Services / Cryptography & assurance

Cryptography & assurance

Modernize cryptographic foundations, resolve integration risks, and build evidence that makes evaluation work tractable.

The algorithm is only part of the system.

Library upgrades affect APIs, certificate handling, authentication paths, firmware dependencies, and the tests that demonstrate correct behaviour. A successful transition needs a dependency map and a verification strategy.

I work across OpenSSL, SSH/TLS, PKI/X.509, key management, and embedded integration, connecting architecture decisions to implementation and evaluation evidence.

Focused engagements

A focused starting point

Cryptographic migration assessment

What has to change, and in what order?

What you bring: Library and protocol inventory, build dependencies, target platforms, and compatibility obligations.
Scope: Dependency and migration planning for an agreed product boundary. Migration implementation is a separate work package.
What you receive: Dependency inventory, compatibility risks, validation needs, and a sequenced migration roadmap.
Timing: Agreed after reviewing system scope, access, and evidence availability.

Discuss this engagement

A focused starting point

Certification readiness review

What evidence or engineering gaps could delay evaluation?

What you bring: Target scheme and scope, design documentation, existing test evidence, and known evaluator questions.
Scope: Readiness assessment and engineering support. Formal evaluation and certification remain with the relevant laboratory and scheme.
What you receive: Evidence gaps, remediation priorities, and a practical evaluation-preparation plan.
Timing: Agreed after reviewing system scope, access, and evidence availability.

Discuss this engagement

Engineering depth

Cryptographic migration: dependency analysis, API/ABI remediation, protocol compatibility, and rollout verification.
TLS and PKI: certificate validation, trust stores, mutual authentication, negative-path testing, and reproducible harnesses.
Key management: HSM-backed provisioning, PKCS#11 integration, key lifecycles, and protected storage.
Post-quantum planning: inventory and sequencing for ML-KEM, ML-DSA, and SLH-DSA adoption, including protocol and vendor dependencies.
Certification support: FIPS-related integration and evidence, Common Criteria requirement analysis, lab questions, and engineering remediation.

Experience behind the work

At Ciena, I own host-software security for coherent optical transport platforms. I led the OpenSSL 1.1.1-to-3.5 migration, traced cryptographic dependencies, remediated consumers, and developed verification tools and evidence supporting Common Criteria evaluation and FIPS-related work.

Earlier work includes CBDC wallet key management at the Bank of Canada and hardened certificate validation and HSM-backed provisioning at Irdeto.

Read the cryptographic modernization case study

Start with the engineering problem

What needs to be secure?

Share your system, the decision ahead, and the constraints. We’ll work out a useful next step.

Discuss your project