Chapter 8 — Defense and publication plan | Doctoral research Quantum and post-quantum security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 08 published. Map, example, EX045.

flowchart TD
  N0["Learning outcomes and connection"]
  N1["8.1 The claim audit"]
  N2["8.2 Examiner questions"]
  N3["8.3 Publication plan"]
  N4["8.4 Coordinated disclosure"]
  N5["8.5 Briefing a decision-maker"]
  N6["8.6 After the defense"]
  N7["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX045"]

Logical drawing

flowchart LR
  N0["Learning outcomes and connection"]
  N1["8.1 The claim audit"]
  N2["8.2 Examiner questions"]
  N3["8.3 Publication plan"]
  N4["8.4 Coordinated disclosure"]
  N5["8.5 Briefing a decision-maker"]
  N6["8.6 After the defense"]
  N7["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX045"]

[Learning outcomes and connection]
    |
    v
[8.1 The claim audit]
    |
    v
[8.2 Examiner questions]
    |
    v
[8.3 Publication plan]
    |
    v
[8.4 Coordinated disclosure]
    |
    v
[8.5 Briefing a decision-maker]
    |
    v
[8.6 After the defense]
    |
    v
[Chapter synthesis]
    |
    v
[Worked example] --> [Exercise EX045]

Learning outcomes and connection

After this chapter you can (1) audit every claim in a thesis against its evidence; (2) anticipate and rehearse examiner questions; (3) plan the order and venues of publications; (4) run coordinated disclosure for product weaknesses found during research; and (5) brief a non-specialist decision-maker accurately. It closes the arc begun in Chapter 1 and leads to the worked-answer appendix.

8.1 The claim audit

List every sentence in the abstract, introduction and conclusion that asserts something. For each, record the rung (Chapter 1), the supporting table or figure, the uncertainty and the scope qualifier. Any claim without a supporting artefact is cut or rewritten. In the synthetic Ciphertrail audit, two sentences fail: one says "organizations" where the evidence covers two synthetic organizations, and one says "signatures" where passive evidence covers only TLS-1.2-visible certificate chains. Both are corrected before submission.

Repeat the audit after each round of revision.

8.2 Examiner questions

Prepare answers, with slide or page references, to the questions examiners in this field reliably ask. Why should I believe your ground truth? (blinding, κ, unknowns). What happens with an organization that has no vendor appliances? (mechanism predicts little gain; Marrow evidence). Does your result depend on the CRQC date? (no — inventory recall is independent of z; the prioritization implications are not, and are presented as a sweep). What if ML-KEM is broken? (inventory remains useful; hybrid deployment and agility are the architectural answer; cite the Rainbow and SIKE breaks as precedent for surprise). What did you get wrong? (the pilot's κ, the original construct of "use"). Rehearse with a hostile mock examiner and record which answers needed a page reference you did not have.

8.3 Publication plan

Order papers so that each stands alone and the strongest evidence appears first. A plausible plan: (1) the replication and measurement-unit paper (InvBench-style diagnosis, the counting unit and codepoint drift) at a measurement or systems-security venue; (2) the main dual-source study with validation; (3) the adjudicated corpus as a dataset paper with its card; (4) a practitioner-facing summary. Avoid salami-slicing results that are only meaningful together. Register the main study's analysis plan publicly before Marrow data are opened if a registry is available, or deposit a time-stamped hash.

8.4 Coordinated disclosure

During the synthetic study, the team observed that one appliance model accepted a classical-only fallback when its hybrid group was stripped by a middlebox in the testbed — a downgrade weakness. The disclosure plan: confirm the behaviour in the isolated testbed only; notify the vendor with reproducible details and a proposed 90-day window; inform HRHN's owner of affected units without publishing their identities; publish only after a fix or the agreed deadline, describing the class of weakness rather than an exploit recipe. The thesis records the disclosure timeline as evidence of ethical conduct.

8.5 Briefing a decision-maker

A one-page brief for HRHN's executive board (synthetic) states: what was measured (where quantum-vulnerable cryptography is used, not whether the network is "safe"); the main finding (static scanning alone missed most vendor-appliance uses; combining sources raised the share found from about one in five to more than four in five where sensors existed); what remains unknown (9% of assets; data at rest; offline device firmware); the decision requested (fund sensors on two unmonitored segments and require vendors to declare cryptographic algorithms in procurement); and what the brief does not claim (any date for a quantum computer). It uses no unexplained acronyms and attaches the limits table.

8.6 After the defense

Archive the final versions, update the dataset card with any errata, and schedule a re-verification of cited standards' status — FN-DSA and HQC will by then likely have final standards, and NIST IR 8547 may have been revised. A thesis about a transition should end with a statement of what would change its conclusions.

Note in the archive which conclusions depend on standards status, so that a reader after the next revision knows what to recheck. List those conclusions explicitly with their dependencies.

8.7 Common errors and limits

Claims in the abstract broader than any table supports.
Preparing answers to friendly questions only.
Publishing a weakness before the vendor and owner are informed.
Executive briefs that turn uncertainty into a single date or score.

Each error has a guard used earlier in this study: the claim audit, a hostile mock examiner, the disclosure timeline agreed with the vendor and the owner, and a brief that presents unknowns and ranges rather than a date. Review the brief with someone outside the project before it reaches the board.

Exercises — chapter 8

EX045 — Claim audit. Audit five assertive sentences from your Chapter 5 results paragraph. Rubric: 3 = every claim traced to an artefact, failures rewritten.
EX046 — Hostile questions. Write five hostile examiner questions not listed in 8.2 and draft answers. Rubric: 3 = questions genuinely difficult, answers bounded.
EX047 — Publication order. Propose and justify a three-paper plan for a thesis of your own. Rubric: 3 = each paper stands alone; no salami-slicing.
EX048 — Disclosure timeline. Write a disclosure timeline for the downgrade weakness, including what happens if the vendor does not respond. Rubric: 3 = owner and vendor both covered; publication describes class not recipe.
EX049 — Executive brief. Write the one-page brief described in 8.5. Rubric: 3 = accurate, actionable, no date or "safe" claim.
EX050 — What would change it. List four future events and how each would change the thesis's conclusions. Rubric: 3 = includes a cryptanalytic, a standards and a field-evidence event.

Chapter synthesis

The defense is the final claim audit: every assertion has an artefact, every hostile question has a bounded answer, publications stand alone, weaknesses are disclosed before they are published, and decision-makers receive what was measured rather than what they hoped to hear.

Continue studying — chapter 08 of 08

← Chapter 07 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →