cryptography

Developers are being reminded that most cryptography in modern software comes from third-party libraries rather than their own code, so a cryptographic inventory is only useful if it identifies the module responsible. The argument, circulating among software and fintech engineers, is that scans which stop at individual lines of code miss where the cryptography actually lives and leave teams unable to audit or upgrade their dependencies properly.

A discussion on the Infosec Exchange forum centers on whether memory-hardness in cryptographic functions can be mathematically proven to be irreversible. The opening post asks whether such a proof exists, prompting responses about the theoretical limits of memory-hard functions like those used in password hashing, and whether adversaries could ever bypass their memory costs.

Cloudflare announced Tuesday that it plans to issue quantum-proof TLS certificates, becoming one of the first certificate authorities to use cryptographic methods widely believed to withstand attacks from future quantum computers. The move is seen as an early step toward protecting encrypted web traffic from the anticipated threat that quantum computing poses to today's public-key cryptography.

A technology chief executive has warned that advances in quantum computing could eventually threaten the encryption that secures Bitcoin, raising concerns about the safety of holdings on the world's largest cryptocurrency. The claim has fueled ongoing debate about whether blockchain networks need quantum-resistant cryptography and how soon such a threat could realistically materialize.

wolfSSL announced that its wolfCOSE library now supports COSE HPKE encryption, combining the CBOR Object Signing and Encryption standard with Hybrid Public Key Encryption. The company positions the update as strengthening lightweight, standards-based cryptography for embedded and IoT devices that use wolfSSL products.