Cryptographic assurance · Operational resilience
Cryptographic trust. Sovereign identity. Resilient infrastructure.
Corenet Security is a UK cryptographic architecture consultancy for enterprise PKI, hardware-backed key governance, post-quantum migration and zero-day vulnerability triage. Architecture decisions are made explicit and assurance evidence is made reviewable.
Root CA offline
- Custody
- Air-gapped HSM · 3-of-5 quorum
- Key
- RSA-4096 → ML-DSA-87 planned
- Validity
- 20 years
Issuing CA online
- Custody
- Network HSM · PKCS#11
- Key
- ECDSA P-384
- Validity
- 5 years
Workload mTLS
- Renewal
- ACME · automated
- Key
- ECDSA P-256
- Validity
- 90 days
Core practice areas
Security at the root. Assurance at every layer.
Architecture-led engagements for complex estates. Explicit trust boundaries, documented decisions and evidence your assurance team can inspect.
PKI & certificate lifecycle
Root hierarchies, offline CAs and automated certificate operations, with crypto agility built into the lifecycle.
- Root CA hierarchy and offline ceremony design
- ACME automation and certificate inventory
- Revocation and recovery playbooks
HSM & key governance
Hardware-backed trust, tamper-evident ceremonies and quorum-controlled key operations.
- Key custody and M-of-N authorisation model
- HSM selection, migration and failover
- Ceremony scripts and evidence capture
Sovereign & zero trust identity
High-assurance credentials, mutual authentication and identity boundaries you control.
- mTLS and workload identity design
- Federation boundaries and credential lifecycles
- Decentralised identifier threat modelling
Zero-day defence & threat advisory
Exploit-aware triage, mitigation decisions and detection engineering grounded in evidence.
- Exposure analysis against KEV and EPSS signals
- Reversible mitigation planning
- Detection and recovery playbooks
Architecture & delivery
From cryptographic discovery to operational confidence.
A structured delivery model with reviewable artefacts at every gate. No opaque handover. No undocumented trust assumptions.
- 01 · DISCOVER
Cryptographic discovery & surface mapping
Map certificates, keys, algorithms, dependencies and ownership. Identify unmanaged trust anchors and long-lived sensitive data.
Output → crypto inventory, exposure & dependency map
- 02 · DESIGN
Threat modelling & key architecture
Define trust boundaries, adversaries and recovery objectives. Specify key custody, crypto agility and protocol compatibility.
Output → threat model, reference architecture & roadmap
- 03 · IMPLEMENT
Air-gapped implementation & HSM deployment
Plan controlled ceremonies, HSM integration and failover. Validate firmware, security policies, operating modes and evidence capture.
Output → ceremony records, verified configuration & runbooks
- 04 · ASSURE
Continuous threat telemetry & zero-day monitoring
Connect advisory signals to asset exposure. Exercise renewal, revocation and incident workflows with measurable acceptance criteria.
Output → control evidence, triage & recovery playbooks
Technical scope: X.509 / RFC 5280, PKCS#11, mTLS / ACME, ML-KEM / ML-DSA, Thales / Utimaco / AWS CloudHSM. FIPS validation applies to a specific module, version and approved configuration, not an entire deployment.
Critical incident / zero-day response
When the threat is live, the response must be deliberate.
Establish exposure. Preserve evidence. Contain the attack path. Prioritise reversible mitigations and verified recovery over speculative fixes.
- 01
Declare scope, authority and incident severity
- 02
Validate exploitation and containment options
- 03
Coordinate mitigation, recovery and disclosure
Response windows and SLAs are contractually agreed. For active incidents, use your established incident response channel.
Vulnerability intelligence
A live view of the threat landscape.
Known exploitation and emerging disclosures across Linux, Windows and AI infrastructure. A starting point for triage, not a substitute for asset-specific analysis.
Monitor data sources
- CISA KEV
- NVD
- GitHub Advisories
- OSV
- FIRST EPSS
Known exploited does not mean confirmed zero-day. Feed health and coverage are shown inside the monitor; advisory data may be incomplete or delayed.
Post-quantum migration
What changes in a post-quantum migration?
A post-quantum migration replaces quantum-vulnerable public-key algorithms (RSA, ECDSA, ECDH and finite-field DH) with NIST-standardised ones: ML-KEM for key establishment and ML-DSA or SLH-DSA for signatures. Symmetric encryption and hashing stay largely as they are. The hard part is finding every place the old algorithms are used.
| Function | Quantum-vulnerable today | Post-quantum replacement | Standard |
|---|---|---|---|
| Key establishment | RSA key transport, ECDH, DH | ML-KEM (often hybrid with ECDH during transition) | FIPS 203 |
| Digital signatures | RSA, ECDSA, EdDSA | ML-DSA | FIPS 204 |
| Long-lived signatures (roots, firmware) | RSA, ECDSA | SLH-DSA (hash-based) | FIPS 205 |
By 2028
Complete discovery and assessment; agree migration goals and an initial plan.
By 2031
Complete early, highest-priority migration activities and refine the plan into a full roadmap.
By 2035
Complete migration of all systems, services and products.
Milestones from the NCSC migration timelines (March 2025). In the US, NIST IR 8547 deprecates RSA, ECDSA, EdDSA and classical key establishment after 2030 and disallows them after 2035.
Industry scenarios
Built for consequential environments.
Illustrative architecture scenarios, not published client case studies or claims of completed engagements.
IoT / embedded: device identity across the fleet
Lifecycle-controlled credentials, hardware-backed key custody and authenticated device-to-cloud communication.
Financial: integrity at transaction scale
HSM-backed transaction validation, signing boundaries and key rotation across high-availability environments.
Government / defence: explicit trust boundaries
High-assurance federation, isolated issuing authorities and credential lifecycles for constrained networks.
Practical answers
Questions before the architecture review.
Last reviewed .
What does a cryptographic architecture review cover?
A review maps trust anchors, certificates, key custody, algorithms and relying-party dependencies. It evaluates threat assumptions, recovery requirements and control evidence, then produces a prioritised remediation and migration roadmap.
How do PKI and certificate lifecycle management differ?
Public key infrastructure establishes and governs certificate-based trust. Certificate lifecycle management covers discovery, ownership, issuance, renewal, revocation and retirement across that infrastructure.
Where should a post-quantum migration start?
Start with a cryptographic inventory and data-retention assessment. Identify public-key dependencies, prioritise long-lived sensitive data, and test crypto-agile migration paths. ML-KEM addresses key encapsulation; ML-DSA addresses digital signatures.
How long does a post-quantum migration take?
For a large organisation, years. The UK NCSC asks organisations to complete discovery and planning by 2028, complete early, highest-priority migration activities by 2031 and finish by 2035. The timeline depends mostly on how many systems, vendors and long-lived certificates must change, which is why an inventory comes first.
What is crypto agility and why does it matter?
Crypto agility is the ability to swap algorithms, keys and certificate profiles without redesigning the systems that use them. It matters because post-quantum standards, key sizes and vendor support will keep changing. Agile systems take a configuration change; rigid ones need a project for every algorithm change.
Does a known-exploited vulnerability mean it is a zero-day?
No. CISA KEV identifies vulnerabilities with evidence of exploitation. Zero-day status depends on the timing of exploitation relative to disclosure or an available fix. Advisory severity and EPSS probability are separate signals.
Does this website dispatch emergency incident responders?
No. This website provides advisory intelligence and a local scoping tool. It does not dispatch responders, accept incident evidence or guarantee response times.
What happens to information entered in the scoping form?
The brief is prepared in your browser and is not submitted to Corenet. You can download a plain-text file or a passphrase-encrypted file (PBKDF2-SHA-256 with 600,000 iterations, then AES-256-GCM). Never include secrets or private keys.
Glossary
Terms used on this page
- PKI
- Public key infrastructure: the certificate authorities, policies and keys that establish certificate-based trust.
- Certificate lifecycle management
- Discovery, ownership, issuance, renewal, revocation and retirement of certificates across a PKI.
- HSM
- Hardware security module: tamper-resistant hardware that generates and uses keys without exposing them.
- ML-KEM
- Module-lattice key encapsulation mechanism, standardised in FIPS 203, used for post-quantum key establishment.
- ML-DSA
- Module-lattice digital signature algorithm, standardised in FIPS 204.
- Crypto agility
- The ability to change algorithms, keys and certificate profiles without redesigning the systems that use them.
- CISA KEV
- The US CISA catalogue of vulnerabilities with evidence of exploitation in the wild.
- EPSS
- FIRST's Exploit Prediction Scoring System: the estimated probability a vulnerability is exploited in the next 30 days.
Start with the architecture
Define the challenge. Establish the trust boundary.
Write a one-page scope for a cryptographic audit, migration programme or incident review. The form builds the brief in your browser and encrypts it if you choose. Nothing is submitted or booked; you share the file through a verified business contact.
Who you work with
Roshan Muthoora, founder. CCISO-certified, with around 30 years in cybersecurity and enterprise product management across enterprise IT and regulatory compliance.
LinkedIn profileContact: roshan.muthoora@gmail.com
What a review produces
- Cryptographic inventoryCertificates, keys, algorithms, owners and dependencies, with unmanaged trust anchors flagged.
- Threat model and reference architectureTrust boundaries, key custody and recovery objectives, written down.
- Prioritised roadmapDecisions, evidence and acceptance criteria, ordered by risk and data lifetime.
Coordinated vulnerability disclosure
Report with care. Preserve the evidence.
For vulnerabilities affecting this website, prepare a minimal, non-destructive reproduction. For third-party products, report directly to the vendor's published security contact. No testing authorisation or safe-harbour commitment is granted by this page.
Send reports to roshan.muthoora@gmail.com. Do not include private keys, credentials or other users' data; agree an encrypted channel first for sensitive evidence. The same contact is published in /.well-known/security.txt.