cryptography

A new cryptography paper describes a method for forging 1024-bit RSA signatures in time close to that of the Special Number Field Sieve, the fastest known factoring algorithm. If the results hold up, they could undermine RSA keys of this size, which are still used in some legacy systems. Security researchers are likely to examine the claims and discuss whether 1024-bit RSA should now be considered practically breakable.

A new essay on the Cryptography Engineering blog asks whether sandboxing is sufficient to contain rogue autonomous AI agents. The piece examines whether technical isolation can really restrain software agents that misbehave or act beyond their intended goals. Readers are debating the limits of sandboxing as a safety measure as AI agents are deployed more widely.

Cloudflare announced on Tuesday that it plans to issue quantum-proof TLS certificates, becoming one of the first certificate authorities to adopt cryptography designed to withstand attacks from quantum computers. The move addresses fears that future quantum machines could break today's encryption, exposing data collected now and decrypted later. Observers see it as a significant step in the industry's transition to post-quantum security.

Shor's algorithm, a quantum algorithm for finding the prime factors of an integer, was developed in 1994 by American mathematician Peter Shor. Its theoretical existence has driven a global shift toward post-quantum cryptography, as a sufficiently powerful quantum computer running it could break widely used encryption methods such as RSA that protect much of today's digital communication.

A technology chief executive has publicly warned that advances in quantum computing could eventually threaten the encryption underpinning Bitcoin, raising concerns about the security of the cryptocurrency. The warning has fuelled broader debate about how prepared crypto networks are for quantum-era attacks and whether a transition to post-quantum cryptography is needed.

Developers are being reminded that most cryptographic code running in modern programs was written by someone else, usually in third-party libraries. A cryptography inventory that only lists lines in a project's own source misses these dependencies. The argument is that proper audits must name the actual module providing each cryptographic function, a point seen as increasingly important for fintech and security-sensitive software.