Cryptography

The first is the Discrete Logarithm Signature, El Gamal Scheme of 1985, sharpened by Schnorr and taken up by NIST in 1991 as the Digital Signature Algorithm, published as FIPS 186 in 1994.

The second is elliptic curve cryptography, proposed independently by Victor Miller and Neil Koblitz in 1985.

Again discrete logarithm problem, but posed in the group of points of an elliptic curve over a finite field, where the index calculus methods that force multi-thousand bit moduli in Zp, multiplicative group Wolf integers modulo a'p, have no analog.

The best-known attacks against a well-chosen elliptic curve are generic discrete logarithm algorithms, which require roughly SQRT, n, group operations for a group of prime order n.

Thus, a curve whose group has an order, i, e, a number of points, of approximately 2 to the power of 256 provides about 128 bits of security.

An attacker would need roughly 2 to the power of 128 group operations to recover a private key using the best-known classical methods.

The Sheik security level allows elliptic curve cryptography to use relatively short keys and signatures.

ECDSA is the elliptic curve analog of digital signature algorithm, DSA.

That's seven families.

Cryptographic, agent, identity, supply chain, quantum service, control plane, operational and vendor.

Now I want to spend some time on what I think is the most intellectually honest part of the post.

After listing the threats, I say security claims should be bounded.

In the new environment, add cryptographic identity, artifact provenance, runtime posture, attestation, the model and configuration version, and job metadata.

The guidance, use this contextual evidence, but define its limits and its freshness.

Cryptographic risk.

Classically, the question is current algorithm strength and key lifecycle.

These methods can work together.

Cryptographically signed content credentials can record where a file originated and what changes were made to it.

This creates a type of digital history for the content.

A hidden watermark can serve as a link back to that history if the attached metadata is stripped away.

The specific action.

Okay, so how do they prove that without making me scan my face a hundred times a day? Through what we call being cryptographically bound.

Cryptographically bound.

Right.

Think of it like a digital wax seal on a very specific set of instructions.

But obviously, we need to know, what are we testing for? And this is where those security weakness enumerations come in.

And at a high level, they're organizing things that do actually make sense for mobile apps that are maybe areas that are a bit more unique to mobile apps than generic APIs, web apps, things about Cryptography, the use of that is pretty standard, but it has some nuances within mobile.

Same with storage.

I think mobile has a bit more interesting storage story behind it.

Like, math underpins a lot of what happens in, say, our banking system, our computer systems, our cybersecurity.

Cryptography, which is kind of based on math in many cases, is what protects our secrets.

It's what protects government secrets.

And so there is a potential interesting angle here that I haven't seen discussed about how mathpocalypse matters for the risk of future cybersecurity issues and even for the security of our financial system, which is kind of important.

Everything's just math.

Yeah.

Cryptography is math.

It's all around us.

Next, establish a weight signing policy.

Cryptographically sign all model weights.

It creates a chain of trust.

The signing authority can integrate with existing identity and access management.

Identify its source and weight status.

Then establish a weight signing policy.

Cryptographically sign each model weight.

That creates a verifiable chain of trust.

Federal agencies must prepare for a significant shift in cybersecurity as they continue their modernization efforts, which is the transition to post-quantum cryptography, or PQC.

Even though practical quantum computers may still be years away, agencies are evaluating their cryptographic readiness because of evolving federal mandates and emerging threats, such as harvest-now-decrypt-later attacks.

In this episode of the Government Technology Insider podcast, Jim Westdorp, who's a principal technologist at Ciena Government Solutions, and LaMont Copeland, who's a senior director of Public Sector Solutions Architecture at Verizon, discuss the approaching twenty-twenty-seven and twenty-thirty PQC deadlines, the importance of crypto agility, and how agencies can make infrastructure investments that support current security requirements and future quantum-resisting capabilities.

I hope you enjoy our conversation today.

And welcome LaMont and Jim.

It's not upon us yet, but we believe it's coming and, and you really can't delay, um, acting on it.

Yeah, and that plays very well into the investments question.

So really, how can agencies ensure that the, uh, infrastructure investments they make today remain viable as the PQC requirements evolve? And really, why is crypto agility critical to that effort? And, uh, we'll stick with Jim on that one.