◇ OpenCyber Academy
Bachelor's · Chapter 22 · English

Chapter 22 — Cryptography and trust services: data and dependencies

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 22 — Cryptography and trust services: data and dependencies

Lesson map

Lesson 22 published. Map, example, EX064.

flowchart TD
  N0["Learning outcomes"]
  N1["22.1 Cryptographic inventory"]
  N2["22.2 Library and algorithm dependencies"]
  N3["22.3 Supplier changes"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX064"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["22.1 Cryptographic inventory"]
  N2["22.2 Library and algorithm dependencies"]
  N3["22.3 Supplier changes"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX064"]

[Learning outcomes]
    |
    v
[22.1 Cryptographic inventory]
    |
    v
[22.2 Library and algorithm dependencies]
    |
    v
[22.3 Supplier changes]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX064]

Learning outcomes

You will (1) inventory cryptographic assets and dependencies; (2) track libraries and algorithms in use; (3) plan for supplier changes.

22.1 Cryptographic inventory

Priya builds an inventory of Tidewell's cryptographic assets: certificates with expiry dates and owners; keys with purposes, algorithms and locations; and protocols in use on each service. SP 800-57 Part 1 stresses knowing what keys an organisation has. She discovers two forgotten certificates on old servers and a backup key stored in a shared folder. The inventory turns invisible risks into a list with owners and becomes the basis for every later change, including algorithm migration. The inventory is reviewed monthly by Grace's team for accuracy.

22.2 Library and algorithm dependencies

Tidewell's systems depend on cryptographic libraries in operating systems, web servers and applications. Priya lists each library and version and records which algorithms each system uses. She finds that the contract-signing service uses RSA with 2048-bit keys and SHA-256, acceptable today, and that an old reporting tool uses SHA-1 for file checks. She notes NIST's guidance in SP 800-131A on transitioning away from SHA-1 and schedules the reporting tool's replacement. She stores the dependency list in the shared repository so that any team can see which systems a library update would affect.

22.3 Supplier changes

Several services come from suppliers, including the e-book provider and the portal host. Priya asks each for its cryptographic practices: TLS versions, key storage and plans for post-quantum migration. One supplier cannot answer about post-quantum plans; she records this as a risk rather than a failure, since migration is still at an early stage. She recommends adding cryptographic requirements to future contracts, such as supporting current TLS versions and notifying Tidewell of key compromises. Grace includes the requirement template in the next tender.

Worked example

Priya's inventory finds two forgotten certificates and a backup key in a shared folder, flags an SHA-1 tool for replacement, and adds cryptographic requirements to supplier contracts.

Synthetic case. Inventory findings are invented; SP 800-57 and SP 800-131A are real.

Errors and limits

Inventories decay without regular discovery scans. Supplier answers need evidence, not only assurances.

Exercises

Synthesis

A cryptographic inventory of keys, certificates, libraries and suppliers is the foundation for every safe change.

Continue studying — chapter 22 of 40

← Chapter 21 (draft) · Course chapter index · Chapter 23 (draft) →

Worked answers

EX064. Two forgotten certificates on old servers and a backup key sitting in a shared folder.

EX065. She scheduled its replacement, following the transition guidance in SP 800-131A.

EX066. She logged it as a risk rather than a failure, since migration is still early.