cryptographers

Cryptographer Matthew Green has warned that we might lose public key cryptography, the mathematical foundation securing most internet communications, including HTTPS, messaging and digital signatures. The remark, shared on Twitter, has drawn attention in technology circles, with readers debating what developments could threaten these systems and how urgently alternatives would need to be found if they fail.

An Ethereum researcher is calling on the cryptocurrency community to enter what he terms 'bunker mode', warning that advances in AI could threaten the mathematical assumptions underpinning cryptographic systems. The appeal has drawn attention across the crypto sector, with debate over whether current encryption and blockchain defenses are adequately prepared for AI-driven mathematical breakthroughs.

Johns Hopkins cryptographer Matthew Green says he thinks "we might lose public key cryptography," the mathematical foundation securing most internet communications, from HTTPS to messaging apps. His warning points to the threat posed by advancing quantum computers capable of breaking today's public key systems, a risk driving the ongoing migration to post-quantum encryption standards.

Cloudflare is warning that the root zone key signing key for the DNS system will be rolled over on October 11, an operation often described as changing the keys of the internet. The rollover updates the cryptographic trust anchor that validates DNS responses worldwide. Operators are advised to update their resolvers in time to avoid validation failures.

PowerDNS has published a piece on preparing DNSSEC, the system that cryptographically authenticates DNS responses, for post-quantum cryptography. The move anticipates future quantum computers capable of breaking today's public-key algorithms, and outlines what migrating DNS signing and validation to quantum-resistant schemes would involve for operators. Interest is concentrated among infrastructure and security engineers weighing the coming transition.

A policy analysis outlines how operators of operational technology, such as industrial control systems and critical infrastructure, can prepare for post-quantum cryptography migration. It argues organizations should start inventorying cryptographic assets and planning transitions now, since quantum-capable computers could eventually break widely used encryption protecting legacy systems that are difficult to upgrade.

A Bitcoin Core developer has publicly responded to concerns that artificial intelligence and quantum computing could threaten Bitcoin's security. The remarks, published by Bitcoin Magazine, come amid growing debate in the crypto community over whether advances in quantum computing could eventually break the cryptography underpinning Bitcoin wallets, and whether AI accelerates that timeline.

More than 6 million bitcoin are held in addresses with exposed public keys, meaning their cryptographic details are visible and potentially vulnerable as computing power advances. The figure is drawing renewed attention alongside growing warnings about artificial intelligence accelerating threats to cryptocurrency security. Commenters in the crypto community are debating how many coins could realistically be at risk and what holders should do to move funds to safer address types.

The Internet's root cryptographic trust keys are scheduled to change on October 11. The change is expected to affect how network operators and service providers handle DNSSEC trust anchors, and technical communities are urging administrators to check their systems are prepared before the date to avoid outages or resolution failures.

Jameson Lopp, co-founder and CTO of bitcoin security firm Casa, says fears that AI will soon break Bitcoin's cryptography distract from the actual risk: implementation errors in wallets, apps and firmware. He notes that not a single key has been compromised, arguing the debate over hypothetical AI-powered cryptographic attacks is overshadowing practical security failures that cause real losses today.

A new open-source tool called PQC Triage lets developers paste a software dependency manifest and instantly see which cryptographic algorithms in their stack a quantum computer could break first. The tool aims to help teams prioritise migration to post-quantum cryptography as quantum computing advances. Discussion so far has been small but focused on its usefulness for security auditing and codebase triage.

Donald Trump has announced a $215 million initiative aimed at advancing quantum computing, a move that comes as fears mount over quantum computers' potential to break Bitcoin's cryptographic security. The announcement has drawn attention from the cryptocurrency community, where concern is growing that sufficiently powerful quantum machines could one day compromise Bitcoin's underlying technology.

Europol is stressing that organisations should pursue crypto-agility proactively, designing systems that can quickly swap cryptographic algorithms as new threats emerge while staying secure. The warning fits ongoing concern that quantum computing and other advances could break today's encryption, leaving unprepared systems exposed. Security professionals are amplifying the message, arguing that retrofitting cryptography after an attack or breakthrough is far costlier than building flexibility in now.

A newly updated vulnerability advisory, EUVD-2026-95241, flags IBM Guardium Data Protection 12.2 with a high severity rating of 8.4 out of 10 under CVSS v3.1. The flaw stems from weak cryptographic protection and a hard-coded recovery key in the pkcrypto passkey component, exploitable by a local attacker. Administrators running Guardium are urged to review the advisory and apply vendor patches.

wolfSSL announced that OpenSSH is now FIPS 140-3 tested and available when built with its wolfCrypt FIPS cryptographic module. This allows organizations with US federal compliance requirements to run the widely used secure shell implementation under FIPS 140-3 validated cryptography, replacing older FIPS 140-2 dependencies.

A newly catalogued vulnerability, EUVD-2026-95263, affects TP-Link's Tapo S505 smart plug running firmware version 1.6. The device stores cryptographic material in plaintext in nonvolatile storage, meaning an attacker with physical access to the device could extract sensitive security credentials. The flaw carries a moderate severity score of 5.4 out of 10 under CVSS v3.1. The advisory was updated in October 2026.

wolfSSL announced that post-quantum cryptography support is coming to its Ada language wrapper, extending quantum-resistant algorithms to developers building security-critical applications in Ada. The update reflects the broader industry shift toward migrating TLS and cryptographic libraries ahead of expected quantum computing threats to current encryption standards.

Meta's engineering team has detailed its adoption of NTS, or Network Time Security, an extension of NTP that cryptographically authenticates time synchronization. The move protects Meta's servers from time spoofing attacks, which could undermine security features like certificates and authentication. Meta says accurate, trusted time is critical infrastructure for its global services.

Tech commentators are revisiting a recurring debate over AI-content detection tools, which keep failing as generative models improve. The latest argument: stop trying to detect AI-generated text and images after the fact, and instead cryptographically sign AI output at the source so its origin can be verified. Critics say detectors are unreliable and easily evaded, while provenance-based approaches like content credentials offer a more durable fix.

The HashSmash Challenge is testing whether cryptographic hashes can withstand AI-driven attacks, drawing attention from security researchers and enthusiasts. Participants are exploring how machine learning tools fare against established hashing methods, sparking debate about whether current cryptographic standards remain robust as AI capabilities advance.

Security researcher David Buchanan, known online as Retr0id, has published a blog post describing how to hack time within C2PA, the content-credentials standard used to cryptographically attest when and how media was created. The write-up details weaknesses that let signed provenance metadata carry misleading timestamps, raising fresh doubts about the standard's reliability for verifying authentic photos and videos.

An online mathematics project is assigning a SHA-256 hash to each of 5,000 integer sequences decomposed into a unique weight × level + jump form, verifying the decomposition at every deployment. Primes are among the sequences given cryptographic fingerprints, with Claude assisting in generating and checking the hashes, a hybrid of number theory and software integrity practice.

The Guardian reports new research into the Voynich manuscript, the medieval text that has baffled linguists and cryptographers for centuries, suggesting some of its pages were bound in the wrong order and may have been read incorrectly all along. The finding has reignited debate among historians and enthusiasts about whether a fresh look at the sequencing could finally yield clues to the manuscript's undeciphered script and origins.

wolfSSL announced that OpenLDAP is now available with FIPS 140-3 tested cryptography through its wolfCrypt FIPS module. The move means organizations with US federal compliance requirements can deploy the popular open-source LDAP directory while meeting FIPS standards for cryptographic modules. The announcement is being shared in security and cryptography circles, where interest centers on what this means for government and regulated-industry deployments of OpenLDAP.

Commentary circulating in developer and crypto circles argues that NVIDIA's attestation capabilities change how compute work can be verified. The piece, tagged around AI, MCP and blockchain, frames 'compute settlement against proof' as a new question for anyone building systems that must trust remote hardware. Readers appear to be debating whether hardware-level attestation can replace economic or cryptographic proofs of computation.

Security researcher David Buchanan has published a write-up describing how the C2PA content-provenance standard can be manipulated to forge or misrepresent timestamps, in a piece he calls "How to Hack Time, With C2PA". The post covers cryptographic weaknesses in how signed time claims are handled, sparking discussion among security and cryptography practitioners about the reliability of provenance metadata in media authentication.

Open-source cryptographic libraries are being highlighted as a key resource for digital investigations and cybersecurity work. The topic sits at the intersection of OSINT, cybercrime research and AI-assisted analysis, with commentators framing accessible crypto tooling as important for online investigators examining encrypted material. Interest reflects broader debate about how open security tools are used by both defenders and criminals.

A new vulnerability, CVE-2026-71887, has been disclosed affecting the Legion of the Bouncy Castle cryptography library for Java. The flaw is classed as CWE-347, improper verification of cryptographic signature, meaning the library may accept signatures it should reject. Security researchers are sharing the advisory and tracking potential impact on Java applications relying on the widely used library.