Iso/iec 24759:2025 | 2026 |

By 2028, every cryptographic module submitted for validation had to include a “24759:2025 conformance pedigree.” The Kalshira name became a verb in security audits: “Don’t Kalshira your RNG testing.”

Not hacked. Turned.

Dr. Aliya Voss, the GCA’s chief validation architect, stared at the logs. The modules in question were certified against the 2022 version of ISO/IEC 24759. At the time, they were gold standard. But the new 2025 revision—published just six months ago—had warned of exactly this vulnerability: a class of side-channel timing attacks that exploited speculative execution in post-quantum key encapsulation mechanisms. iso/iec 24759:2025

“Add new case: Kalshira. 2.2B records. Cause: module vendor skipped §8.47 to save 3% on validation cost. Standard was sufficient. Implementation was not.” By 2028, every cryptographic module submitted for validation

The story of ISO/IEC 24759:2025 isn’t about a document. It’s about the gap between what is tested and what is true. The 2025 revision didn’t just add tests—it added paranoia . And paranoia, Aliya learned, was just another word for having been burned before. Aliya Voss, the GCA’s chief validation architect, stared