Loading story…
Neodyme built a proof-of-concept FIDO2 hardware authenticator that replaces the conventional elliptic-curve or RSA signatures used in WebAuthn/FIDO deployments with SPHINCS+, a hash-based post-quantum signature scheme. The prototype was implemented on a Nordic nRF52840 Cortex-M4 device using the OpenSK FIDO2 firmware and targets the WebAuthn/FIDO2 ecosystem defined by the W3C Web Authentication standard.
The researchers said they adapted SPHINCS+ for the FIDO2 use case by reducing the allowed-signatures-per-key parameter q, which helped signatures fit within CTAP2 frame-size limits and improved signing performance. In benchmarking, the design slightly outperformed Google’s Dilithium-hybrid FIDO2 hardware-key approach for MakeCredential and, in several configurations, GetAssertion, while avoiding hybrid cryptography; Neodyme stressed that the token remains a research prototype and is not production-ready.
Track how attackers are adapting to this technology.
1 event from the most recent confirmed update back to the earliest known activity.
Neodyme published a blog post describing a proof-of-concept FIDO2 hardware authenticator built on OpenSK and a Nordic nRF52840 that uses the SPHINCS+ post-quantum signature scheme. The write-up says the team tuned parameters for CTAP2 constraints and benchmarked the design against Google's Dilithium-hybrid approach, while noting it is not production-ready.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Recent developments in post-quantum cryptography are addressing the growing threat posed by quantum computers to traditional digital signatures and encrypted communications. The National Institute of Standards and Technology (NIST) has approved new post-quantum digital signature algorithms, such as ML-DSA (FIPS 204) and SLH-DSA (FIPS 205), to replace vulnerable mechanisms like RSA and elliptic curve signatures. These algorithms are designed to ensure the integrity and authenticity of digital documents and communications, even in the face of future quantum attacks. The focus on hybrid key exchanges, such as X25519MLKEM, is also gaining traction to mitigate "harvest now, decrypt later" (HNDL) threats, where adversaries collect encrypted data today to decrypt it once quantum capabilities become available. In parallel, industry innovation is bringing quantum-resistant technologies into operational environments. Forward Edge-AI has delivered its Isidore Quantum One-Way Data Diode to National Central University in Taiwan, marking a significant step in quantum-safe data protection for critical infrastructure. This device uniquely combines unidirectional data flow with NIST-approved post-quantum encryption (AES-256 GCM and ML-KEM), addressing the limitations of traditional data diodes that lack encryption and are vulnerable to HNDL attacks. The Isidore Quantum solution also offers deployment flexibility across both fiber and copper networks, reducing costs and accelerating adoption of quantum-safe communications.
Jun 29, 2026
Microsoft has begun rolling out support for syncing passkeys across Windows devices and its Edge browser, addressing a key barrier to widespread adoption of passwordless authentication. This phased rollout starts with Edge on Windows 10 and 11, with plans to expand to iOS, Android, and MacOS, aiming to make passkey management seamless for users and organizations. The move is expected to accelerate the shift away from traditional passwords, leveraging the FIDO Alliance's non-phishable passkey standard to enhance security and usability across platforms. Industry experts highlight that passwordless authentication is not just a technological upgrade but a critical component in modern fraud prevention strategies. As organizations transition to passkeys and device-based authentication, they face challenges such as cross-device access and user education. Integrating behavioral analytics with passwordless systems is seen as essential for detecting sophisticated fraud attempts, including those involving AI-driven identity spoofing and deepfakes, ensuring both external and internal threats are mitigated effectively.
Jul 12, 2026
The Cryptographic Community Specification Project (**C2SP**) published a specification for **post-quantum algorithms for HTTP Message Signatures**, extending the ecosystem around `RFC 9421` as organizations prepare for cryptographic migration. The work builds on the existing HTTP Message Signatures standard, which defines how clients and servers sign HTTP request and response components such as `@method`, `@path`, `@status`, `content-digest`, and related fields to provide integrity and authenticity across web transactions. The new specification appears alongside established Internet standards that underpin interoperable message signing and encoding, including `RFC 4648` for Base16/Base32/Base64 encodings and the RFC convention language defined in **BCP 14**. Together, these references show the HTTP signing framework expanding from classical algorithms such as RSA, ECDSA, Ed25519, and HMAC toward post-quantum options, giving implementers a path to preserve signed HTTP exchanges against future quantum-era cryptographic threats.
Aug 11, 2026