Insights that help security teams make better decisions.

The official CNSA 2.0 timeline from NSA and CNSSP 15: new acquisitions from 1 January 2027, phase-out by 2030, CNSA 2.0 mandated by 2031.

Hybrid post-quantum TLS explained: how X25519MLKEM768 works, RFC 10024 groups and sizes, browser and server support, how to enable and test it.

Post-quantum code signing explained: LMS, XMSS, ML-DSA and SLH-DSA compared, CNSA 2.0 rules, state management and a migration plan for firmware.

How DuoKey uses Securosys Primus HSM and CloudHSM as a key backend: Microsoft 365 DKE, PQC keys in hardware, PKCS#11. When to combine the two.

How threshold cryptography protects keys: t-of-n shares, signing without rebuilding the key, the key lifecycle, NIST's threshold work and when to use it.

How HashiCorp Vault auto-unseal with an HSM works: the PKCS#11 seal, Enterprise requirement, recovery keys, seal wrap, and an HSM-free option using MPC.

Post-quantum cryptography explained: why RSA and ECC break, FIPS 203, 204 and 205 compared, hybrid mode, deadlines to 2035 and where to start.

Secure code signing in 2026: keep signing keys in an HSM or vault, sign Authenticode, JAR, Git commits, container images and firmware remotely, under approval.

EST vs SCEP vs CMP (and ACME) for device certificates: how each protocol enrolls, renews and revokes, where it fits in factory provisioning, and how to choose.