Cleartext

Austin, 2027. A security engineer finds a post on an invite-only forum. It contains an API endpoint, a bearer token, and one line of instructions. Test it on something you think is safe. He sends RSA-4096 ciphertext from a training archive. It comes back decrypted in 1.4 seconds. He generates a fresh key pair, encrypts a new sentence, and tries again. 1.8 seconds. By the third successful test, he understands that one of the core assumptions underneath modern public-key cryptography is no longer holding.

A thousand miles east, at Fort Meade, a senior NSA cryptanalyst is handed a case. Someone outside the network has been using agency credentials through a relay chain that dies in three jurisdictions. He does not yet know who he is hunting. He does not yet know that the machine behind the credentials was not supposed to be used this way, or that a committee inside his own agency has been using it for months against Americans whose names never reached a FISA court.