Root Causes 681: The Basis for Cryptographic Agility

In this episode about the key compromise at the public certificate authority eMudhra and its exit from the WebPKI, Jason and Tim discuss how a researcher found intermediate CA keys with only one byte of entropy and what eMudhra's incident report says went wrong. They walk through the move of keys between hardware security modules (HSMs), the scripting error that replaced the original keys outside the HSMs' safeguards, and the tighter key generation rules Tim expects from the CA/Browser Forum, and why, unlike with Heartbleed, no subscriber can know whether an attack already took place. Clarification: eMudhra's incident report lists 16 affected intermediate CAs. Eight of them, the elliptic curve (ECDSA P-384) keys, had only one byte of entropy, not all 16 as said in the episode. Jason Soroko on LinkedIn https://www.linkedin.com/in/jason-soroko-19b41920/

In this episode about Tim's move from Sectigo to Microsoft, Jason and Tim discuss why Microsoft runs a public certificate authority strictly for its own use, and what Tim's new compliance role there involves. They cover the scale of Microsoft's footprint (roughly 5% of the world's public servers, by Tim's estimate), compare Amazon, Google and GoDaddy running their own CAs, explain why the job is narrower than at a commercial CA yet faces the same Merkle Tree Certificates (MTCs), post-quantum cryptography (PQC) and shorter certificate lifespans, and confirm that Root Causes continues. Jason Soroko on LinkedIn https://www.linkedin.com/in/jason-soroko-19b41920/

In this episode about Merkle trees and cryptographic mirrors, Jason and Tim discuss Jason's hands-on experiment building an RFC-compliant Merkle tree to log autonomous AI actions and keep AI systems tamper-evident. They explain how binary hash pairing works from leaf events up to the root hash, uncover how an attacker or misaligned agent could silently prune unpaired trailing branches without invalidating the root math, and show why independent mirrors run by CAs, browsers, and infrastructure providers are essential to Merkle Tree Certificates (MTCs).

In this episode about the security risks of treating a phone number as an identity, Jason and Tim discuss why a telephone number is merely a routing label for potential reachability rather than a proof of who is on the other end. They examine how silent SIM-swapping attacks, three-line mobile SMS redirection malware, low-entropy knowledge-based verification questions, and AI voice cloning render telephone-based authentication and SMS OTPs below an acceptable security threshold.

In this episode about certificate agility, Jason and Tim discuss what it takes to replace any or all digital certificates across an organization rapidly and reliably. They explain why browser root programs are driving shortened certificate lifespans (down to 47 days) and deprecating public clientAuth certificates as a forcing function for automation, why public WebPKI rules exist to protect everyday internet users, and how visibility and Certificate Lifecycle Management (CLM) prepare enterprises for revocations, key compromises, and post-quantum transitions.

In this episode about "Turducken" (post-quantum opt-out) certificates and WebPKI downgrade attacks, Jason and Tim discuss why trusting even a single classical Certificate Authority leaves the entire web vulnerable to a cryptographically relevant quantum computer. They explain how wrapping classical RSA or ECC keys inside an ML-DSA post-quantum CA signature prevents global downgrade attacks during the transition to Merkle Tree Certificates (MTCs), and walk through the 2027–2028 browser root store roadmap from Chrome and Apple.

In this episode, Jason and Tim discuss the recent compromise of DNS for several country-code top-level domains, including .gh (Ghana), .sl (Sierra Leone) and .as (American Samoa), which made domain control validation untrustworthy for every domain under them. Chrome blocked the unauthorized certificates that were found, thanks to certificate transparency logs, though it could not guarantee it found every affected domain. We explain why CAA records could not help, since CAA lives in the same DNS that the attacker controlled, how this relates to multi-perspective issuance corroboration, and the two takeaways: protect your DNS settings at all costs and watch the CT logs.

In this episode, Jason and Tim start from the P versus NP question and use a Sudoku puzzle to show the difference between problems that are easy to check and hard to solve. We discuss why RSA and ECC, which rest on factorization, fall to Shor's algorithm and the quantum Fourier transform, and why lattice-based post-quantum algorithms such as ML-DSA were chosen. Because it is impossible to know which hard problem will survive AI-accelerated cryptanalysis, we make the case that cryptographic agility is essential. We also cover NIST's push for math diversity beyond lattices, and Apple's proposed Merkle Tree Certificate root program including SLH-DSA, so that MTCs can act as an abstraction layer that makes swapping algorithms practical.

In this episode, Tim and Jason revisit the "Bugzilla bloodbath," the surge of public CA compliance incidents on Mozilla's Bugzilla, which has become the official WebPKI incident reporting platform. A normal year brings around 100 bugs, but there are now 138 open at once and several hundred opened this year. Almost all are reported by third parties, which suggests security researchers are using AI-assisted automation to scour public CA behavior in CT logs, CPS documents and root hierarchies. We discuss why the volume is a healthy sign of the system working as designed, why finding these issues before attackers do is a good thing, and why we hope the backlog will eventually run out and return to normal levels.

As the WebPKI drives toward a Merkle Tree architecture for post quantum cryptography, we have seen a significant development. Google Chrome has announced its preliminary intention, as early as 2028, to remove all non-MTC CAs from its traditional root store. We give you the details.