0xLoopTheory

Super excited 🥳🥳

Google Trust Services shifts some Google services to ECDSA leaf certificates by default in Q2 2026. Classical cleanup, not PQC: how TLS migrates in layers. #postquantumcryptography #webpki...Show more

TIL cryptography101.ca 🔥

Something I really dislike about modern work culture: We have somehow normalized arriving at meetings at the exact last second. Or a minute late. Or walking in while the meeting has already started, opening the laptop, getting settled, and pretending this is fine. Remote work probably made this worse. One call ends at 10:00, the next starts at 10:00, so everyone is constantly teleporting between contexts. But I see it more and more in physical meetings too. I know not everyone wants to be five minutes early. Fair enough. But being ready when the meeting starts should not be an old-fashioned idea. It is basic respect for the people in the room and for the time we decided to block together. And yes, we have too many meetings. Too many people in them. Too many meetings without a clear goal, agenda, or decision to make. That is a separate problem. But if we are going to have the meetings, let's at least treat it like it matters. Be there. Be ready. Start on time.

redesigned aumasson.jp (topright theme toggle)

Yesterday I wrote that it had finally sunk in. Today the first copy arrived in the mail. A real book. Real weight. My name on the spine. I've looked at this cover on a screen a hundred times. Holding it is something else entirely. Thank you all. 💙

"We use STARKs, so we are post-quantum" is not a complete answer. Quantum risk in a deployed proof system depends on which layer carries the assumption and whether you can actually replace it in production.

Full analysis, PDF, and LaTeX source: encryptorium.com/research/post-…

It would mean a lot if you could check it out. All information can be found here: cleartextnovel.com

The realization that Cleartext is actually published has just hit me. A real book. With my name on it. It's difficult to put into words what that means to me. So much happened in the last couple of years. Work, papers, CISSP, late nights, doubts, edits, life. And still the book is out now. I am so grateful! I can't fully process it. Thank you so much to everyone who has been on this journey with me and continues to be. It means a great deal to me to have your support. 💙 The journey continues. The PQ-ZK paper is next.

Full piece available as a blog post 😊 encryptorium.medium.com/google-is-swit…

Google is moving a number of its TLS certificates from RSA to ECDSA. Not because ECDSA is quantum-safe. It is not. Not because RSA is about to fall. It is not. Not because someone at Google forgot Shor's algorithm exists. They did not. The announcement is easy to misread. Google Trust Services says that during Q2 2026, a number of Google services that have historically provided an RSA leaf certificate will shift to an ECDSA leaf certificate by default. So in the middle of the post-quantum migration, Google moves certificates from one Shor-vulnerable algorithm to another. Under standard resource estimates (Roetteler et al., 2017), breaking P-256 requires fewer logical qubits than breaking RSA-2048. On paper, this is a step toward the more quantum-fragile primitive. It still makes sense, and the reason is the most useful mental model I know for the PQ transition: TLS does not migrate as one block. It migrates in layers, and each layer faces a different threat on a different clock. Key exchange is on the fast clock. Recorded traffic can be decrypted retroactively: harvest now, decrypt later. So it moved first. X25519MLKEM768 is now default or automatically advertised in current major browser stacks: Chrome, Edge, Firefox, and Safari on Apple's 26-generation OS releases. By late October 2025, the majority of human-initiated traffic with Cloudflare was already using post-quantum encryption. Certificates are on the slow clock. For live TLS authentication, a signature must be unforgeable at the moment it is verified, not forever. A quantum computer in 2035 cannot retroactively forge the certificate that authenticated your session today. And the slow clock is forced by a budget nobody can print more of: bytes. An ML-DSA-44 signature is 2,420 bytes. A raw ECDSA P-256 signature is 64 bytes. Cloudflare estimates a drop-in swap would more than double the bytes most QUIC connections transmit over their lifetime. Chrome says plainly it has no immediate plan to add traditional X.509 post-quantum certificates to its root store. Chrome's public-WebPKI plan is Merkle Tree Certificates, now being developed in the IETF PLANTS working group, against Google's broader stated 2029 PQC migration timeline. So the ECDSA move is classical housekeeping. Google's stated rationale is efficiency: smaller to transmit, cheaper to process. The announcement does not mention post-quantum once. Which layer is migrating? Against which threat? With which ecosystem attached? Ask those three questions and most "why not just deploy PQC now" takes dissolve. The honest counterweight: maybe the slow clock is not as slow as the WebPKI assumes. Roots live for decades. Devices outlive their update channels. Gidney's estimate for breaking RSA-2048 dropped from 20 million noisy qubits in 2019 to under one million in 2025. If you think certificate authentication has less time than the ecosystem assumes, that is the argument worth having. I would like to hear it.

I’ve moved my active posting to @0xLoopTheory . That’s where I write about cryptography, PQC, ZK, secure systems, and the projects I’m building now. This old account will stay parked, but I won’t really use it anymore.

We’ve received notice that the Department of Commerce has lifted export controls on Claude Fable 5 and Mythos 5. We'll begin restoring access tomorrow, and will share an update soon. We’re grateful to our users for their patience, and to everyone who worked with us on redeploying the models.

Sitting in the train right now, working on my book (Cleartext), and it just hit me how good this feels. Not only the book part. Just having time and mental space for my own projects again. The #CISSP was worth it, and I am genuinely happy I passed. But the last few weeks also took a lot of focus. Work, family, studying, practice questions, weak areas, notes, repetition. Again and again. It was a lot. And now, suddenly, there is room again. Room to think about writing. Room to work on Cleartext. Room to go back into cryptography, PQC, ZK, Web3 security, research, building things, all the stuff that makes me feel like myself. It also feels good to realize that I can still do it. I can still pick one hard thing, focus on it properly, and push through until it is done. That is something I do not want to take for granted. At work, there's a crazy amount going on, so life is definitely not calm. But somehow I still feel lighter. The big exam-shaped weight is gone, and I can feel my curiosity coming back in a very concrete way. It is a nice feeling. Passing the CISSP was important. But getting back to the work I love feels amazing.

The United States did not just discover post-quantum cryptography this week. The goal has been federal policy since National Security Memorandum 10 in 2022, with the stated aim of "mitigating as much of the quantum risk as is feasible by 2035." Congress added statutory weight with the Quantum Computing Cybersecurity Preparedness Act that December. OMB then told agencies to inventory their cryptography and name a migration lead in M-23-02, also in 2022. NIST finalized the first three PQC standards in August 2024: ML-KEM, ML-DSA, and SLH-DSA. The intent, the law, and the technical standards were already in place. What the June 22 executive order changes is the date. Federal HVAs and high-impact systems must move to PQC for key establishment by December 31, 2030, and for digital signatures by December 31, 2031. Covered contractors get a 2030 line through the coming FAR rule and NIST FIPS requirements. A NIST pilot is due by the end of 2027. The order also tells agencies to identify a PQC migration lead and review their inventories, which strongly echoes what M-23-02 asked in 2022. That suggests the earlier inventory work either did not fully take, or was not actionable enough to drive migration. The new move is to put a near-term deadline on work that was supposed to be underway already. One detail is worth sitting with. Key establishment gets the earlier deadline, signatures get an extra year. That ordering is a threat-model statement. Key establishment protects confidentiality, which is exactly what harvest-now-decrypt-later attacks: an adversary records encrypted traffic today and waits for a quantum computer to read it later. Signatures protect authenticity. They matter, especially for code, certificates, and long-lived trust chains, but they are not retroactively broken in the same way recorded confidential traffic is. The confidentiality clock is already running, so confidentiality goes first. What I am less sure about is whether a date fixes the hard part. The binding constraint on PQC migration was never only the math. NIST has settled enough of the standards question for migration to begin. The constraint is discovery. Most organizations do not know where their cryptography lives. It sits in protocols, certificates, firmware, vendored libraries, cloud services, appliances, and code nobody has opened in a decade. The 2022 inventories were meant to surface exactly this. A deadline can force real cryptographic agility, or it can force a one-time spreadsheet that is stale the day after it is filed. I would like to hear from people who have run a cryptographic inventory in a large environment. What was the part that did not fit on the spreadsheet?

@destcert YouTube: @destcert" target="_blank" rel="nofollow noopener">youtube.com/@destcert Think Like a Manager: youtube.com/watch?v=vfC9OL… Pass the CISSP Like a Pro: youtube.com/watch?v=gKe88t… CISSP Exam Cram 2026: youtube.com/playlist?list=…

Here are the resources that carried me through the CISSP. Not a complete list. Just what actually helped me. Your mileage will vary. 📚 Core study path The Official @ISC2 CISSP Study Guide This was the spine. Not exciting, but necessary. LearnZapp Daily questions, weak-area checks, and full trials. This did most of the reps for me. @destcert The book, the mindmap videos, and the mindmaps themselves. Probably the clearest map I found for seeing how the eight domains connect. @pzerger CISSP material Especially useful for high-yield review and final consolidation. 🧠 Final stretch / exam mindset “How to Think Like a Manager for the CISSP Exam” by @pzerger If one thing changed how I read questions, it was this. “How to Pass the CISSP Exam Like a Pro” by @destcert Very useful close to exam day for strategy, framing, and not fighting the exam. 🛠️ My own layer I ran the whole thing with Claude Code / @claudeai / @AnthropicAI. Not as autocomplete. As a mentor, administrator, track keeper, dashboard builder, flashcard engine, and accountability system. It helped me keep the boring parts visible: hours, weak domains, missed concepts, streaks, review loops, and what to study next. That mattered more than I expected. Again: this is not “the” CISSP path. It is just what worked for me. What did I miss? Which CISSP resource helped you the most? #CISSP #CyberSecurity #InfoSec #Certification #StudyTips