iOS 26 adds post-quantum ML-DSA keys in Secure Enclave; Android support remains partial

·2 views

Apple's iOS 26 introduced hardware-backed ML-DSA post-quantum signing keys inside the Secure Enclave, using a familiar CryptoKit API that ties biometric authentication directly to the key rather than app logic. A developer building a cross-platform Capacitor plugin found iOS support straightforward, with private keys never leaving the device's secure processor. Android's Keystore similarly supports ML-DSA key generation with per-operation biometric authentication, offering comparable signing capabilities. However, Android does not expose ML-KEM, the post-quantum key encapsulation standard, to app-level code through the Keystore API, despite the algorithm being present in the device's secure hardware. This gap forces developers to implement ML-KEM in software on Android, requiring extra steps to protect the private key by encrypting it with a hardware-backed, auth-gated Keystore key.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Java Conditional Operator (?:): Syntax, Nesting Rules, and Interview Tips

Java's conditional operator (?:) is the language's only ternary operator, taking three operands to evaluate a boolean condition and return one of two values in a single line. Its syntax follows the pattern: result = (condition) ? valueIfTrue : valueIfFalse, making it a compact alternative to standard if-else assignments. The operator supports nesting, allowing multiple conditions to be chained similarly to if-else-if ladders, though deep nesting can reduce readability. Both branches of the operator must return compatible types; mismatched types such as an int and a String will cause a compiler error. Due to its concise syntax, type compatibility rules, and nesting behavior, the conditional operator is a commonly tested topic in Java technical interviews.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Data Scientist Tests 10 AI Coding Models: Cheaper Options Rival Premium Tiers

A data scientist spent three weeks evaluating ten large language models on five coding tasks — including bug fixing, algorithm design, and code review — using a consistent scoring rubric weighted on correctness, quality, documentation, and edge-case coverage. All models were tested under identical conditions via the same endpoint, with pricing drawn directly from provider pages. DeepSeek-R1 posted the highest raw score at 9.4, while budget options like DeepSeek V4 Flash and Qwen3-Coder-30B scored comparably at a fraction of the cost. A Pearson correlation analysis between price and quality returned r = 0.31, a statistically insignificant result, suggesting that higher spending does not reliably yield better code output. The findings challenge common assumptions about AI model procurement, with the reviewer noting that premium models often delivered only marginal quality gains over far cheaper alternatives.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Claude API Drops budget_tokens: Developers Must Switch to Adaptive Thinking

Anthropic's Claude models from version 4.7 onward have removed support for the budget_tokens parameter in the thinking configuration, causing 400 errors for developers relying on the old pattern. The fixed token budget system has been replaced by adaptive thinking, where the model itself determines how much reasoning to apply, guided by a new effort parameter ranging from low to max. Developers must replace thinking: { type: 'enabled', budget_tokens: N } with thinking: { type: 'adaptive' } and add an output_config effort level suited to each use case. Additional breaking changes include the removal of temperature, top_p, and top_k parameters on the same model versions, and thinking block text is now hidden by default during streaming unless display: 'summarized' is explicitly set. Early testing suggests that higher effort settings can sometimes reduce total token cost on multi-step agentic tasks by improving upfront planning and reducing the number of turns required.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Windows Stores Toast Notifications in SQLite Database, Raising Privacy Awareness

Windows 10/11 stores all toast notifications locally in a SQLite database file called wpndatabase.db, located in each user's AppData folder. Security researchers can query this database using standard SQL commands to retrieve notification history, including payload content, arrival time, and handler IDs. A practical example shows how an unsolicited 'Phone Link' setup reminder can be traced back to Microsoft's YourPhone app triggering a first-run experience notification. Users who do not use the Phone Link feature can remove the app entirely via a PowerShell command to stop such notifications. The finding highlights how built-in Windows apps can silently generate background activity that is logged and queryable on the local system.

0 comments Read more at DEV Community