# cryptographic Published articles for cryptographic. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## JDK 27 Security Enhancements DevFeed: [JDK 27 Security Enhancements]() Original publisher: [Read original article]() Author: Sean Mullan Published: 2026-09-16T00:00:00Z Content type: article Language: en Sources: [Inside Java]() Topics: [JDK 27](), [Security](), [Cryptography](), [Encryption](), [TLS (Transport Layer Security)](), [Post-Quantum](), [Release notes]() Tags: [certificates](), [cryptographic](), [encryption](), [jdk-27](), [notes](), [password](), [post-quantum](), [private-key](), [release-notes](), [security](), [tls]() ### AI overview This article reviews selected security enhancements in JDK 27, released on September 15, 2026. It highlights TLS 1.3 support for post-quantum hybrid key exchange mechanisms and the third preview of the PEM API for encoding and decoding cryptographic objects. ### Source excerpt JDK 27 was released on September 15, 2026! As with my previous blogs, I have compiled a list of what I think are the most interesting and useful security enhancements in this release. I have also grouped them into appropriate categories (crypto, TLS, etc) which should make it easier to find out what has changed in each specific area. The JDK 27 release notes also contain further details on these and other enhancements. ## How WorkOS Vault's local encryption works DevFeed: [How WorkOS Vault's local encryption works]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-14T00:00:00Z Content type: article Language: en Sources: [WorkOS Blog]() Topics: [Encryption](), [Cryptography](), [Security](), [data]() Tags: [cryptographic](), [data](), [encryption](), [pii](), [security](), [token]() ### AI overview The article explains how WorkOS Vault performs local encryption using envelope encryption. Each operation uses a single-use data encryption key, which is protected by a key encryption key stored in a hardware security module. Sensitive plaintext and ciphertext remain within the customer's infrastructure; only the wrapped key is sent to WorkOS. Key contexts automatically select or create isolated keys for organizations or tenants, with support for customer-managed keys and documented limits on context size and key counts. ### Source excerpt Envelope encryption, data keys, and why your sensitive data never has to leave your infrastructure ## A Case Study: Building an EN 18031-Compliant IoT Solution with ESP32-C5 and ESP RainMaker DevFeed: [A Case Study: Building an EN 18031-Compliant IoT Solution with ESP32-C5 and ESP RainMaker]() Original publisher: [Read original article]() Author: John Lee Published: 2026-09-14T00:00:00Z Content type: article Language: en Sources: [Blog on Developer Portal]() Topics: [ESP32](), [Internet of things](), [Security](), [Cloud](), [Security & Privacy](), [Espressif](), [Authentication](), [Authorization]() Tags: [access-control](), [authentication](), [blog](), [compliance](), [connectivity](), [cryptographic](), [data](), [data-management](), [documentation](), [en-18031](), [esp-rainmaker](), [esp32-c5](), [espressif](), [eu](), [firmware](), [iot](), [privacy](), [rainmaker](), [regulatory](), [security](), [standards](), [storage]() ### AI overview This case study describes an ESP32-C5 and ESP RainMaker device-to-cloud IoT implementation assessed against EN 18031 cybersecurity and privacy requirements for products targeting the EU market. ### Source excerpt This case study assesses device-to-cloud IoT implementation of products based on ESP32-C5 and ESP RainMaker against the EN 18031 security requirements for the EU market. ## AP2 Protocol Explained: How Agent Payments Get Authorized DevFeed: [AP2 Protocol Explained: How Agent Payments Get Authorized]() Original publisher: [Read original article]() Author: Ayush Agarwal Published: 2026-09-13T00:00:00Z Content type: article Language: en Sources: [Dodo Payments Blog]() Topics: [Authorization](), [AI Agent](), [Artificial Intelligence](), [JSON Web Tokens](), [Google]() Tags: [agent](), [agentic](), [ai](), [authentication](), [cryptographic](), [google](), [payments](), [tokens]() ### AI overview A practical explanation of AP2, an authorization and evidence protocol for AI agent payment transactions. It describes cryptographic proof, verifiable digital credentials, SD-JWTs, and separate checkout and payment mandates. ### Source excerpt A practical guide to AP2, the Agent Payments Protocol: checkout and payment mandates, open versus closed authorization, verifiable digital credentials, and what it means for merchants. ## The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE DevFeed: [The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE]() Original publisher: [Read original article]() Author: Eviatar Garzi Published: 2026-09-10T10:00:43Z Content type: article Language: en Sources: [Unit 42]() Topics: [Kubernetes]() Tags: [api](), [containers](), [cryptographic](), [identity](), [json](), [kubernetes](), [linux](), [malware](), [node](), [open-source](), [research](), [secrets](), [spiffe](), [spire](), [spoof](), [spoofing](), [threat-research](), [tool]() ### AI overview Research on a post-exploitation technique in which root access to a Kubernetes node can let an attacker spoof cgroup metadata used by SPIRE workload attestation, impersonate co-located workloads, and obtain SVIDs. ### Source excerpt Learn how root access on a compromised K8s node allows attackers to utilize SPIFFE/SPIRE metadata to spoof and harvest co-located workload identities. The post The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE appeared first on Unit 42. ## Crypto Agility: Why PQC Is Not a One-Time Upgrade DevFeed: [Crypto Agility: Why PQC Is Not a One-Time Upgrade]() Original publisher: [Read original article]() Author: Hugo Vliegen Published: 2026-09-03T15:00:56Z Content type: article Language: en Sources: [Security @ Cisco Blogs]() Topics: [Cryptography](), [networking](), [Network design](), [Vulnerabilities]() Tags: [cisco-sd-wan](), [cryptographic](), [cryptography](), [infrastructure](), [network-security](), [networks](), [post-quantum](), [quantum-computing](), [sd-wan-security](), [security](), [security-for-ai]() ### AI overview The article explains why crypto agility is essential for long-lived network infrastructure adopting post-quantum cryptography. It argues that organizations should design systems to update cryptography continuously as standards, threats, and implementations evolve. ### Source excerpt Learn why crypto agility is essential for PQC-ready networks--and how adaptable infrastructure helps organizations keep pace with evolving threats. ## How Android Strongbox and Open Standards Enable the Future of High-Assurance Digital Credentials DevFeed: [How Android Strongbox and Open Standards Enable the Future of High-Assurance Digital Credentials]() Original publisher: [Read original article]() Author: Jason Wong Published: 2026-09-01T12:00:00Z Content type: article Language: en Sources: [Security]() Topics: [Hardware](), [Architecture & Design](), [cross-platform]() Tags: [android](), [android-security](), [compliance](), [cross-platform](), [cryptographic](), [hardware](), [identity](), [none](), [open](), [security]() ### AI overview Android Strongbox uses tamper-resistant hardware, key attestation, and remote key provisioning to support high-assurance digital credentials based on open, cross-platform standards. ### Source excerpt Checking phone to see image of digital credential ## Kubernetes v1.37: Pod Certificates and Cluster Trust Bundles DevFeed: [Kubernetes v1.37: Pod Certificates and Cluster Trust Bundles]() Original publisher: [Read original article]() Author: Taahir Ahmed Published: 2026-08-28T18:30:00Z Content type: article Language: en Sources: [Kubernetes Blog]() Topics: [Kubernetes](), [Authentication](), [JSON Web Tokens](), [TLS (Transport Layer Security)](), [Cloud]() Tags: [authentication](), [blog](), [cloud](), [cryptographic](), [json](), [kubernetes](), [post](), [tls](), [tokens]() ### AI overview Kubernetes 1.37 introduces generally available Pod Certificates and Cluster Trust Bundles, adding built-in X.509 certificate issuance for TLS and mTLS. The article explains how this production identity mechanism relates to existing service account JWTs and addresses the security limitations of bearer tokens. ### Source excerpt Pod Certificate / Cluster Trust Bundles Blog Post Kubernetes brings a wealth of features that make it easy to run your production workloads securely and reliably. While aspects like scheduling, health checks and resource limits are probably at the front of your mind, one other important feature of Kubernetes is production identity -- how your workload can authenticate to other systems in order to do its job. Up until now, the primary production identity mechanism built into Kubernetes has been service account JWTs (JSON Web Tokens). These are cryptographically-signed tokens, issued by the control plane of your cluster, that let anyone in the world understand who is calling when your workload uses them. In Kubernetes 1.37, the foundations of a new built-in production identity technology have gone GA. Pod Certificates (and the closely-associated Cluster Trust Bundles) build X.509 certificate issuance for TLS and mTLS directly into core Kubernetes. Why? Service account JWTs have a lot going for them: They are built directly into Kubelet, and work pretty magically. They are written to your workload container's filesystem before your workload starts up, and automatically kept up to date. The issuance system follows least-privilege principles; the node restriction admission plugin ensures that tokens can only be requested by the Kubelet that is actually currently running your pod. They can be federated, allowing you to use them to authenticate to other systems outside of Kubernetes. Service account JWTs underpin the pod-to-cloud authentication store for all of the largest cloud providers, and have widespread support across many additional services and software packages. If it can understand JWTs, you can authenticate to it with a service account token. However, service account JWTs have one big downside -- they are bearer tokens. With bearer tokens, if you have the token, then you are the identity asserted by the token. And since you necessarily have to hand copies of the J ## Why a cryptographic inventory is key for addressing the quantum computing threat DevFeed: [Why a cryptographic inventory is key for addressing the quantum computing threat]() Original publisher: [Read original article]() Author: Christopher Day Published: 2026-08-28T14:01:00Z Content type: article Language: en Sources: [Tenable Blog]() Topics: [Cryptography](), [Security, Privacy and Abuse Prevention](), [migration](), [Security Attacks]() Tags: [algorithms](), [attacks](), [cryptographic](), [cryptography](), [encryption](), [migration](), [post-quantum](), [quantum](), [quantum-computing](), [security]() ### AI overview The article explains how a cryptographic inventory and phased migration to quantum-resistant cryptography can address the risk that future quantum computers pose to public-key algorithms. It highlights harvest-now, decrypt-later attacks, the vulnerability of RSA, ECC, and Diffie-Hellman to Shor's Algorithm, and the expected resilience of AES-256. ### Source excerpt When quantum computers become generally available, they'll be able to crack current public-key cryptographic algorithms, putting digitally stored and transmitted data at risk. But the threat already exists, as attackers use the "harvest now, decrypt later" tactic. Discover why building a comprehensive cryptographic inventory and executing a phased operational strategy are critical for protecting your data against quantum computing attacks. Key takeaways Quantum computing risks are an operational threat today due to "harvest now, decrypt later" (HNDL) tactics, in which adversaries actively harvest and store encrypted data to decrypt it retroactively once quantum capabilities mature. When run on a quantum computer that's powerful enough, Shor's Algorithm will break foundational asymmetric infrastructure like the RSA, ECC, and Diffie-Hellman algorithms, although symmetric encryption standards like AES-256 are expected to remain secure against quantum attacks. Globally, more regulatory bodies are starting to mandate a comprehensive cryptographic inventory, making absolute visibility across the digital environment a prerequisite for an orderly post-quantum migration. Transitioning to quantum-resistant cryptography requires a phased operational strategy spanning discovery, prioritization, remediation, and verification. The quantum threat to modern security architecture Future quantum computers will represent a threat to the foundational security architecture that protects digital data. For decades, the global economy, national security apparatus, and critical infrastructure have relied on asymmetric cryptography, specifically RSA and elliptic curve cryptography (ECC), to secure data in transit, authenticate identities, and protect digital signatures. The mathematical difficulty of factoring large integers or solving discrete logarithm problems has long provided a robust shield against cyber attacks launched using conventional computing capabilities. However, the rapid mat ## Piloting the world's first double-blind AI evaluations DevFeed: [Piloting the world's first double-blind AI evaluations]() Original publisher: [Read original article]() Author: William Isaac; Sol Messing; Kristian Lum Published: 2026-08-27T12:59:16Z Content type: article Language: en Sources: [Google DeepMind News]() Topics: [ai observability]() Tags: [ai](), [ai-models](), [ai-safety](), [benchmarks](), [cryptographic](), [evaluation](), [gemini](), [privacy](), [responsibility-safety](), [security](), [testing]() ### AI overview Google describes a double-blind evaluation of a Gemini Flash Lite model using confidential benchmarks in a cryptographically protected, privacy-preserving environment. The approach is intended to reduce benchmark contamination and improve trust in model capability and safety results. ### Source excerpt Piloting the world's first double-blind AI evaluations ## Announcing Oracle Jipher 10.37: FIPS 140-3 Cryptography for Java DevFeed: [Announcing Oracle Jipher 10.37: FIPS 140-3 Cryptography for Java]() Original publisher: [Read original article]() Author: Poonam Parhar Published: 2026-08-25T00:00:00Z Content type: release Language: en Sources: [Inside Java]() Topics: [Cryptography](), [fips 140-3](), [openssl](), [Java](), [Encryption](), [Security, Privacy and Abuse Prevention]() Tags: [cryptographic](), [cryptography](), [fips](), [fips-140-3](), [java](), [openssl](), [oracle](), [security](), [standard]() ### AI overview Oracle Jipher 10 packages a FIPS 140-3 validated OpenSSL cryptographic module and exposes cryptographic services through Java Cryptography Architecture (JCA). ### Source excerpt Oracle Jipher 10 packages a FIPS 140-3 validated OpenSSL cryptographic module, making cryptographic services available through the standard Java Cryptography Architecture (JCA) framework. ## Identity Everywhere: Bringing Infrastructure Identity to Agentic IT DevFeed: [Identity Everywhere: Bringing Infrastructure Identity to Agentic IT]() Original publisher: [Read original article]() Author: info@goteleport.com (Peter Bailey, Ev Kontsevoy) Published: 2026-08-25T00:00:00Z Content type: release Language: en Sources: [Teleport]() Topics: [Cisco](), [Security](), [Artificial Intelligence]() Tags: [agentic](), [ai-agents](), [cisco](), [cryptographic](), [identity-management](), [infrastructure](), [partnership](), [security]() ### AI overview Cisco and Teleport announce a strategic partnership involving technology integration, licensing, and investment. The article presents Infrastructure Identity as a cryptographic model intended to connect secure identity with human and machine actions, including activity by workloads, automation, and AI agents. ### Source excerpt Cisco and Teleport are announcing a strategic partnership centered on deep technology integration, licensing, and investment. ## How Google is Making Private AI Practical with Homomorphic Encryption DevFeed: [How Google is Making Private AI Practical with Homomorphic Encryption]() Original publisher: [Read original article]() Author: Jeremy Kun Published: 2026-08-14T14:00:00Z Content type: article Language: en Sources: [Security]() Topics: [Encryption](), [Artificial Intelligence](), [Google](), [AI Inference](), [Compiler](), [Cryptography](), [toolchain](), [Open Source](), [Security](), [Cloud]() Tags: [ai](), [ai-inference](), [cloud](), [cryptographic](), [data](), [encryption](), [google](), [none](), [open-source](), [security](), [toolchain]() ### AI overview Google introduces HEIR, an open-source compiler toolchain designed to make private AI inference practical with homomorphic encryption. The approach lets servers compute on encrypted data and return encrypted results without exposing the underlying information, while addressing the usability challenges of adopting homomorphic encryption. ### Source excerpt heir logo ## What Is a Container Registry and How to Use One DevFeed: [What Is a Container Registry and How to Use One]() Original publisher: [Read original article]() Author: Pramodh Kumar M Published: 2026-08-10T17:48:35Z Content type: tutorial Language: en Sources: [Kubernetes - KodeKloud Blog | DevOps, Cloud, Kubernetes, AI Tutorials & More]() Topics: [container images](), [content addressed store](), [Docker Hub](), [Dockerfile](), [supply-chain-security]() Tags: [base-images](), [cache](), [ci-cd](), [cloud](), [container-images](), [container-registry](), [containers](), [content-addressed-store](), [cryptographic](), [devops](), [docker](), [docker-hub](), [docker-login](), [docker-pull-rate-limits](), [docker-registry](), [harbor](), [image-manifest](), [image-retention-policy](), [image-scanning](), [image-tags-vs-digests](), [kubernetes](), [private-registry](), [pull-through-cache](), [reproducible-builds](), [security](), [supply-chain-security]() ### AI overview This guide explains how container registries store and distribute container images, emphasizing the distinction between mutable tags and immutable content digests. It also covers pushing, pulling, authentication, Docker Hub rate limits, caching, scanning, and retention. ### Source excerpt A tag is a bookmark somebody else can move. A digest is the image itself. Once that distinction lands, reproducible builds, supply chain security, and every it worked yesterday mystery make sense. ## Keleusma Research Spike: What Happens When Error Correction Meets a Signature DevFeed: [Keleusma Research Spike: What Happens When Error Correction Meets a Signature]() Original publisher: [Read original article]() Author: Brendan Sechter Published: 2026-08-10T09:00:00Z Content type: article Language: en Sources: [Brendan A R Sechter's Development Blog]() Topics: [Security, Privacy and Abuse Prevention](), [Cryptography](), [Code](), [Compiler]() Tags: [bytecode](), [compiler](), [compilers](), [cryptographic](), [engineering](), [integrity](), [research](), [security](), [test](), [verification]() ### AI overview This case study examines how combining error correction with cryptographic signatures can create an unsafe verification order. Exhaustive analysis of bit errors shows that some damaged inputs are incorrectly repaired or reported as clean, so a clean correction result does not establish integrity. ### Source excerpt A file carries an error-correcting code so that a flipped bit can be repaired, and a cryptographic signature so that a changed byte is refused. Both are ordinary. Putting them in the same file forces a choice that neither feature announces, and one of the two answers is sound only under an assumption that the error-correcting code exists because it is false. The uncomfortable part is that the two answers are indistinguishable on every input anybody tests. An undamaged file behaves identically under both. They diverge only on damaged input, and damaged input is the case the error-correcting code exists for and the case no test suite exercises, because producing it requires deliberately corrupting your own artefact. Enumerating the fault space of a single 64-bit word exhaustively, rather than sampling it, gives four numbers that decide the design. The space is small enough to enumerate because the number of ways to flip $w$ bits out of 64 is a binomial coefficient, and for $w \le 4$ it stays under a million. \[\binom{64}{1} = 64, \quad \binom{64}{2} = 2{,}016, \quad \binom{64}{3} = 41{,}664, \quad \binom{64}{4} = 635{,}376\] flipped bits patterns repaired exactly wrongly "repaired" invisible 1 64 64 0 0 2 2,016 0 0 0 3 41,664 0 23,364 (56.08%) 0 4 635,376 0 0 5,133 (0.81%) Three flipped bits are reported as a successful repair 56.08 percent of the time, and the repair is wrong every time it happens. Four flipped bits are, 5,133 times, completely invisible, because the code reports the word as clean when the error pattern is itself a valid codeword. The consequence is one sentence, and everything else in this article is either its derivation or its implications. The corrector is not an authority on whether it corrected, and a clean report from it is not evidence of integrity. What this is a case study of The setting is the bytecode format for Keleusma, a language whose value proposition is that a program's worst-case time and memory can be proven before it runs, and wh ## Passkeys in B2B: the real risk is recovery DevFeed: [Passkeys in B2B: the real risk is recovery]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-06T15:29:33Z Content type: article Language: en Sources: [WorkOS Blog]() Topics: [Passkeys](), [WebAuthn](), [Cloud](), [systems]() Tags: [b2b](), [cloud](), [cryptographic](), [phishing](), [recovery]() ### AI overview The article explains why consumer passkey guidance does not fully apply to B2B systems. Although passkeys are phishing-resistant WebAuthn credentials, synced passkeys may reside in employees' personal cloud accounts, creating enrollment, ownership, recovery, and revocation challenges when devices are lost or employees leave. ### Source excerpt Consumer passkey guidance optimizes for the login. In B2B, the enrollment and recovery story is what decides whether passkeys actually work. Here's the gap. ## A few notes on AWS Nitro Enclaves: KMS integration DevFeed: [A few notes on AWS Nitro Enclaves: KMS integration]() Original publisher: [Read original article]() Author: "Paweł Płatek" Published: 2026-08-05T11:00:00Z Content type: article Language: en Sources: [The Trail of Bits Blog](), [The Trail of Bits Blog]() Topics: [Cryptography](), [AWS IAM]() Tags: [application-security](), [aws](), [cryptographic](), [cryptography](), [encryption](), [iam](), [integration](), [policy](), [trusted-execution-environment]() ### AI overview The article examines security and operational risks in integrating AWS Nitro Enclaves with KMS, including attestation, key policies, and encrypted key handling. ### Source excerpt Nitro Enclaves and Key Management Service (KMS) feel like a natural fit: since the KMS can verify attestation documents generated by the enclaves, developers can offload key management tasks from their applications to the AWS-managed service. But integrating an external service with your trusted enclaves comes with new threats, even if that service comes from the same provider. In this blog post--the third in our series on Nitro Enclaves, following our posts on attack surface and images and attestation--we catalog passive and active attack classes against the enclave-KMS communication channel, and cover the operational risks that persist even when the cryptography is correct. Intro to KMS The KMS is an AWS service that provides a unified public API for creating and managing keys backed by HSMs to the broader AWS ecosystem. There are three main key types supported by KMS that devs need to care about: Customer-managed keys (CMK) Data keys (DK, symmetric) Data key pairs (asymmetric) CMKs never leave KMS. You request KMS to perform cryptographic operations (like encryption or signing) for you. Data keys and key pairs are generated in KMS, are not stored in KMS, and are intended for programmatic uses. For symmetric keys, the KMS gives you a plaintext key and the same key encrypted to CMK. Your application performs encryptions, removes the plaintext key, and stores the key encrypted to a CMK along the ciphertexts; this pattern is called envelope encryption. For asymmetric keys, the KMS gives you a plaintext key pair and the private key encrypted to CMK. Your application creates signatures or encrypts data, deletes the private key, and keeps the public key and encrypted private key (along with signatures/ciphertexts). Both types of data keys can be used with Decrypt operation to get plaintext keys again. S t o r a g e s t { o E r _ e d ( k E , _ C d } k , C ) E n c l a v G e e { n d e k C D p r , = e l a E e c a t _ n r i e d c y n D k ( p t a = d t e t e k ( { x a n , c d t ## Engineering the Datadog Agent for FedRAMP High® Certification DevFeed: [Engineering the Datadog Agent for FedRAMP High® Certification]() Original publisher: [Read original article]() Author: Srdjan Grubor; Nathan Baker Published: 2026-07-28T00:00:00Z Content type: article Language: en Sources: [Datadog | The Monitor blog]() Topics: [Cryptography]() Tags: [architecture](), [compliance](), [cryptographic](), [cryptography](), [datadog-agent](), [engineering](), [fedramp](), [go](), [infrastructure](), [logs](), [metrics](), [network-configuration](), [observability](), [python](), [security](), [traces]() ### AI overview The article explains how Datadog engineered its Agent to meet FedRAMP High requirements in customer-managed environments, emphasizing cryptographic enforcement across Go and Python runtimes. ### Source excerpt Datadog achieves GovRAMP High authorization, bringing unified observability and security to state and local government agencies for critical systems. ## Hedge 312: Keys and DNS DevFeed: [Hedge 312: Keys and DNS]() Original publisher: [Read original article]() Author: Russ Published: 2026-07-17T16:16:02Z Content type: article Language: en Sources: [rule 11 reader]() Topics: [Internet]() Tags: [cryptographic](), [hedge](), [internet](), [ip]() ### AI overview A Hedge episode discusses a paper proposing cryptographic keys as the primary host identifier instead of IP addresses, alongside an article about DNS's central role on the Internet. ### Source excerpt The entire technology world has, for decades, treated the IP address as a shorthand host identifier. This is clearly not the way IP was designed, but what are our other choices? In this episode of the Hedge, Scott Robohn joins Russ And Tom to discuss a recent paper arguing cryptographic keys should be the primary host identifier, and another article on the centrality of DNS to the Internet. ## How Teleport Operationalizes the EU Cyber Resilience Act's Secure-by-Design Mandate DevFeed: [How Teleport Operationalizes the EU Cyber Resilience Act's Secure-by-Design Mandate]() Original publisher: [Read original article]() Author: info@goteleport.com (Maximilian Heck, Waldemar Kindler) Published: 2026-07-16T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [cyber resilience act](), [Security](), [Architecture & Design](), [Authentication](), [Encryption](), [audit trail](), [Monitoring & Alerting]() Tags: [audit-trail](), [authentication](), [cra-requirements](), [cryptographic](), [cyber-resilience-act](), [eu](), [monitoring-alerting](), [secure-by-design](), [security]() ### AI overview The article explains how Teleport maps its infrastructure identity, access, policy, logging, monitoring, and audit controls to ENISA's Secure by Design and Default Playbook and the EU Cyber Resilience Act. It highlights cryptographic identity, least privilege, secure communication, supply-chain controls, and default protection of device identities and secrets. ### Source excerpt See how Teleport features map to ENISA's Secure-by-Design specification for CRA. ## Worth Reading 071526 DevFeed: [Worth Reading 071526]() Original publisher: [Read original article]() Author: Russ Published: 2026-07-15T18:56:46Z Content type: article Language: en Sources: [rule 11 reader]() Topics: [Artificial Intelligence](), [Confidential Computing](), [Security](), [Cloud](), [Internet](), [Protocol (disambiguation)]() Tags: [ai](), [ai-assistants](), [china](), [cloud](), [corporate](), [cryptographic](), [europe](), [government](), [innovation](), [models](), [open](), [research](), [security](), [worth-reading]() ### AI overview A curated reading roundup examines failures in corporate AI implementation, the role of AI assistants in shaping access to information, confidential computing and sovereign cloud ambitions in Europe, a possible architectural flaw in a security protocol used to establish cryptographic trust, and strategies emphasizing open models and innovation in competition with China. ### Source excerpt Reports of AI corporate implementation failures have continued to mount over the last year. AI assistants now hand you a single, ready-made answer, and a harder question comes with it: who decides what we get to know, and what never makes it into the reply? Vendors are trying to position "confidential computing" as the technical backbone of Europe's sovereign cloud ambitions. But new research shows that a security protocol used to prove cryptographic trust in the system may have a fundamental architectural flaw. The Internet should stop asking only who was in the room. It should ask who can bind the party bearing the loss. America won't beat China by banning AI. We'll win by building the world's best open models and letting innovation--not government--lead the way. ## Introducing modularized kernel cryptography in Amazon Linux DevFeed: [Introducing modularized kernel cryptography in Amazon Linux]() Original publisher: [Read original article]() Author: Mahak Arora Published: 2026-07-14T19:34:12Z Content type: article Language: en Sources: [AWS Compute Blog]() Topics: [Cryptography]() Tags: [algorithms](), [amazon](), [compliance](), [cryptographic](), [cryptography](), [kernel](), [linux](), [security](), [update](), [updates](), [validation]() ### AI overview Amazon Linux 2023 introduces a standalone FIPS 140-3 cryptographic kernel module. Keeping cryptographic code separate from the main kernel can let unchanged modules carry forward across kernel updates through a streamlined validation process. ### Source excerpt We are introducing modularized kernel cryptography in Amazon Linux 2023, an approach that separates Federal Information Processing Standard (FIPS) 140-3 cryptographic components into an independent kernel module that can be certified once and reused across subsequent kernel versions. In this post, we describe how this modular approach works, what it means for FIPS compliance workflows, [...] ## Deep Dive into SASL PLAIN and SCRAM in Kafka: Login Modules and Config Hot-Reload DevFeed: [Deep Dive into SASL PLAIN and SCRAM in Kafka: Login Modules and Config Hot-Reload]() Original publisher: [Read original article]() Author: Pratul Yadav Published: 2026-07-06T09:43:40Z Content type: article Language: en Sources: [Confluent: Data in motion]() Topics: [Kafka](), [configuration](), [Authentication](), [passwords](), [TLS (Transport Layer Security)]() Tags: [authentication](), [config](), [configuration](), [confluent-platform](), [credential-theft](), [cryptographic](), [deep-dive](), [kafka](), [operational](), [password](), [production](), [tls]() ### AI overview This article explains Kafka authentication with SASL PLAIN and SASL SCRAM, focusing on login modules, credential storage, and configuration hot-reload. It compares their security and operational characteristics and describes how hot-reload enables credential changes without restarting brokers. ### Source excerpt Deep Dive into SASL PLAIN and SCRAM in Kafka: Login Modules and Config Hot-Reload ## Strengthening Snow for the open source community DevFeed: [Strengthening Snow for the open source community]() Original publisher: [Read original article]() Author: info@1password.com (Daryl Martin and Christian Rask) Published: 2026-06-16T00:00:00Z Content type: article Language: en Sources: [Blog on 1Password Blog]() Topics: [open-source-security]() Tags: [building-1password](), [contributors](), [cryptographic](), [developers](), [open-source](), [pull-requests](), [review](), [rust](), [security](), [testing]() ### AI overview 1Password funded and published an independent security assessment of Snow, an open-source Rust implementation of the Noise Protocol Framework. The review found 10 issues; eight, including a nonce-handling flaw and an invalid-PSK panic, have been resolved and validated. ### Source excerpt At 1Password, we regularly invite outside experts to challenge our assumptions and strengthen our security. We encourage security researchers to participate in our bug bounty programs, and have spent years building a collaborative research environment. We also believe in the benefit of open source software and standards, which raise the bar for the industry as a whole, while ultimately benefiting our 1Password customers. That's why we funded an independent security assessment of the open source library Snow, worked closely with the maintainer on remediation, and are making the results publicly available for anyone to review. Where to read the report The results of the independent security assessment are available now for anyone who wants to learn more. Read the report Why we invested in Snow Snow is a Rust implementation of the Noise Protocol Framework, a system for building secure channels using customizable cryptographic handshake patterns based on Diffie-Hellman key exchange. We rely on Noise-protected channels in parts of 1Password. Since Snow gives Rust developers an implementation of that framework, that makes it, for us, part of the security foundation we care about getting right. Funding validation on Snow allows us to improve something we care deeply about while giving back to the open source community that helps make 1Password possible. We are active contributors to Snow. The pull requests we've opened and the independent security assessment we funded reflect our commitment to helping strengthen the project. What Trail of Bits found Trail of Bits reviewed Snow through a combination of manual review and automated testing over four engineer-weeks. Their report identified 10 findings in total: one medium-severity issue, one low-severity issue, and eight informational findings. The most important issue discovered was a nonce-handling bug that could let an attacker permanently disrupt an encrypted channel without knowing any cryptographic secrets. Another findi [Next page]()