GoKawiil
Tech News
A team including UC San Diego professor Nadia Heninger published research describing a new classical-computing attack that forges RSA signatures without factoring the underlying keys. The method reportedly cracked deprecated 1024-bit RSA keys in a few months using an academic CPU cluster, far less effort than factoring would require, and it also degrades the theoretical security of 2048- and 4096-bit keys.
Cloudflare launched Automatic Key Exchange, a feature that probes origin servers to detect which key agreement algorithms they support before committing to one, rather than always guessing X25519 as before. This measurement-based approach reduced HelloRetryRequest occurrences from about 52% to 3.7% and cut roughly 150ms off connection latency at the 90th percentile, while also enabling post-quantum key exchange (X25519MLKEM768) automatically wherever origins support it.
Bernstein's cr.yp.to blog post argues that switching protocols entirely to post-quantum (PQ) cryptography, rather than combining it with existing ECC, creates unnecessary security risk. He contends that PQ implementations will inevitably contain exploitable bugs, and keeping ECC alongside PQ limits the damage those flaws can cause, at minimal extra cost.