Riccardo Schirone
Summary: Trail of Bits collaborated with the Sigstore community to build cryptographic agility into the software signing ecosystem, letting organizations use different signing algorithms while maintaining security through predefined algorithm suites and out-of-band configuration rather than in-band signaling. A separate 2023 post describes Toucan, a four-month pilot project that integrated OpenAI's Codex into Trail of Bits' Solidity auditing workflow to test whether AI could power software security audits.
What you should know: Signing systems are what let an organization approve code and releases, so the ability to swap algorithms without in-band signaling is what keeps that trust intact as cryptographic standards shift. The Toucan pilot is the earlier question sitting underneath it: whether AI can be trusted to audit the code those signing systems protect.
Read the original at Trail of Bits Blog ↗
- Topics
- AI Security
- Related
- SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 8 Cyber Risks · Nov 15, 2026Pentagon Renames CDAO ‘Super Intelligence Office’ Cyber Risks · Nov 15, 2026186 Fake AI Domains Redirect Users to Click Fix Lures, Browser Malware, and Search Hijackers Cyber Risks · Nov 12, 2026