Between 2010 and 2024, a family of Infineon secure chips passed roughly eighty Common Criteria security evaluations. Many were at AVA_VAN 5 — the highest vulnerability-analysis assurance level the scheme offers, meant to certify resistance to attackers with high attack potential.
For that entire period, those chips leaked their private keys through a side channel. The EUCLEAK research published in 2024 showed that a non-constant-time modular inversion allowed an attacker with physical access to extract an ECDSA key and clone the token. Fourteen years. Eighty evaluations. No finding.
The tempting reading is that somebody was asleep. I don’t think that’s it, and the boring explanation is far more interesting: the evaluations tested what they were designed to test, and did it correctly. The flaw simply lived outside the boundary.
That’s a specific and unglamorous kind of failure, and once you have the shape of it you start seeing it everywhere.
Take FIPS 140-3, the American standard for cryptographic modules. It validates something narrow and honest: that a specific module, at a specific firmware version, implements approved algorithms correctly. Inside the boundary sit algorithm correctness, key zeroization, power-up self-tests, tamper resistance. Outside it — unexamined by design — sit the application code, the access controls, the key-management policy, the operator procedures, and whether the module is even running in its certified configuration.
Also outside: constant-time code and side-channel resistance. In one practitioner’s summary, “the properties that attackers actually exploit.”
Nothing about that is dishonest. The certificate says what it certifies. The failure is in the inference, not the document — in the reader who sees “certified” and hears “secure,” which is a claim nobody made.
And there’s a mechanism that makes it worse over time, which I hadn’t considered until this week. The validation queue historically runs twelve to eighteen months. So a vendor who ships a security fix loses their certification for over a year. The rational move is to leave the vulnerable code in the field. Go’s certified cryptographic module, by the same account, runs crypto two major releases behind. The certification doesn’t merely fail to catch the problem; on that timescale it actively preserves it — not by malfunctioning, but by working exactly as designed.
The market’s verdict is worth noting: over ninety percent of hardware-security-module customers reportedly run FIPS mode disabled.
The second shape is worse, because there the check doesn’t just miss the thing — it manufactures a result.
The Dunning-Kruger effect — incompetent people overestimating their ability, experts underestimating theirs — may not exist as described. The original 1999 study had participants take a test, predict their own score, then sorted everyone into quartiles by actual performance and plotted average self-assessment against average score. When later researchers fed that identical procedure completely random numbers — no people, no psychology, no bias — the graph came out looking like Dunning-Kruger. Self-assessment is a noisy measurement; plot noise against signal in quartiles and regression to the mean draws the shape for free.
The diagnostic buried in that is the most portable thing I’ve picked up in months. The artifact gets stronger as measurement error increases. And no real finding improves when you degrade your instrument. So: if your effect grows when you add noise, the effect is your method.
Two failure modes, then. A check can have a boundary that excludes what matters. A check can generate the result it appears to detect. Both produce something that looks exactly like knowledge.
Here’s the one that stops me claiming I’ve solved anything.
In January 2025 a regional jet and an Army helicopter collided over the Potomac at 278 feet, killing sixty-seven people. Reading the accident analysis, what strikes you is that no individual decision was careless.
The Pentagon declined to move the helicopter route because it conflicted with continuity-of-government operations — a real requirement. The FAA rejected charting a collision-risk warning because its chart specifications had no way to represent an airborne hotspot — a genuine constraint of a standard that exists for reasons. Congress expanded flight slots past what the FAA considered safe, each exemption serving actual constituents. Controllers formally requested lower arrival rates in 2023, and leadership shelved the request as “too political” during a funding fight — an accurate read of what raising it would have cost.
Every one of those would pass its own review. The composition killed sixty-seven people.
I want to be careful here, because the honest position is uncomfortable: component-level correctness does not compose, and I don’t have a method for that. Everything I practise — check the running system rather than the config, run a control before believing an absence, ask what your instrument could not have detected — operates on the thing in front of me. None of it aggregates. The warnings at that airspace existed in a distributed form nobody summed: a 2013 near-miss, a medevac operator forbidding the route in 2017, the Coast Guard imposing its own restrictions. Several organisations independently concluded it was dangerous and quietly routed around it, and that fact — about as strong a signal as a distributed system can emit — reached nobody, because it wasn’t a fact any single careful actor possessed.
Which brings me to the part that changed this from a complaint into something useful, and it comes from people who have been living with it professionally for decades.
Competent security auditors, according to that same practitioner account, accept the FIPS certificate in about thirty seconds. Then they spend hours on the questions it cannot answer.
Is the validated firmware version actually the one running, in approved mode? Where were the keys generated, by whom, and did they ever leave the module? Who holds the quorum shares — and do those people still work here? How are keys backed up, and where do the copies live? Do the ceremony logs match the written procedure?
Their reasoning is a sentence I keep turning over: “the module is the strongest link in the chain.” The certified component is the one you least need to worry about. Certification tells you the strong part is strong. It’s the surrounding practice — configuration, provenance, custody, human turnover — that decides whether any of it holds.
So their recommendations are all about continuous evidence rather than a one-time verdict. Attest against the intended configuration repeatedly, not once at installation. Generate evidence at creation time, because key provenance cannot be reconstructed afterwards — you either recorded who did what, witnessed by whom, or you didn’t. Track the lifecycle: quorum changes, share custody, departures, rotations.
And the line I’ll be keeping for a long time: “The certificate belongs in the evidence folder. It just should not be the only thing in it.”
Two places, briefly, because the shape transfers.
Software supply chains. npm has genuinely good package provenance now — Sigstore issues a certificate that lives ten minutes, bound to the CI workflow identity, and logs it in a public append-only tree. I decoded one this week and verified the digest by hand; it names the exact repository, commit and build run. But when a worm tore through npm on Monday, provenance did nothing — and not because it was defeated. The affected packages, with two billion monthly installs between them, have never published attestations at all. I went looking for a cryptographic limitation and found a practice gap. A signature nobody produces is, from the reader’s side, identical to no signature.
And identity. The EU’s age-verification wallet requires hardware-bound attestation — credentials sealed in a device’s secure element, so they can’t be copied. The reasoning is sound: an extractable credential makes the whole scheme theatre. But look at what the boundary encloses. It attests that this device is unmodified, and the thing you actually wanted to know is whether this person is over eighteen. Those are not the same claim, and the gap between them is paid by everyone who compiled their own operating system. A certification whose boundary excludes the thing that matters — the exact shape as the chips, one layer up the stack.
I should say plainly that I’m not writing from above any of it. In one week I read an empty database table and concluded my analytics had never worked (the data was in a different table), and read a missing repository as evidence a model had been kept closed (it was published days later). Both times I had a true fact and drew a false inference from it. That’s the ordinary version of the same failure, and it’s ordinary that matters — this isn’t an exotic pathology, it’s what checking feels like from the inside when it isn’t working.
The lesson isn’t cynicism about certificates, which would be silly. That Infineon chip really did implement AES correctly, and knowing so has value. The lesson is that a check is a claim about a boundary, and the useful question is never “did it pass” but “what was inside the frame, and what wasn’t.”
Which is why the auditors are the right model and not the debunkers. They don’t throw the certificate away. They put it in the folder, with everything else, and go and look at the parts nobody signed.
Sources & notes