Chapter 4 — Academic writing
Lesson map
Lesson 04 published. Map, example, EX007.
flowchart TD
N0["Learning outcomes"]
N1["4.1 Claim, evidence, reasoning"]
N2["4.2 Citing standards and their status"]
N3["4.3 Writing about uncertainty"]
N4["4.5 Practical activity"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX007"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["4.1 Claim, evidence, reasoning"]
N2["4.2 Citing standards and their status"]
N3["4.3 Writing about uncertainty"]
N4["4.5 Practical activity"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX007"]
[Learning outcomes]
|
v
[4.1 Claim, evidence, reasoning]
|
v
[4.2 Citing standards and their status]
|
v
[4.3 Writing about uncertainty]
|
v
[4.5 Practical activity]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX007]
Learning outcomes
You will (1) structure an argument as claim, evidence and reasoning; (2) cite primary sources accurately, including their status; (3) write about uncertainty without overstating or hiding it; and (4) adapt one finding for a technical and a non-technical reader.
4.1 Claim, evidence, reasoning
Every paragraph in a security report should let the reader find three things: what you claim, what evidence supports it and why the evidence supports the claim. "HCU's VPN is quantum-vulnerable" is a claim. "The VPN configuration exported on 3 March negotiates only ECDH group 19" is evidence. "ECDH is broken by Shor's algorithm on a cryptographically relevant quantum computer, so recorded VPN traffic could be decrypted later" is reasoning. When one of the three is missing, readers either distrust a correct finding or accept an unsupported one.
4.2 Citing standards and their status
Cryptographic writing depends on standards whose status changes. Cite the document precisely — "NIST FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism Standard, August 2024" — with a persistent link such as its DOI. State the status when it matters: FIPS 203, 204 and 205 are final standards; NIST IR 8547 was an initial public draft on 12 October 2026, so its proposed transition dates are proposals, not rules; FN-DSA was still in development. Prefer primary sources over news articles, and check that the source actually says what you attribute to it. Many errors in migration reports come from quoting a secondary summary of a draft as if it were a final requirement.
4.3 Writing about uncertainty
Nobody knows when a cryptographically relevant quantum computer will exist. Good writing turns that uncertainty into explicit assumptions: "If such a machine exists within 15 years, records with a 30-year confidentiality requirement are already exposed to harvest-now-decrypt-later collection." Avoid both false precision ("in 2031") and dismissal ("decades away, ignore it"). Use ranges, state who made an estimate and when, and show how your recommendation changes across the range.
Two-part statements of this kind let the reader replace your assumption with their own and still use your reasoning. Say who made each estimate you cite and when.
4.4 Worked example
A draft sentence reads: "Quantum computers will break our encryption by 2030, so NIST requires us to switch to Kyber immediately." Rewritten: "Public estimates of when a quantum computer could break RSA-2048 vary widely and none is authoritative. NIST published ML-KEM, derived from CRYSTALS-Kyber, as FIPS 203 in 2024, and its draft IR 8547 proposes deprecating quantum-vulnerable algorithms after 2030 and disallowing them after 2035. Because our mortgage archive must stay confidential for 30 years, we recommend starting key-exchange migration for archive transfers this year." Each claim is now sourced, dated and qualified.
4.5 Practical activity
Take a one-page news article about quantum computing. Mark every factual claim, find its primary source if one exists, and rewrite the article's main conclusion in three sentences that respect the evidence.
Most news articles mix accurate facts with claims that have no source or that overstate one. Writing your three sentences forces you to decide what the evidence actually supports. Compare your version with a classmate's: if they differ, check whether one of you relied on a claim the other could not source. Keep the primary sources you found, as you will reuse them in later chapters.
4.6 Common errors and limits
- Citing a vendor blog for a standard's content.
- Presenting a draft's proposed dates as mandatory.
- Writing "quantum-proof" or "unbreakable"; prefer "designed to resist known quantum attacks".
A vendor blog may describe a standard accurately, but it may also mix in product claims or an earlier draft. Cite the standard itself. Draft documents propose dates for comment; they are not requirements until published in final form. Absolute words such as unbreakable promise more than any cryptographer can deliver, and readers who later learn of an attack will distrust everything else in the report.
Exercises
- EX007 — Claim, evidence, reasoning. Write a three-sentence finding that HCU's internal CA uses RSA-2048 and why that matters. Label each sentence C, E or R. Rubric: 3 = all three present and accurate.
- EX008 — Status discipline. Correct this sentence: "FIPS 206 requires Falcon for all signatures from 2025." Rubric: 3 = notes FIPS 206 was in development, names FN-DSA, removes the false requirement.
Synthesis
Clear security writing separates claim, evidence and reasoning, cites primary sources with their status and turns uncertainty into stated assumptions.
Continue studying — chapter 04 of 40
← Chapter 03 (draft) · Course chapter index · Chapter 05 (draft) →