Leon Acosta
Company strategy, enterprise engagements, partnerships, and standards-body and ISO alignment.
IETF tightens KEM-only authentication for LAKE
Revision 01 of the IETF LAKE authentication draft specifies a five-message, three-secret KEM handshake for constrained systems and tightens the rules around key binding, freshness and when authentication completes.
IETF holds standalone ML-KEM TLS draft for review
The RFC Editor has paused the standalone ML-KEM-for-TLS draft while IETF process complaints are reviewed. The hold delays publication but does not revoke hybrid RFC 10024 or establish a cryptographic flaw.
OpenSSL 4.1 beta speeds ML-KEM and ML-DSA
OpenSSL 4.1.0-beta1 adds architecture-specific ML-KEM and ML-DSA paths for Power, IBM Z and x86-64, moving PQC performance testing from generic support claims to real CPU fleets.
IETF draft brings post-quantum crypto to EAP-TLS
A new standards-track IETF draft applies post-quantum TLS to EAP-TLS, EAP-TTLS, PEAP and TEAP, while confronting the certificate-size problem that enterprise authentication cannot ignore.
oqs-provider 0.12.0-rc2 fixes key-handling bugs
The new oqs-provider release candidate packages fixes for use-after-free, hybrid-key length validation, RSA reconstruction overflow, and allocation cleanup.
How to test hybrid post-quantum TLS end to end
A practical four-pass method for proving that hybrid TLS was negotiated across the real network path, without confusing support with evidence.
Java 27 puts hybrid post-quantum TLS on the default path
Java 27 adds hybrid ML-KEM key exchange to TLS 1.3 by default, changes ML-KEM and ML-DSA private-key encodings, and speeds both algorithms on AVX-512 systems.
Cloudflare brings ML-DSA validation to DNSSEC
Cloudflare's 1.1.1.1 now validates ML-DSA DNSSEC signatures. Larger responses and downgrade protection show why the trust chain still matters.
The quantum claim that put lattice security in question
A quantum algorithm raised an unsettling question about lattice security. Twelve days later came a refutation. Here is what failed, and why it is a relief.
Go 1.27 puts ML-DSA into TLS and X.509
Go 1.27 brings ML-DSA signatures to X.509 and TLS 1.3. What Go teams can use now, how FIPS module support differs, and what to test.