing transition roadmaps to ensure long-term security resilience.
Researchers are exploring quantum jamming—a theoretical vulnerability where entangled particles could be covertly manipulated without detection—as a way to stress-test quantum cryptography and understand fundamental principles of causality beyond current quantum mechanics. This work highlights a critical risk: if quantum mechanics is eventually superseded by a deeper theory, current quantum-based security protocols may become obsolete, making cryptographic systems vulnerable to attacks we cannot yet anticipate. IT leaders should recognize that today's "quantum-safe" security investments may require fundamental rethinking if post-quantum physics theories emerge, necessitating a flexible, layered security architecture that doesn't rely solely on any single theoretical framework.
Researchers have discovered a breakthrough connection between mathematical logic and cryptography, enabling a new class of zero-knowledge proofs that leverage fundamental mathematical unknowability rather than computational complexity to hide secrets. This advancement overcomes long-standing limitations in cryptographic proof systems and opens new pathways for securing sensitive information without revealing underlying data or reasoning. For IT organizations, this represents a fundamental shift in cryptographic capabilities that could enhance data protection, enable privacy-preserving authentication systems, and strengthen defenses against increasingly sophisticated threats.
Neural networks and cryptographic ciphers share surprising architectural similarities—both use repeated sequences of linear and nonlinear transformations with alternating row-column mixing patterns—because they solve fundamentally similar problems: creating complex interdependencies from simple primitives under weak correctness requirements and extreme performance constraints. This structural convergence has strategic implications for IT leaders, suggesting that advances in one field (such as hardware accelerators or optimization techniques) may directly transfer to the other, creating opportunities for consolidated infrastructure and cross-domain innovation. Organizations should recognize that investments in cryptographic and AI acceleration infrastructure may yield synergistic returns and that security and ML teams could benefit from closer technical collaboration.
Leading quantum computing researchers warn that fault-tolerant quantum computers capable of breaking current cryptographic systems could emerge by 2029, necessitating immediate action on post-quantum cryptography migration rather than delayed response. IT organizations face a critical window to transition away from RSA, Diffie-Hellman, and elliptic curve cryptography before quantum threats materialize, as vendors show no inclination to slow development timelines. This represents a strategic imperative comparable to the AI security challenges the industry has underestimated, requiring proactive cryptographic modernization across all systems handling sensitive data.
A quantum computing competition (QDay Prize) designed to benchmark cryptanalysis capabilities fundamentally failed due to flawed judging criteria—the winning submission succeeded through statistical luck rather than legitimate quantum computing advances, exploiting the inherent difficulty of validating Shor's algorithm on small problems where quantum advantage is indistinguishable from random results. This exposes critical gaps in how organizations evaluate emerging quantum capabilities and validate breakthrough claims, requiring IT leaders to demand rigorous validation methodologies before incorporating quantum-resistant cryptography strategies into their security roadmaps. The incident highlights that premature or poorly validated quantum achievements could create false confidence in quantum threat timelines, potentially delaying necessary cryptographic transitions.
GnuPG 2.5.19 introduces post-quantum cryptography support through Kyber (ML-KEM) encryption, marking a critical evolution in cryptographic infrastructure that IT organizations must adopt before the 2.4 series reaches end-of-life in two months. This advancement is essential for protecting sensitive data against future quantum computing threats and establishing compliance with emerging cryptographic standards. For CIOs, this represents both an immediate upgrade obligation and a strategic opportunity to future-proof encryption across email, data protection, and secure communication systems enterprise-wide.