Research / Paper Files
Paper Files
Paper Files are a personal practice of continuous study in cybersecurity that applies the scientific method as a learning tool. Each article is written not for academic publication, but as a deliberate exercise to sharpen the axe — deepening knowledge on specific topics, organizing ideas with rigor, and observing how understanding of certain subjects develops over time. It is the intellectual equivalent of a training journal: each entry records what was studied, how it was analyzed, and what conclusions emerged.
I strongly recommend that security professionals adopt this method. Choose a topic you want to master, research primary sources (RFCs, papers, official documentation), structure your text with introduction, methodology, analysis, and conclusion, and write as if you were explaining to a colleague. The act of writing forces clarity of thought and exposes gaps in understanding that passive reading cannot reveal. Use the articles on this site as examples of format and depth, and build your own collection — over time, you will have a personal repository of refined knowledge that no course or certification can replace.
DAI & ADAI · 2026
DAI: A Domain-Specific LLM with Model-Excluded Authority, Capability-Disjoint Verification, and Recomputable Receipts
DAI (Decripte Artificial Intelligence) is a proprietary domain-specific LLM within a governed autonomous defensive architecture. It is an instance of the proposed ADAI category defined in the companion framework paper. T…
Read paper →ADAI · ENAutonomous Defensive AI: An Envelope-and-Evidence Framework for Governed LLMs Acting on Production Infrastructure
ADAI (Autonomous Defensive Artificial Intelligence) is a proposed category of governed autonomous cyber defense. The framework specifies defended perimeters, bounded effects, declared rollback and capability-disjoint ver…
Read paper →11 papers
Crypto in Cybersecurity in 2026: Offensive Abuse, Defensive Engineering, and a Unified Risk Framework for Cryptographic Systems
Cryptography remains one of the most misunderstood and over-trusted layers in modern cybersecurity. By 2026, it is no longer sufficient to ask whether an algorithm is mathematically sound; practitioners must evaluate how cryptography is deployed, how keys are generated and protected, how trust anchors are provisioned, how protocols fail under real operational pressure, and how adversaries weaponize implementation mistakes, supply-chain compromise, side channels, and social engineering. This paper examines “crypto” as a full-stack cybersecurity problem spanning confidential messaging, TLS ecosystems, software signing, cloud key management, hardware roots of trust, password storage, post-quantum migration, and criminal abuse of encrypted channels. We propose a unified methodology that models cryptographic risk across four layers: primitive security, protocol composition, implementation integrity, and operational governance. The paper synthesizes offensive tradecraft and defensive engineering drawn from real-world vulnerabilities, including weak randomness, nonce reuse, padding-oracle exposure, misconfigured certificate validation, signature-substitution attacks, and key theft from CI/CD, endpoint, and cloud control planes. We also analyze the 2026 threat landscape, where AI-assisted phishing, malicious package ecosystems, and encrypted command-and-control reduce attacker cost while increasing the burden on defenders. Our contribution is a practical framework for evaluating cryptographic control planes in enterprises, with concrete validation steps using open-source tools, measurable security criteria, and deployment guidance for hybrid classical/post-quantum transitions. Experimental evaluation uses a representative test environment to compare crypto hygiene profiles across common service classes and to quantify the reduction in exposure achieved by hardening measures such as strict certificate pinning policy, HSM-backed key storage, ephemeral key rotation, and centralized secret scanning. The paper concludes that cryptography is not merely a collection of algorithms but an operational security system whose resilience depends on the weakest trust boundary in the stack.
Read paper →CryptoResilient Cryptographic Architecture Against Advanced Threats: Formalization, Implementation, and Operational Evaluation of Crypto-Agile Controls in Enterprise Infrastructures
TITLE: Resilient Cryptographic Architecture Against Advanced Threats: Formalization, Implementation, and Operational Evaluation of Crypto-Agile Controls in Enterprise Infrastructures ABSTRACT: The growing dependence on cryptographic mechanisms in modern enterprise infrastructures has transformed cryptography into the primary mechanism of digital trust. However, recent incidents involving exploitation of cryptographic libraries (e.g., CVE-2022-0778 in OpenSSL), attacks against protocols (e.g., downgrade attacks in TLS), and operational abuse of cryptography by ransomware (MITRE ATT&CK T1486) reveal gaps between cryptographic theory and practical implementation. This work systematically investigates the problem of governance, detection, and resilience of cryptographic assets in enterprise environments under active threat. We propose a crypto-agile architecture oriented toward defense in depth, integrating automated discovery of cryptographic assets, formal validation of parameters, detection of cryptographic anomalies in network traffic, and automated incident response. Our methodology combines formal analysis of security properties (confidentiality, integrity, forward secrecy), traffic instrumentation with Suricata and Zeek, certificate validation via OpenSSL and CFSSL, memory inspection with Volatility, and event correlation via Sigma and Elastic Stack. We developed two main algorithms: (i) Crypto Asset Discovery and Risk Scoring (CADRS), for inventory and risk prioritization, and (ii) Crypto Misuse Anomaly Detection (CMAD), for identifying anomalous patterns in TLS sessions and misuse of cryptographic primitives. Experimental evaluations conducted in an environment with 1,200 assets and 18 TB of TLS traffic demonstrated a 63% reduction in the mean time to identify insecure configurations and detection of 94.7% of TLS sessions vulnerable to downgrade attacks, with a false positive rate of 3.1%. The proposed architecture exhibited an average overhead below 4.8% in network throughput. A case study based on a real-world ransomware scenario demonstrated the system’s ability to identify malicious cryptographic patterns before complete data exfiltration. We conclude that the integration of cryptographic formalization, operational telemetry, and response automation is essential to reduce the cryptographic attack surface. This work contributes a practical and measurable approach to enterprise cryptographic resilience, offering operational guidelines for security teams, SOCs, and infrastructure architects.
Read paper →CryptoResilient Cryptographic Architecture for Critical Infrastructures: Formal Modeling, Active Defense, and Empirical Evaluation against Advanced Threats
TITLE: Resilient Cryptographic Architecture for Critical Infrastructures: Formal Modeling, Active Defense, and Empirical Evaluation against Advanced Threats ABSTRACT: The increasing sophistication of cyberespionage campaigns, ransomware, and hybrid operations has exposed structural weaknesses in cryptographic implementations of corporate systems and critical infrastructures. Incidents involving exploitation of misconfigured TLS, compromise of private keys, misuse of weak elliptic curves, and attacks on libraries such as OpenSSL (e.g., CVE-2014-0160 – Heartbleed) demonstrate that cryptographic security depends not only on the mathematical robustness of algorithms, but also on their implementation, key management, and operational integration. In this work, we propose a resilient cryptographic architecture based on three pillars: (i) formal modeling of the adversary with realistic capabilities according to MITRE ATT&CK, (ii) automated orchestration of key rotation and verification with continuous cryptographic validation, and (iii) active monitoring of cryptographic degradation via network telemetry and behavioral analysis. We developed an experimental framework integrating HSMs, OpenSSL 3.x with custom providers, Suricata, Zeek, and detection modules based on YARA and Sigma. We evaluated the solution in a controlled environment with 120 distributed nodes, simulating attacks such as protocol downgrade (T1190), exfiltration via encrypted channels (T1041), and compromise of cryptographic material (T1552). The results indicate a 73% reduction in mean time to detect cryptographic anomalies (MTTD) and automatic mitigation of 92% of attempts to use invalid or expired certificates. Average performance overhead remained below 4.8% under TLS workloads with ECDHE-RSA-AES256-GCM-SHA384. Our contributions are: (C1) a mathematical formalization of the problem of operational cryptographic degradation; (C2) an algorithm for continuous verification of security properties; (C3) quantitative empirical evidence of the architecture’s effectiveness. The results demonstrate that operational cryptographic security requires integration between formal theory, secure engineering, and active defense based on telemetry.
Read paper →CryptoAdaptive and Verifiable Cryptographic Architecture for Distributed Infrastructures: Formalization, Implementation, and Empirical Evaluation under an Advanced Threat Model
TITLE: Adaptive and Verifiable Cryptographic Architecture for Distributed Infrastructures: Formalization, Implementation, and Empirical Evaluation under an Advanced Threat Model ABSTRACT: The massive adoption of cryptography in distributed infrastructures—encompassing cloud services, blockchain networks, and cyber-physical systems—has been accompanied by a proportional growth in the exploitation of implementation, configuration, and cryptographic composition flaws. Recent incidents associated with inadequate certificate validation, nonce reuse in AEAD protocols, and vulnerabilities such as CVE-2022-0778 (OpenSSL) highlight the gap between formal security and operational security. In this work, we propose an Adaptive and Verifiable Cryptographic Architecture (ACAV) designed to mitigate systemic failures in large-scale distributed environments. Our approach integrates (i) formal verification of cryptographic properties based on temporal logic, (ii) risk-oriented adaptive key rotation, and (iii) continuous monitoring of cryptographic usage with anomaly detection. We formalize the problem as a multi-objective optimization that minimizes residual risk R(t) subject to latency and throughput constraints. We implemented a prototype on Kubernetes, OpenSSL 3.0, and HSM modules compliant with FIPS 140-3, evaluating it in a 64-node cluster. Experimental results demonstrate a 47.3% reduction in the estimated risk of key compromise under an extended Dolev-Yao model, with an average latency overhead of 3.8% (±0.6%) and an impact below 2.1% on throughput for TLS 1.3 workloads with 10,000 simultaneous connections. Compared with static periodic rotation policies, ACAV reduced events of improper reuse of cryptographic material by 92%. We conclude that the systematic integration of formal verification, cryptographic telemetry, and dynamic adaptation constitutes a viable and scalable strategy to strengthen cryptographic resilience in modern infrastructures.
Read paper →CryptoCryptoResilient: An Adaptive and Formally Verifiable Cryptographic Architecture for Mitigating Advanced Attacks in Distributed Infrastructures
TITLE: CryptoResilient: An Adaptive and Formally Verifiable Cryptographic Architecture for Mitigating Advanced Attacks in Distributed Infrastructures ABSTRACT: The growing complexity of contemporary distributed infrastructures, characterized by microservices, multi-cloud environments, confidential computing, and integration with artificial intelligence-based systems, imposes new challenges on cryptographic engineering. Although modern primitives such as TLS 1.3 and AEAD modes offer robust formal guarantees, recent incidents demonstrate that systemic security depends critically on dynamic key management, correct implementation, and continuous adaptation to evolving threat models. In this work, we propose CryptoResilient, an adaptive and formally verifiable cryptographic architecture that integrates continuous risk monitoring, dynamic orchestration of cryptographic policies, and incremental formal verification based on SMT. We formalize the problem of cryptographic adaptivity as a probabilistic game against an adaptive adversary with partial observation, defining a quantitative metric of temporal key exposure. We show, under explicit assumptions, that risk-conditioned adaptive rotation reduces expected exposure linearly when compared to fixed periodic strategies. We implemented a prototype in Kubernetes 1.29, using OpenSSL 3.2, HashiCorp Vault, a PKCS11 v3.1-compatible HSM, and integration with observability mechanisms via Prometheus and eBPF. Additionally, we incorporated crypto-agility mechanisms compatible with post-quantum algorithms standardized by NIST in 2024, such as CRYSTALS-Kyber and CRYSTALS-Dilithium. We empirically evaluated the system in a 64-node cluster under a load of 40,000 requests per second, observing a statistically significant reduction in the average exposure window to compromised keys, with overhead below 7% in throughput. The results indicate that the integration of cryptographic adaptivity and continuous formal verification is feasible in production environments, offering measurable gains in resilience against replay attacks, partial node compromise, and techniques cataloged in MITRE ATT&CK. We conclude by discussing implications for cryptographic governance, regulatory compliance, and transition to post-quantum scenarios.
Read paper →CryptoCryptoResilient: An Adaptative and Formally Verifiable Cryptographic Architecture for Mitigating Advanced Attacks in Distributed Infrastructures
TITLE: CryptoResilient: An Adaptative and Formally Verifiable Cryptographic Architecture for Mitigating Advanced Attacks in Distributed Infrastructures ABSTRACT: The increasing complexity of contemporary distributed infrastructures, characterized by microservices, multi-cloud environments, confidential computing, and integration with artificial intelligence-based systems, poses new challenges to cryptographic engineering. Although modern primitives such as TLS 1.3 and AEAD modes provide robust formal guarantees, recent incidents demonstrate that systemic security depends critically on dynamic key management, correct implementation, and continuous adaptation to evolving threat models. In this work, we propose the CryptoResilient architecture, an adaptive and formally verifiable cryptographic approach that integrates continuous risk monitoring, dynamic orchestration of cryptographic policies, and incremental formal verification based on SMT. We formalize the problem of cryptographic adaptivity as a probabilistic game against an adaptive adversary with partial observation, defining a quantitative metric of temporal key exposure. We show, under explicit assumptions, that risk-conditioned adaptive rotation reduces expected exposure linearly when compared to fixed periodic strategies. We implemented a prototype in Kubernetes 1.29, using OpenSSL 3.2, HashiCorp Vault, an HSM compatible with PKCS11 v3.1, and integration with observability mechanisms via Prometheus and eBPF. Additionally, we incorporated crypto-agility mechanisms compatible with post-quantum algorithms standardized by NIST in 2024, such as CRYSTALS-Kyber and CRYSTALS-Dilithium. We empirically evaluated the system in a 64-node cluster under a load of 40,000 requests per second, observing a statistically significant reduction in the average exposure window to compromised keys, with overhead below 7% in throughput. The results indicate that the integration between cryptographic adaptivity and continuous formal verification is feasible in production environments, offering measurable gains in resilience against replay attacks, partial node compromise, and techniques cataloged in MITRE ATT&CK. We conclude by discussing implications for cryptographic governance, regulatory compliance, and transition to post-quantum scenarios.
Read paper →CryptoBehavioral Cryptanalysis and Adaptive Key Monitoring in Hybrid Infrastructures: A Cryptographic Architecture Resilient to Advanced Persistent Threats
TITLE: Behavioral Cryptanalysis and Adaptive Key Monitoring in Hybrid Infrastructures: A Cryptographic Architecture Resilient to Advanced Persistent Threats ABSTRACT: The increasing complexity of hybrid infrastructures, combining on‑premises environments, public and private clouds, edge computing, and artificial intelligence–based workloads, imposes new challenges for cryptographic security in 2025. The expansion of Zero Trust architectures, the adoption of post‑quantum cryptography, and the massive use of large language models (LLMs) have expanded the attack surface, especially with regard to the management and lifecycle of cryptographic keys. In this work, we propose a formal architecture of behavioral cryptanalysis combined with adaptive key monitoring, designed to detect and mitigate advanced persistent threats (APTs) in hybrid infrastructures. Our proposal is grounded in formal security models based on games, probabilistic analysis of behavioral deviations, and verification of security properties through cryptographic invariants. We introduce a mathematical detection model based on statistical divergence and machine learning robust to data poisoning, integrating telemetry derived from eBPF, CNAPPs (Cloud‑Native Application Protection Platforms), and key management systems compliant with FIPS 140‑3. We evaluate the architecture under realistic scenarios involving key exfiltration, lateral movement attacks in Kubernetes clusters, and exploitation of MLOps pipelines. The results indicate a significant reduction in mean time to detection (MTTD) and strengthening of confidentiality and integrity guarantees under the adaptive adversary model. We further demonstrate the compatibility of the proposal with post‑quantum algorithms standardized by NIST, such as CRYSTALS‑Kyber and CRYSTALS‑Dilithium, while preserving formal security properties. We conclude that the integration of behavioral cryptanalysis and adaptive key monitoring constitutes a promising paradigm for resilient cryptographic defense in contemporary digital ecosystems.
Read paper →CryptoBehavioral Cryptanalysis and Adaptive Key Monitoring in Hybrid Infrastructures: A Cryptographic Architecture Resilient to Advanced Persistent Threats
TITLE: Behavioral Cryptanalysis and Adaptive Key Monitoring in Hybrid Infrastructures: A Cryptographic Architecture Resilient to Advanced Persistent Threats ABSTRACT: The increasing complexity of hybrid infrastructures, combining on-premises environments, public and private clouds, edge computing, and artificial intelligence-based workloads, imposes new challenges for cryptographic security in 2025. The expansion of Zero Trust architectures, the adoption of post-quantum cryptography, and the widespread use of large language models (LLMs) have broadened the attack surface, especially with regard to the management and lifecycle of cryptographic keys. In this work, we propose a formal architecture for behavioral cryptanalysis combined with adaptive key monitoring, designed to detect and mitigate advanced persistent threats (APTs) in hybrid infrastructures. We ground our proposal in formal game-based security models, probabilistic analysis of behavioral deviations, and verification of security properties through cryptographic invariants. We introduce a mathematical detection model based on statistical divergence and machine learning robust to data poisoning, integrating telemetry from eBPF, CNAPPs (Cloud-Native Application Protection Platforms), and key management systems compliant with FIPS 140-3. We evaluate the architecture under realistic scenarios involving key exfiltration, lateral movement attacks in Kubernetes clusters, and exploitation of MLOps pipelines. The results indicate a significant reduction in mean time to detect (MTTD) and strengthened confidentiality and integrity guarantees under the adaptive adversary model. We also demonstrate the proposal’s compatibility with NIST-standardized post-quantum algorithms, such as CRYSTALS-Kyber and CRYSTALS-Dilithium, while preserving formal security properties. We conclude that the integration of behavioral cryptanalysis and adaptive monitoring constitutes a promising paradigm for resilient cryptographic defense in contemporary digital ecosystems.
Read paper →CryptoOperational Cryptography in Cybersecurity: Attack Surfaces, Post‑Quantum Transition, and Defensive Engineering in Real‑World Systems (2025)
Cryptography forms the foundational trust layer of modern cybersecurity architectures, protecting data confidentiality, integrity, authenticity, and non‑repudiation across distributed systems. However, the operational deployment of cryptographic mechanisms often introduces exploitable weaknesses due to flawed implementations, poor key management, legacy protocol support, or cryptographic misuse. By 2025, the threat landscape has evolved to include not only classical cryptographic attacks but also protocol downgrade exploitation, hardware side‑channels, cryptographic supply‑chain compromises, and the emerging risk of quantum‑capable adversaries. Simultaneously, defenders must manage large‑scale cryptographic infrastructures spanning TLS, VPNs, identity systems, blockchain networks, and zero‑trust architectures. This research paper analyzes cryptography from an operational cybersecurity perspective, emphasizing attack surfaces and defensive strategies observed in real‑world environments. We examine cryptographic vulnerabilities exploited in the wild—including padding oracle attacks, TLS misconfiguration, weak certificate management, and key leakage in cloud environments—and analyze how modern adversaries weaponize automation and AI‑assisted reconnaissance to identify cryptographic weaknesses at scale. Particular attention is given to post‑quantum cryptography (PQC) adoption following NIST’s standardization of CRYSTALS‑Kyber and CRYSTALS‑Dilithium, and the operational challenges associated with hybrid cryptographic deployments. The study proposes a defensive methodology integrating cryptographic asset discovery, automated misconfiguration detection, hardware‑backed key management, and continuous protocol validation. A prototype implementation using widely deployed tools such as OpenSSL, testssl.sh, and OpenSCAP demonstrates practical detection and remediation workflows. Experimental evaluation across multiple enterprise environments reveals that over 30% of externally exposed TLS services still permit legacy cipher suites vulnerable to downgrade or cryptanalytic attacks. A detailed case study analyzes cryptographic failures in a real‑world enterprise breach scenario involving compromised TLS private keys due to misconfigured cloud storage and improper certificate lifecycle management. The results highlight how cryptographic failures rarely stem from broken algorithms; instead, they arise from operational mismanagement, inadequate monitoring, and insecure integration with modern cloud‑native systems. This paper contributes a comprehensive operational framework for cryptographic security in enterprise environments, bridging theoretical cryptography with practical defensive tradecraft. The findings emphasize that cryptographic resilience depends not only on strong algorithms but also on disciplined engineering, automated verification, and continuous threat‑driven validation.
Read paper →CryptoCriptoResiliente: An Adaptive and Formally Verified Architecture for Mitigating Cryptographic Failures in Large-Scale Distributed Environments
TITLE: CriptoResiliente: An Adaptive and Formally Verified Architecture for Mitigating Cryptographic Failures in Large-Scale Distributed Environments ABSTRACT: Modern cryptography constitutes the security foundation of distributed systems, ensuring confidentiality, integrity, authenticity, and non-repudiation. Although primitives such as AES, RSA, ECDSA, and the TLS 1.3 protocol remain formally secure under classical computational assumptions, empirical experience demonstrates that most incidents stem from failures in implementation, configuration, key management, and system integration. In 2025, the transition to NIST post-quantum standards, the widespread adoption of cloud-native architectures, CNAPP (Cloud-Native Application Protection Platforms), instrumentation with eBPF, and the incorporation of AI/LLM-based components significantly expand the attack surface and operational complexity. In this work, we propose CriptoResiliente, an adaptive cryptographic architecture with incremental formal verification, designed to mitigate cryptographic failures in large-scale distributed environments. We introduce a mathematical risk model R(k,t) for cryptographic keys, incorporating exposure time, associated vulnerabilities, and the intensity of observed attacks, and formulate an optimization problem subject to computational cost constraints. We show that a risk-driven rotation policy significantly reduces the average exposure time under an adversarial model with network control and partial node compromise. We implemented a prototype in Kubernetes 1.29 with hybrid TLS 1.3 (X25519 + ML-KEM), integration with a FIPS 140-3-compliant HSM, telemetry via eBPF and Prometheus, and formal verification with ProVerif. In an experimental evaluation with up to 10^7 TLS sessions/day, we observed a 73.4% reduction in average exposure time and overhead below 10%, with statistical significance (p < 0.01). We conclude that the combination of cryptographic agility, risk-driven monitoring, and incremental formal verification constitutes a viable and scalable approach to resilient cryptographic security in 2025, including under post-quantum transition requirements and AI governance.
Read paper →CryptoAdaptive Cryptographic Architecture with Post-Quantum Integrity Proofs for Distributed Critical Infrastructures
TITLE: Adaptive Cryptographic Architecture with Post-Quantum Integrity Proofs for Distributed Critical Infrastructures ABSTRACT: The transition to post-quantum cryptography imposes substantial challenges to the security of distributed critical infrastructures, especially in light of the need to preserve interoperability, performance, and formal security guarantees during the migration period. In this work, we propose the Adaptive Cryptographic Architecture with Post-Quantum Integrity Proofs (ACAPQ), a hybrid model that combines classical and post-quantum primitives with mechanisms for formal continuous integrity attestation. We ground confidentiality in the robust composition of ECDHE and CRYSTALS-Kyber, with key derivation via HKDF authenticated by the complete handshake transcript, mitigating downgrade attacks. For state integrity and authenticity, we introduce an attestation protocol based on Merkle trees and CRYSTALS-Dilithium signatures, providing quantifiable probabilistic guarantees under resistance to second-preimage attacks and EUF-CMA. We formalize the threat model in the computational paradigm with a probabilistic polynomial-time adversary capable of active interception, partial adaptive compromise, and quantum computational power modeled by the BQP class. We demonstrate that, under the hypothesis of statistical independence of the hybrid secrets, the derived key remains indistinguishable even in the event of a future break of the classical primitives. We implemented a prototype in Go 1.22 using liboqs and evaluated performance in a Kubernetes 1.29 environment under a load of 50,000 requests per second. The results indicate overhead below 12% in latency and throughput when compared to traditional TLS 1.3, while maintaining manipulation detection rates above 99%. The analysis discusses implications for CNAPP, cloud-native environments, the use of eBPF for secure observability, and cryptographic governance aligned with NIST and ENISA guidelines through 2025. We conclude that ACAPQ offers a formally grounded and operationally viable path for post-quantum transition in distributed critical infrastructures.
Read paper →