808bitshttps://808bits.com/808bits. 101 bytes. The quiet infrastructure of trustless systems: notes on keys, proofs, and continuity.enKMIP vs PKCS#11: the difference is whose code runs in your processhttps://808bits.com/articles/kmip-vs-pkcs11/https://808bits.com/articles/kmip-vs-pkcs11/Thu, 17 Sep 2026 00:00:00 +0000Every network HSM ships a closed PKCS#11 library that runs inside your application. KMIP is TLS and an encoding you can write yourself. What that buys, and what it does not.The FIPS tamper seal is a sticker, and applying it is your jobhttps://808bits.com/articles/fips-tamper-evident-seals/https://808bits.com/articles/fips-tamper-evident-seals/Sun, 13 Sep 2026 00:00:00 +0000Most FIPS 140 level 2 hardware ships with the seals in a bag. What the lab tests on a tamper-evident label, and what sixty security policies leave to the operator.Segregated crypto in a custodian bankruptcy still needs a key that workshttps://808bits.com/articles/crypto-segregation-bankruptcy-keys/https://808bits.com/articles/crypto-segregation-bankruptcy-keys/Sat, 12 Sep 2026 00:00:00 +0000Art. 242a SchKG lets clients claim crypto out of a bankrupt Swiss custodian's estate. The claim only works if the estate can still sign, and nobody tests it.FIPS 140-2 vs 140-3: what actually changedhttps://808bits.com/articles/fips-140-2-vs-140-3-what-changed/https://808bits.com/articles/fips-140-2-vs-140-3-what-changed/Thu, 10 Sep 2026 00:00:00 +0000A FIPS 140-2 certificate issued on 31 July 2026 expires on 21 September. What 140-3 changed on paper, and what 778 certificates say changed in practice.TPM 2.0 playgroundhttps://808bits.com/tools/tpm2-playground/https://808bits.com/tools/tpm2-playground/Tue, 01 Sep 2026 00:00:00 +0000A real TPM 2.0 command interface in your browser: the Microsoft reference implementation compiled to WebAssembly. Send commands, read every annotated byte, seal a secret to a boot state and watch tampering destroy it. No server.FIPS 140-3 levels 1 to 4: what each level actually requireshttps://808bits.com/articles/fips-140-3-levels-explained/https://808bits.com/articles/fips-140-3-levels-explained/Tue, 01 Sep 2026 00:00:00 +0000Level 1 is software, Level 3 is the HSM tier, Level 4 is empty: none of 773 FIPS 140-3 certificates as of September 2026. What each level actually requires.Raw transaction decoderhttps://808bits.com/tools/raw-transaction-decoder/https://808bits.com/tools/raw-transaction-decoder/Thu, 20 Aug 2026 00:00:00 +0000Paste a raw transaction from Bitcoin, Ethereum, Solana, Cosmos, NEAR, Tron, TON, Cardano, Sui or Tezos and see every byte named: scripts disassembled, addresses derived, senders recovered from signatures. Zig compiled to WebAssembly, no server.The ECDSA tax: GG20, CGGMP21, DKLs23 and FROST comparedhttps://808bits.com/articles/the-ecdsa-tax/https://808bits.com/articles/the-ecdsa-tax/Wed, 19 Aug 2026 00:00:00 +0000Same library, same machine: FROST signs in 3 ms, threshold ECDSA in 5 s. Why, and what GG20, CGGMP21, DKLs23 and FROST pay for it. Who ships them, which broke.The key that never exists: a threshold signing ceremony in your browserhttps://808bits.com/articles/threshold-signing-ceremony-in-your-browser/https://808bits.com/articles/threshold-signing-ceremony-in-your-browser/Sat, 15 Aug 2026 00:00:00 +0000Three keyholders run a real 2-of-3 key generation and FROST signing session on this page, every message shown byte for byte. Zig to WebAssembly, no server.FIPS 140-3 is not a security guarantee, and auditors know ithttps://808bits.com/articles/fips-140-3-not-a-security-guarantee/https://808bits.com/articles/fips-140-3-not-a-security-guarantee/Wed, 05 Aug 2026 00:16:08 +0000Validated modules shipped ROCA, EUCLEAK and a YubiKey flaw caused by FIPS self-tests. What the certificate attests, what FIPS mode costs, where auditors look.Coldcard's seed bug: the right RNG was in every binary, never calledhttps://808bits.com/articles/coldcard-entropy-failure-lessons/https://808bits.com/articles/coldcard-entropy-failure-lessons/Sun, 02 Aug 2026 00:00:00 +0000A five-year Coldcard firmware bug cut seed entropy from 128 bits to about 40. Why no audit could catch it afterwards, and what it means for anyone making keys.Fireblocks Recovery Utility: what verify mode proveshttps://808bits.com/articles/fireblocks-recovery-tool-what-it-proves/https://808bits.com/articles/fireblocks-recovery-tool-what-it-proves/Fri, 12 Jun 2026 00:00:00 +0000How the Fireblocks Recovery Utility verifies a backup kit step by step, what a green Verified! proves, and the three things it takes on trust.DORA exit plan for crypto custody: the test is whether you can signhttps://808bits.com/articles/dora-exit-plan-digital-asset-custody/https://808bits.com/articles/dora-exit-plan-digital-asset-custody/Fri, 05 Jun 2026 00:00:00 +0000DORA Article 28(8) wants a documented, tested exit plan for every critical ICT provider. For MPC custody the exit is signing capability, not data.A custody recovery drill that never exposes a keyhttps://808bits.com/articles/custody-key-recovery-drill/https://808bits.com/articles/custody-key-recovery-drill/Fri, 29 May 2026 00:00:00 +0000A recovery drill for MPC custody produces four numbers and a deviation log, and touches no private key. Most of what it finds is not cryptography.