CT-Monitor++: Improving the Certificate Transparency Ecosystem with Cryptographic and Security Checks

Hidden Ciphers and Where to Find Them: Static Discovery and Assessment of Cryptographic Assets in Software

Modern software systems rely on cryptography for data protection, authentication, and trust establishment, yet organizations often lack a structured view of the cryptography deployed across source code, configuration, dependencies, and cryptographic files. This lack of visibility complicates security governance and post-quantum migration planning. This paper presents a static approach for discovering and assessing cryptographic assets in software systems. We introduce a classification of Crypto-Material, Crypto-Artifacts, and Crypto-Invocations, derive an extensible scanner-independent rule repository from it, and implement a static scanner that applies these rules to produce CBOM-oriented output. We evaluate the approach on a synthetic benchmark with known ground truth and on a real-world infrastructure of ten deployed services. The scanner achieves an F1 score of 0.75 for asset discovery and correctly annotates 91% of expected weaknesses and vulnerabilities. In the realworld setting, it processes 57 610 files in under six minutes and discovers 370 cryptographic assets, including six CVE-linked vulnerabilities and 52 post-quantum migration candidates. Real-world coverage is assessed against a manually compiled reference list rather than an exhaustive one. These results show that classification-driven static discovery can provide practical cryptographic transparency for governance and post-quantum migration planning.

Improving the Security of Containerized Workloads using Transparency and Traceability Services

Containerized workloads are commonly built via CI/CD pipelines, stored in registries, and executed across heterogeneous infrastructures, including cloud and edge environments. A single compromised build step or credential can turn routine automation into large-scale distribution of malicious artifacts, motivating integrity, transparency, and enforceable deployment-time checks. In this paper, we present an architecture for verifiable container image distribution that addresses key-management challenges and enables policy-enforced admission-time verification. A transparency service generates one-time signing keys bound to authenticated identities, records signing events in an append-only transparency registry, and returns cryptographically verifiable proofs of inclusion. These proofs and identity attributes are attached to image metadata and evaluated by policy-as-code at admission time, so only compliant artifacts are deployed. We implement a proof-of-concept integrated with GitHub Actions and GitLab Runners and evaluate how the resulting pipeline mitigates common supply-chain attacks under a realistic threat model.

A cryptographically verified approach to secure Docker container updates in CI/CD pipelines

Automated formal verification of secure aggregation protocols

Confidential Key Management as a Service: Enhancing Availability and Isolation in Key Protection

: Key management is paramount to security concerns in cloud system. Key protection is vital to avoid data breaches due to the inadvertent or intentional disclosure of cryptographic keys. Hardware security modules (HSM) have been considered as a trustworthy entity to store keys and certificates. However, the systems using HSMs are difficult to achieve scalability because of the heavy workload of cryptographic operations, as well as the cost of the dedicated hardware. Based on the idea of key isolation by HSM, we introduce a confidential software-based HSM ( ccHSM ) designed to provide strong isolation and scalable key management without the need for dedicated hardware. ccHSM delivers cryptographic operations and secure secret storage to cloud-native services throughout lifecycle. To enable this, ccHSM adopts Intel SGX for a trusted execution environment and implementation of HSM features, PKCS#11-compliant key management. Furthermore, ccHSM is able to establish a secure, intra-host PKCS#11 communication with the target application to ensure low-latency and tamper-resistant interaction. Finally, we apply ccHSM for TLS key offloading, JSON Web Token authentication. Our evaluation shows that ccHSM doesn’t suffer substantial performance trade-offs while significantly reducing cost relative to conventional hardware and cloud-based solutions.

A Systematic Review of Java Security: Architecture, Cryptographic Services, Vulnerabilities, and Emerging Security Paradigms

ava continues to play a significant role in the development of enterprise software, mobile applications, and embedded solutions because of its portability, reliability, and extensive security capabilities. This review investigates the security ecosystem of the Java platform by examining both its built-in protection mechanisms and the security challenges faced by modern Java applications. The study begins with an analysis of the fundamental components of Java’s security model, including the Java Virtual Machine (JVM), bytecode validation processes, class-loading mechanisms, and the Security Manager, whose role has diminished in recent Java releases. In addition, the review discusses the Java Cryptography Architecture (JCA), emphasizing its support for widely used security technologies such as the Advanced Encryption Standard (AES), Rivest–Shamir–Adleman (RSA) encryption, SHA-256 hashing, secure random number generation, and Transport Layer Security (TLS) protocols for protected communication. The paper further investigates common vulnerabilities observed in Java-based systems. Particular attention is given to issues such as SQL injection, unsafe deserialization practices, misuse of reflection, exposure of hard-coded credentials, and reliance on outdated cryptographic algorithms. The causes of these weaknesses, their potential consequences, and recommended countermeasures are examined with reference to established security standards and current academic research. In addition, the review outlines key secure software development practices that can strengthen application security. These include parameterized database queries, rigorous input validation and sanitization techniques, adherence to the principle of least privilege, and systematic management of third-party libraries and dependencies throughout the software lifecycle. The paper also discusses recent developments shaping the future of Java security. Topics include the gradual retirement of the Security Manager, the increasing importance of the Java Platform Module System (JPMS) for application modularization and isolation, security considerations in cloud-native deployments, and the growing application of artificial intelligence for automated vulnerability identification and threat analysis. By consolidating findings from contemporary literature, these reviews offers insights into Java’s evolving security landscape and presents practical guidance for building resilient and secure Java applications.