Chapter 24 — Quantum and post-quantum security: controls
Lesson map
Lesson 24 published. Map, example, EX047.
flowchart TD
N0["Learning outcomes"]
N1["24.1 Control families"]
N2["24.2 Hybrid key establishment"]
N3["24.3 Matching controls to exposure"]
N4["24.4 Residual risk"]
N5["24.6 Practical activity"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX047"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["24.1 Control families"]
N2["24.2 Hybrid key establishment"]
N3["24.3 Matching controls to exposure"]
N4["24.4 Residual risk"]
N5["24.6 Practical activity"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX047"]
[Learning outcomes]
|
v
[24.1 Control families]
|
v
[24.2 Hybrid key establishment]
|
v
[24.3 Matching controls to exposure]
|
v
[24.4 Residual risk]
|
v
[24.6 Practical activity]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX047]
Learning outcomes
You will (1) list the main control families for quantum risk; (2) explain hybrid PQ/T key establishment and its terminology; (3) choose controls for HNDL and forge-later exposures; and (4) document residual risk after controls.
24.1 Control families
Controls for quantum risk fall into five families. Algorithm controls deploy post-quantum or hybrid algorithms. Data controls minimise, shorten or re-encrypt data so that less is exposed. Key-management controls add symmetric pre-shared keys or shorten key lifetimes. Architecture controls centralise cryptographic policy for agility. Governance controls include inventory ownership, procurement clauses and transition timelines.
Most HCU exposures need controls from more than one family. Governance controls are the slowest to show effect but keep the other families moving over the years a migration takes.
24.2 Hybrid key establishment
A PQ/T hybrid scheme, in the terminology of RFC 9794, combines a post-quantum and a traditional component so that the result is secure if either component is. In TLS, X25519MLKEM768 (RFC 10024) concatenates an ML-KEM-768 shared secret with an X25519 shared secret and feeds both into the key schedule. Hybrids hedge two risks at once: a future quantum computer (breaking X25519) and an unexpected classical break or implementation flaw in the new scheme. SP 800-227 discusses combining KEMs and approved key-combination methods.
24.3 Matching controls to exposure
For HNDL exposure, deploy hybrid key establishment on flows carrying long-lived data and minimise what those flows carry. For forge-later exposure, plan post-quantum signatures, starting with long-lived trust anchors and code signing, and procure devices that support them; where signatures must remain verifiable for decades, also plan archive timestamp renewal. For unknown items, the control is investigation: a vendor inquiry or lab test.
HCU's plan lists each exposure with the control chosen and the evidence that will show it worked.
24.4 Residual risk
No control removes all risk. After hybrid key exchange on the branch VPN, residual risks include classical authentication (forge-later, lower urgency), unknown devices behind branches and the chance that a configuration silently falls back to classical-only. State residual risk explicitly with an owner and review date; a migration report that claims "quantum-safe" without residual risk is not credible.
HCU monitors handshakes to detect silent fallback to classical-only groups. Each fallback is logged and reviewed by the network team within a week.
24.5 Worked example
HCU's control plan for the mortgage archive: (1) hybrid IKEv2 for branch transfers; (2) stop sending scanned documents nightly, sending them once on completion; (3) re-wrap archive keys with ML-KEM-based key transport inside the HSM when the HSM supports it; (4) residual risk: RSA-signed archive timestamps, owner Head of Records Management, review annually.
Item two is a data control that reduces exposure immediately and costs almost nothing. Item three depends on a vendor and is therefore dated by the HSM roadmap rather than by HCU. Item four names an owner for a risk that cannot yet be closed. Together they show that a credible plan mixes control families and admits what remains.
24.6 Practical activity
Produce a control table for three HCU exposures with control family, specific control, expected effect, owner and residual risk.
Choose exposures of different kinds, such as one HNDL-exposed flow, one forge-later trust anchor and one unknown device. Expected effect should be measurable, for example the share of a flow's traffic using hybrid key exchange. Name a real role as owner, not a team. Residual risk should state what stays exposed after the control and when it will be reviewed, so the table records what remains open as well as what was done.
24.7 Common errors and limits
- Claiming hybrid key exchange makes authentication post-quantum.
- Ignoring data controls, which are often the cheapest.
- Omitting residual risk.
Hybrid key exchange protects session secrets; signatures and certificates remain classical until changed separately. Data controls such as sending less, sending it less often or deleting it sooner often cut exposure faster and more cheaply than any algorithm change. Omitting residual risk makes a plan look finished when it is not, and readers who notice the gap stop trusting the rest of the report.
Exercises
- EX047 — Hybrid rationale. Give two distinct risks that a PQ/T hybrid hedges. Rubric: 3 = quantum break of traditional and classical/implementation break of PQ.
- EX048 — Control table row. Write a complete control row for HCU's internal root CA. Rubric: 3 = family, control, effect, owner, residual risk.
Synthesis
Algorithm, data, key-management, architecture and governance controls together reduce quantum risk; hybrids hedge both quantum and classical surprises, and residual risk must be stated.
Continue studying — chapter 24 of 40
← Chapter 23 (draft) · Course chapter index · Chapter 25 (draft) →