OpenSSH 10.4 release notes: stricter KEX, SFTP/SCP fixes, and an experimental ML-DSA 44 + Ed25519 composite signature.

Can your negotiation bot's concessions, timing, and convergence leak hidden constraints? This paper formalizes that and randomizes around...

IETF TLS last-call thread on ML-KEM in TLS, with the usual calls for actual attacks and less hand-waving.

3PaaS adds post-compromise security via a third party, with unlinkable identities, revocation, and ZK blind-signature proofs.

IETF's PQC engineer guide, covering NIST/ISO algorithms, hybrids, protocol fallout, and the usual key-size pain.

Six bugs and a heap UAF in proprietary proximity transfer, courtesy of reverse engineering and protocol-aware fuzzing.

arXiv paper on Web4 agent wallets, payments, and API use, with logs and GitHub issues to map the usual auth/payment mess.

What did djb think the NSA got the IETF to ship, and why are we still pretending standards bodies are neutral?

Need a Rust MPC toolkit where the same protocol runs in simulation or over mTLS? This repo does that, for research.

Auto-generates Tamarin models from a DSL and ties them back to code, because hand-writing protocol proofs was still too pleasant.

Hamster tweaks rotating-leader BFT with exclusivity certificates and overlapping rounds, shaving latency off the usual slog.

1kx revisits its old 'cost of trust' thesis with two buckets, rent compression and zero-to-one enablement, to sort winners and losers.

Private Record Certification revokes anonymous credentials at billion-scale with sub-second latency, because privacy loves paperwork.

Can OMR beat PIR in practice? UnifOMR says yes, with batch PIR inside and the usual digest/round tax.

CMoSS gives modular crypto-protocol specs for composing black-box subprotocols, with separate predicates for models and goals.