Technical dictionary

159 terms — linked from finance and protocol pages when those concepts appear in the text.

• Account abstraction — Design pattern (e.g. ERC-4337-style) where smart-contract accounts can define custom validation—including future PQC signatures.
• Account model (Ethereum / Solana) — Global accounts with balances/nonces (and program data) rather than Bitcoin-style UTXOs—changes hygiene stories, not the need for quantum-safe signatures.
• ACME — Protocol for automated certificate issuance and renewal (e.g. Let’s Encrypt-class flows).
• Address reuse (Bitcoin) — Receiving multiple payments to the same address after the public key is known—bad for privacy and quantum exposure timing.
• AES-256 — Symmetric block cipher; against Grover, 256-bit keys are the usual long-term recommendation.
• Algorithm agility — Ability to change cryptographic algorithms without multi-year rewrites—program and engineering property.
• Algorithm agility (ops) — Ability to change cryptographic algorithms via configuration and dual-stack verification—essential for PQC migration.
• AMM (Automated Market Maker) — Smart-contract market using liquidity pools instead of order books—user risk is still wallet keys and approvals.
• API gateway — Edge for APIs combining TLS, authn/z, and routing—concentrated crypto surface.
• AVS (Actively Validated Service) — Service secured by restaked stake—operator keys and service admins need explicit inventory.
• Bastion host — Hardened jump host for admin access—concentrates SSH/TLS identity risk.
• BLS12-381 (light) — Pairing-friendly curve family used in modern consensus designs (including Ethereum staking contexts)—classical crypto, not a PQC checkbox.
• Board-level quantum risk — How directors should hear residual crypto risk, milestones, and funding—not algorithm trivia alone.
• Bridge validator / relayer — Operator set that attests cross-chain messages—often a small classical multisig or committee.
• CBOM (Cryptographic Bill of Materials) — Structured inventory of cryptographic algorithms and components in a system or product.
• Certificate Transparency (CT) — Public logging of issued certificates to detect mis-issuance—auditability, not session confidentiality.
• CICS — Transaction server environment often paired with COBOL on mainframes—operational context for online banking workloads.
• Cipher suite — Named combination of key exchange, authentication, encryption, and MAC algorithms in TLS-class protocols.
• CNSA — Commercial National Security Algorithm suite guidance—track current versions from primary sources.
• COBOL — Business-oriented programming language still common in core finance systems—not a cryptosystem; quantum risk sits in surrounding PKI and channels.
• Code signing — Digital signatures on software/firmware so clients trust updates—integrity-critical classical keys.
• Core banking system — Systems of record for customer balances and postings—often mixed legacy and modern channels with heavy PKI dependencies.
• CRL (Certificate Revocation List) — Signed list of revoked certificates published by a CA—classical PKI operations tool.
• Cross-chain bridge — Mechanism moving value or messages between domains—often a concentrated classical-key or trust surface.
• Cryptanalysis — Science of breaking or evaluating cryptographic schemes—classical and quantum techniques included.
• Crypto exception management — Time-bound acceptance of classical-only systems with owners and compensating controls.
• Crypto-Agility — Engineering ability to change algorithms via configuration without rewriting the product.
• Crypto-agility testing — Lab and canary tests for larger handshakes, new cert profiles, and dual-stack negotiation.
• Cryptographic attestation — Evidence signed by a device or environment about its state—used in device trust and confidential computing.
• Cryptographic incident — Security event involving key compromise, CA distrust, mass revocation, or algorithm break.
• Cryptographic inventory — Living map of where cryptography runs—certificates, keys, protocols, libraries, and owners.
• Cryptographically Relevant Quantum Computer (CRQC) — A quantum computer large and reliable enough to break real-world public-key cryptography.
• Data shelf life — How long confidentiality or integrity of data must hold—drives HNDL prioritization.
• DeFi (Decentralized Finance) — On-chain financial applications—multiplies user, admin, oracle, and bridge key surfaces on classical host chains.
• DeFi account risk surface — Combined EOA, approvals, and protocol roles that define practical DeFi quantum exposure.
• Digital signature — Cryptographic proof that a message was authorized by a private key holder—core of blockchain spends and many enterprise authentications.
• Discrete logarithm problem — Hard problem underlying DH and many ECC schemes—efficiently solvable by Shor’s algorithm on a CRQC.
• DNSSEC — DNS Security Extensions—signed DNS data for authenticity, not general traffic encryption.
• DoH / DoT — DNS over HTTPS or TLS—encrypts DNS queries in transit using TLS-class channels.
• DTLS — Datagram TLS—TLS-like security over UDP for real-time and IoT stacks.
• Dual-stack cryptography — Running classical and PQC/hybrid algorithms in parallel during migration windows.
• EAP-TLS — Certificate-based EAP method for 802.1X—enterprise Wi‑Fi and wired NAC strong auth.
• ECDSA (secp256k1 on Bitcoin) — Elliptic-curve signature scheme used widely on Bitcoin; breakable by Shor’s algorithm given the public key.
• Ed25519 — Fast classical signature scheme used heavily on Solana—strong classically, not post-quantum.
• Encrypted Client Hello (ECH) — TLS feature hiding SNI and related ClientHello fields—metadata privacy, not a PQC substitute.
• Envelope encryption — Data encrypted with a DEK; DEK wrapped by a KEK in KMS/HSM—common cloud pattern.
• EOA (Externally Owned Account) — Ethereum-style account controlled by a private key (not a contract)—usually secp256k1 ECDSA today.
• FIDO / WebAuthn — Passwordless public-key authentication standards—phishing-resistant classically, PQ ecosystem evolving.
• FIPS — U.S. federal information processing standards—including crypto module and algorithm validations.
• Flash loan — Uncollateralized same-block loan—economic primitive; user auth still host-chain signatures.
• Governance token — Token granting voting rights over protocol parameters—power maps to classical keys holding it.
• Grover's Algorithm — Quantum search algorithm that roughly halves the effective bit strength of symmetric crypto and hashes.
• Guardian (protocol) — Privileged role that can pause or emergency-control a protocol—high-value classical key surface.
• Harvest Now, Decrypt Later (HNDL) — Adversaries store ciphertext today to decrypt when a quantum computer becomes available.
• Harvest-now threat model — Adversary records ciphertext or public transcripts today for future cryptanalysis—core HNDL framing.
• Hash-based signature — Signatures built from hash functions (e.g. XMSS, LMS, SPHINCS+/SLH-DSA)—conservative PQ option.
• Host chain — Blockchain where an asset or app instance lives—signature scheme of that chain dominates user risk.
• HSM (Hardware Security Module) — Tamper-resistant hardware for storing keys and performing crypto operations—enterprise key custody building block.
• Hybrid KEM — Combining classical and post-quantum key encapsulation so both must break to expose the session.
• Hybrid TLS — TLS key exchange combining classical ECDH with a PQC KEM so an attacker must break both.
• IKE / IKEv2 — Key exchange protocol used with IPsec to establish security associations.
• Integer factorization — Hard problem behind RSA—broken by Shor’s algorithm at cryptographically relevant scale.
• IPsec — Suite for authenticating and encrypting IP traffic—often with IKEv2 key exchange still classical today.
• JWT (JSON Web Token) — Compact token format often signed with classical RSA/ECDSA—common in APIs and OIDC.
• Keeper — Bot or operator that triggers liquidations or maintenance transactions—ops keys separate from users.
• Key Encapsulation Mechanism (KEM) — Public-key primitive that securely transports a symmetric key (used heavily in PQC TLS).
• KMS (Key Management Service) — Service that creates and controls cryptographic keys—cloud or on-prem—algorithm support varies.
• Lattice-Based Cryptography — Crypto whose hardness assumes problems on high-dimensional lattices (basis of ML-KEM/ML-DSA).
• Layer 2 / scaling network — Scaling systems that inherit or reference a base chain’s security—still usually classical user keys plus extra operator surfaces.
• Liquid staking token (LST) — Receipt token (e.g. stETH) representing staked assets—holder keys plus protocol operator/withdrawal credentials matter.
• Liquidation — Forced closure of undercollateralized loans—driven by oracles and keepers with their own key/ops risk.
• Liquidity provider (LP) — User who deposits assets into a pool and receives LP tokens—keys and approvals define quantum-relevant risk.
• LMS — Leighton–Micali hash-based signatures—stateful PQ signatures used in some firmware ecosystems.
• Load balancer TLS termination — Decrypting TLS at a VIP/edge—centralizes certificates and cipher policy.
• Logical qubit — Error-corrected qubit effective for algorithms—many physical qubits needed per logical qubit today.
• MEV — Maximal extractable value from transaction ordering—ops and relay infrastructure, not a PQC algorithm.
• ML-DSA (Dilithium) — NIST standardized lattice-based digital signature scheme for general authentication.
• ML-KEM (Kyber) — NIST standardized lattice-based key encapsulation mechanism for general encryption and hybrid TLS.
• Module-LWE — Lattice assumption used by ML-KEM/ML-DSA-class schemes—basis of many NIST PQC standards.
• MPC (Multi-Party Computation) — Cryptography where parties compute without revealing inputs—used in some custody designs.
• MTA-STS — SMTP policy requiring TLS between mail servers—transport discipline, not end-to-end message crypto.
• mTLS (Mutual TLS) — TLS where both client and server present certificates—strong classical auth that still needs algorithm migration.
• Multisignature (multisig) — Authorization requiring M-of-N keys—improves operational security, not post-quantum math by itself.
• NAC (Network Access Control) — Admission control for LAN/WLAN—often 802.1X with EAP-TLS certificates.
• NIST PQC standardization — Multi-year process producing standardized post-quantum KEMs and signatures (ML-KEM, ML-DSA, SLH-DSA, …).
• Nonce (account) — Sequence number on account-based chains preventing replay—part of Ethereum-style transaction structure, not a PQC primitive.
• NSM-10 — U.S. National Security Memorandum driving federal progress on quantum-resistant cryptography.
• OAuth — Authorization framework for delegated access—tokens and TLS define much of the crypto risk.
• OCSP — Online Certificate Status Protocol—checks whether a certificate has been revoked.
• On-chain governance — Token voting and executors that change protocol parameters—high-value classical keys if not PQC.
• OpenID Connect (OIDC) — Identity layer on OAuth using ID tokens—usually classical JWT signatures today.
• Optimistic rollup — L2 design that posts data/state assumptions to L1 and relies on fraud proofs—users still use classical signatures by default.
• Oracle (DeFi) — System that brings off-chain data on-chain—operator keys that sign reports are distinct from token-holder keys.
• P2PK (Pay-to-Public-Key) — Early Bitcoin script style that locks coins to a raw public key—maximally exposed for Shor-class attacks if a CRQC exists.
• P2PKH (Pay-to-Public-Key-Hash) — Classic Bitcoin address style that commits to a hash of the public key until spend—better exposure timing than P2PK, still classical signatures.
• PAM (Privileged Access Management) — Controls for admin access—brokers and backends still use classical TLS/SSH unless upgraded.
• PKI operations — Day-2 certificate lifecycle: issuance, renewal, revocation, CA hierarchy, and monitoring.
• Post-Quantum Cryptography (PQC) — Classical algorithms designed to resist both classical and quantum attacks—no quantum hardware required to run them.
• Post-quantum TLS — TLS using PQC or hybrid KEMs (and eventually PQ certificates)—primary network migration goal.
• PQC migration — Program to inventory classical public-key crypto and transition to hybrid/post-quantum algorithms.
• PQC via account abstraction — Using smart-contract wallets to validate post-quantum signatures when EOAs cannot.
• Private key — Secret key material that authorizes signatures or decryption—compromise means loss of control.
• Proxy admin — Key or contract allowed to upgrade proxy implementation—critical DeFi and app admin surface.
• Public key — Shareable half of a key pair used to verify signatures or encrypt to a holder of the matching private key.
• Public Key Infrastructure (PKI) — Certificates and CAs that bind identities to keys—signature algorithms must become PQC-capable.
• Q-Day — Informal name for the arrival of cryptographically relevant quantum attacks on widely used public-key crypto.
• QKD vs PQC — Physics-based key distribution versus algorithmic quantum-resistant crypto—different deployment models.
• Quantum Key Distribution (QKD) — Physics-based key exchange using quantum channels—complementary to, not a drop-in for, PQC.
• Quantum-safe / quantum-proof claim — Marketing or product language asserting resistance to quantum attacks—must be mapped to concrete algorithms and residual risk.
• QUIC / HTTP/3 — UDP-based transport with integrated crypto—modern web stacks still need hybrid/PQC handshake roadmaps.
• RADIUS — AAA protocol for network access—often paired with EAP-TLS enterprise wireless and NAC.
• Re-encryption — Decrypting and encrypting data under new keys/algorithms—needed for long-lived archive migration.
• Restaking — Reusing staked economic security for additional services—multiplies operator and protocol key surfaces.
• RPKI / BGP security — Routing PKI binding prefixes to ASNs—integrity of internet routes, classical signatures today.
• RSA — Public-key system based on factoring—broken by Shor’s algorithm at sufficient scale.
• RWA (Real-World Asset) — On-chain token representing off-chain value—on-chain keys plus issuer/custody/banking rails all matter.
• SAML — XML-based federation standard—assertion signatures are long-lived enterprise trust surfaces.
• SASE / SSE — Cloud security edges that proxy or tunnel enterprise traffic—vendor crypto roadmaps matter.
• SBOM (Software Bill of Materials) — List of software components and dependencies—useful when you analyze crypto libraries inside it.
• SD-WAN — Software-defined WAN overlays—branch tunnels and orchestrators hold long-lived crypto.
• secp256k1 — Elliptic curve used by Bitcoin and many EVM chains for ECDSA (and related) signatures—vulnerable to Shor-class attacks.
• Secret zero — The first credential that unlocks all others—bootstrap trust problem in secrets systems.
• Seed phrase (BIP-39) — Human-readable secret that derives wallet keys—compromise is total; algorithm family still usually classical.
• Sequencer — L2 component that orders transactions—often a high-value operational key surface separate from user EOAs.
• Service mesh — Infrastructure layer for service-to-service mTLS and traffic policy—certificate factory at scale.
• Shor's Algorithm — Quantum algorithm that efficiently factors integers and computes discrete logs—breaking RSA and ECC.
• Short-lived certificate — Certificate with hours/days validity—reduces revocation dependence and speeds algorithm rollover.
• Side-channel attack — Attack using timing, power, or EM leakage—implementation risk for classical and PQC alike.
• SLH-DSA (SPHINCS+) — Stateless hash-based signature standard—conservative alternative to lattice signatures.
• Smart contract — Program on a blockchain that holds logic and often assets—admin keys and upgradeability define extra risk.
• SPIFFE / SPIRE — Workload identity framework issuing short-lived SVIDs—safety depends on configured crypto.
• SSH — Secure Shell for remote admin—host keys and user keys are classical public-key identities in most fleets.
• SSH certificate — CA-signed SSH identity for users or hosts—improves scale vs TOFU host keys.
• SSO (Single Sign-On) — Centralized authentication to many apps—IdP signing keys are high-value classical trust anchors.
• Stablecoin issuer controls — Off-chain reserves and on-chain mint/burn authorities—issuer keys and banking rails both matter.
• Staking keys — Validator/consensus keys distinct from withdrawal and user spending keys.
• Taproot — Bitcoin soft-fork feature set using Schnorr signatures and improved script paths—classically powerful, not quantum-safe by itself.
• Timelock — Contract that delays execution of admin actions—operational control, not a post-quantum algorithm.
• TLS (Transport Layer Security) — Protocol securing HTTPS and many APIs; classical key exchange is the primary quantum concern.
• TLS middlebox — Device that intercepts or inspects TLS (enterprise CA MITM)—blocks hybrid pilots if outdated.
• TLS session resumption — Tickets/PSK reuse avoiding full handshakes—inherits prior key material security.
• Token allowance / approval — ERC-20-style permission for a spender to move tokens—amplifies damage after key compromise.
• UTXO (Unspent Transaction Output) — A discrete chunk of spendable Bitcoin controlled by a locking script/key condition—the unit of quantum exposure analysis for holders.
• Validator — Consensus participant that proposes/attests to blocks—holds high-value keys distinct from ordinary user wallets.
• Validator keys — Consensus-critical signing keys held by staking operators—high-value classical secrets with systemic impact if mishandled.
• Validity rollup (ZK rollup) — L2 that posts validity proofs to L1—advanced proofs are not the same as quantum-safe user wallets.
• Vendor PQC risk — Third-party residual risk from classical crypto in SaaS, appliances, and libraries.
• Vote-escrow token (veToken) — Locked governance token model granting boosted voting/rewards—political power on classical keys.
• VPN — Virtual private network tunneling remote or site traffic—quantum risk is mostly handshake and identity crypto.
• WireGuard — Modern VPN protocol with a small crypto design—classically strong, not post-quantum by default.
• Withdrawal credentials — Settings that control where staked assets can be withdrawn—critical operational crypto surface for staking systems.
• Workload identity — Cryptographic identity for services/machines—short-lived certs or tokens instead of static passwords.
• Wrapped asset — Token representing an asset locked elsewhere—bridge/custodian keys dominate extra risk.
• Wrapped token — Token representing an asset from another domain—bridge/custodian keys define extra risk.
• X.509 — Standard certificate format binding public keys to identities—backbone of TLS and enterprise PKI.
• XMSS — Stateful hash-based signature scheme—one-time/few-time key use discipline required.
• Y2Q — Informal “years to quantum” planning metaphor—prepare before a public CRQC, not on announcement day.
• Zero trust — Security model of continuous verification and least privilege—not automatically post-quantum.
• ZTNA — Zero trust network access—per-app access brokers still terminate classical crypto unless upgraded.