OpenCyber AcademyLesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes and connection"]
N1["1.1 The object of study: a transition, not a primiti"]
N2["1.2 A ladder of claims"]
N3["1.3 Timelines as assumptions"]
N4["1.4 Do no harm while observing cryptography"]
N5["1.5 Data tiers"]
N6["1.6 Metrics that resist gaming"]
N7["1.8 Practical activity — Lab 1: Mosca's inequality u"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes and connection"]
N1["1.1 The object of study: a transition, not a primiti"]
N2["1.2 A ladder of claims"]
N3["1.3 Timelines as assumptions"]
N4["1.4 Do no harm while observing cryptography"]
N5["1.5 Data tiers"]
N6["1.6 Metrics that resist gaming"]
N7["1.8 Practical activity — Lab 1: Mosca's inequality u"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX001"]
[Learning outcomes and connection]
|
v
[1.1 The object of study: a transition, not a primiti]
|
v
[1.2 A ladder of claims]
|
v
[1.3 Timelines as assumptions]
|
v
[1.4 Do no harm while observing cryptography]
|
v
[1.5 Data tiers]
|
v
[1.6 Metrics that resist gaming]
|
v
[1.8 Practical activity — Lab 1: Mosca's inequality u]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes and connection
After this chapter you can (1) separate the five kinds of statement that PQC research produces and keep them labelled; (2) explain why claims about quantum timelines must be stated as conditional assumptions rather than predictions; (3) design an inventory study that cannot harm the systems it observes; (4) choose metrics that resist the most common ways of making a migration look finished; and (5) write a bounded protocol a review board could approve. The chapter builds on your entry research experience and prepares the literature mapping of Chapter 2.
1.1 The object of study: a transition, not a primitive
Most cryptography research studies an object that holds still: a scheme, a reduction, an implementation. Post-quantum security research usually studies something that moves. Organizations are replacing RSA, finite-field Diffie–Hellman and elliptic-curve algorithms — which Shor's algorithm would break on a sufficiently large fault-tolerant quantum computer (Shor 1997) — with algorithms standardized for quantum resistance: ML-KEM in FIPS 203, ML-DSA in FIPS 204 and SLH-DSA in FIPS 205, plus the stateful hash-based signatures LMS and XMSS profiled in NIST SP 800-208. The thing you measure is a moving boundary between quantum-vulnerable and quantum-resistant use, across protocols, products and decades of stored data.
That changes what counts as rigour. A reduction proof can be checked once. A claim such as "HRHN has migrated 80% of its key establishment" depends on how "use" was counted, who could see which systems, when the snapshot was taken and whether hybrid negotiation actually happened or was merely configured. The first discipline of this book is therefore to know which object a sentence describes: a primitive, a protocol, a deployment, an organization or an ecosystem.
1.2 A ladder of claims
Climb one rung at a time and never skip one in writing:
- Observation — "The passive sensor recorded 41,212 TLS 1.3 handshakes on segment B between 1 and 7 March (synthetic); 63% selected group X25519MLKEM768." This is a measurement by a named instrument.
- Inference — "Most browser-originated sessions on segment B are protected against harvest-now-decrypt-later collection of their key exchange, assuming ML-KEM-768 remains secure or X25519 remains secure." Note the explicit assumption: a PQ/T hybrid (RFC 9794) is designed to remain secure if either component holds.
- Claim — "Dual-source inventory recalls quantum-vulnerable key establishment in the HRHN corpus with recall 0.91 (95% CI 0.88–0.94)." A claim has scope, uncertainty and a method.
- Decision — "The steering group prioritized the VPN concentrator." A decision is made by people and may be right for reasons outside your evidence.
- Exposure — "Archived imaging studies encrypted under RSA-wrapped keys before 2026 remain decryptable by a future CRQC for as long as ciphertext copies exist." Exposure is the consequence you ultimately care about, and it frequently lies outside what any sensor can see.
The commonest integrity failure in this field is rung-skipping: a vendor scan (rung 1) becomes "the organization is quantum-safe" (an exposure statement) without any inference, claim or scope in between.
1.3 Timelines as assumptions
Nobody can currently observe when a cryptographically relevant quantum computer (CRQC) will exist. What can be observed is a sequence of published resource estimates. Gidney and Ekerå (2021) estimated that RSA-2048 could be factored in about eight hours with twenty million noisy qubits under stated hardware assumptions; Gidney (2025) revised the estimate to fewer than one million noisy qubits running for less than a week, again under explicit assumptions about error rates, cycle time and connectivity. These are results about algorithms and error-correction overheads, not forecasts of engineering progress.
Mosca (2018) framed the planning question as an inequality: if the confidentiality lifetime of data (x) plus the time to migrate (y) exceeds the time until a CRQC (z), then data encrypted today is at risk. A doctoral thesis may use this frame, but it must treat z as a parameter swept over a range and report how conclusions change, never as a single number borrowed from a survey. Lab 1 makes that sensitivity concrete.
Policy dates are a different kind of object again. NIST IR 8547 (initial public draft) proposes deprecating 112-bit quantum-vulnerable public-key algorithms after 2030 and disallowing them after 2035, and the NSA's CNSA 2.0 advisory sets its own transition targets for national-security systems. These are decisions by institutions; cite them as decisions, with their status, not as evidence about quantum hardware.
1.4 Do no harm while observing cryptography
Inventory research touches live systems. Active TLS scanning of an internal network can trip intrusion prevention, exhaust connection tables on embedded devices or, in a hospital, disturb a medical device. Passive capture records metadata that can reveal who talked to whom. Code scanning can surface secrets. A sound protocol therefore specifies: written authorization from the system owner; passive collection by default; active probing only against an agreed list, rate-limited and outside clinical hours; capture limited to handshake metadata (no application payload, no private keys); immediate deletion of any credential discovered; and a named person with stop authority. Downgrade experiments — forcing a client to fall back from hybrid to classical groups — belong only in an isolated testbed, because they deliberately weaken real protection.
The Menlo Report's principles (Dittrich and Kenneally 2012) — respect for persons, beneficence, justice and respect for law and public interest — map directly onto these choices. Beneficence, in particular, means that a finding of a weak legacy device is reported to the owner before it is published.
1.5 Data tiers
Classify every artefact before it exists. Tier 0 (public): code, synthetic data, aggregate counts. Tier 1 (restricted): de-identified handshake metadata with hostnames replaced by stable pseudonyms. Tier 2 (confidential): raw packet captures, configuration files, certificate inventories that reveal internal architecture. Tier 3 (never collected): private keys, session keys, application payload, patient data. A protocol that cannot say which tier an artefact belongs to is not ready for review.
In the Ciphertrail Study the pseudonymized handshake export is tier 1 and the raw captures from HRHN segments stay at tier 2 on HRHN premises. Any credential discovered in code scanning moves to tier 3 handling at once: it is deleted, its owner is told, and the incident is logged without the value. The tier is written on the file itself as well as in the protocol.
1.6 Metrics that resist gaming
"Percentage of systems migrated" is the metric most likely to mislead. It can be raised by redefining "system", by counting configured rather than negotiated algorithms, or by excluding devices the scanner cannot reach. Prefer metrics with a denominator someone else can audit: recall of quantum-vulnerable uses against an adjudicated ground truth; precision of reported findings; negotiated-hybrid share weighted by data sensitivity; unknown share — the fraction of assets whose cryptography could not be determined, reported separately rather than silently treated as safe; and time-to-replace for a chosen algorithm, which measures agility rather than a one-time migration.
1.7 Worked example: the first protocol review of the Ciphertrail Study
The candidate's first draft proposes active scanning of all 1,200 HRHN services and reports "% quantum-safe". The review board (synthetic) returns five objections. (a) Active scanning of the segregated medical-device network is unjustified when passive capture at the boundary suffices; the revised protocol restricts active probes to 140 IT services and schedules them. (b) "Quantum-safe" is undefined; the revision replaces it with recall, precision and unknown share against an adjudicated sample. (c) Packet captures would contain patient-identifying hostnames; the revision pseudonymizes at the sensor and keeps raw captures at tier 2 on HRHN premises. (d) The CRQC date is cited from a single blog; the revision sweeps z and cites primary resource estimates. (e) No stop authority is named; the revision names HRHN's head of clinical engineering. Each objection forced a claim down to a rung the evidence could actually support.
1.8 Practical activity — Lab 1: Mosca's inequality under uncertainty
Run the script offline with Python 3. It treats z as a distribution chosen purely for teaching and asks how often x + y > z for four HRHN record classes.
# Lab 1 (synthetic): Mosca's inequality x + y > z under uncertainty.
# x = years the data must stay confidential, y = years to migrate,
# z = years until a cryptographically relevant quantum computer (CRQC).
# The z distribution below is an ARBITRARY teaching assumption, not a forecast.
import random
random.seed(7)
def p_exposed(x, y, trials=20000, z_lo=8, z_hi=30):
hits = 0
for _ in range(trials):
z = random.triangular(z_lo, z_hi, 15) # mode 15 years: illustrative only
if x + y > z:
hits += 1
return hits / trials
for name, x, y in [("appointment logs", 1, 4), ("lab results", 10, 4),
("genomic archive", 50, 4), ("lab results, slow migration", 10, 9)]:
print(f"{name:30s} x={x:2d} y={y:2d} P(x+y>z) = {p_exposed(x, y):.3f}")
# Sensitivity: the same record class under a different z assumption
print("lab results, z in [15,40] ", f"{p_exposed(10, 4, z_lo=15, z_hi=40):.3f}")
Expected output (seeded):
appointment logs x= 1 y= 4 P(x+y>z) = 0.000
lab results x=10 y= 4 P(x+y>z) = 0.234
genomic archive x=50 y= 4 P(x+y>z) = 1.000
lab results, slow migration x=10 y= 9 P(x+y>z) = 0.631
lab results, z in [15,40] 0.000
Read the output as a statement about the model, not about the world. The genomic archive is exposed under every assumption because its confidentiality lifetime alone exceeds any plausible z; migration speed cannot save data that has already been harvested. Lab results flip from 0.23 to 0.63 when migration slows, and to 0 under a more optimistic z range — which is exactly why a thesis must publish the sensitivity, not a single probability.
1.9 Common errors and limits
- Treating a resource estimate as a date. Estimates bound cost under assumptions; they do not schedule engineering.
- Counting configuration as negotiation. A server that offers a hybrid group protects nothing if no client selects it.
- Silent denominators. Assets the scanner cannot see must appear as "unknown", not disappear.
- Harmful observation. Active scans and downgrade tests on production can cause outages and weaken protection.
- Lab 1's distribution is arbitrary. Its value is the method of sensitivity analysis, not the probabilities.
- Turning a sensitivity table into a single headline probability.
Exercises — chapter 1
Each exercise is scored 0–3: 0 absent or unsafe; 1 partially correct with a major gap; 2 correct with minor gaps; 3 complete, scoped and justified.
- EX001 — Label the ladder. Objective: separate statement types. Input: five sentences from the worked example. Constraint: use only the five labels. Steps: label each, then rewrite any rung-skipping sentence. Evidence: a labelled table. Rubric: 3 = all labels correct and both rewrites scoped.
- EX002 — Define the object. Objective: name the object of a claim. Input: "Our hospital is 80% PQC-ready." Steps: list four objects it could describe and the metric each would need. Evidence: a four-row table. Rubric: 3 = objects distinct, metrics auditable.
- EX003 — Sweep z. Objective: sensitivity analysis. Input: Lab 1. Steps: change the mode of z to 10 and 25; report all four record classes. Evidence: a table and two sentences of interpretation. Rubric: 3 = correct runs and an interpretation that does not treat z as a forecast.
- EX004 — Harm review. Objective: identify harms of observation. Input: a plan to run active TLS probes against all medical devices nightly. Steps: list three harms and a safer design for each. Evidence: harm table. Rubric: 3 = harms realistic, alternatives preserve the research question.
- EX005 — Tier the artefacts. Objective: data classification. Input: packet capture, pseudonymized handshake CSV, certificate inventory, analysis notebook, a discovered private key. Steps: assign tiers 0–3 and the handling for each. Evidence: a table. Rubric: 3 = the private key is deleted and reported, not stored.
- EX006 — Ungameable metric. Objective: metric design. Input: "% of systems migrated". Steps: describe two ways to game it and propose a replacement with an auditable denominator. Evidence: metric definition. Rubric: 3 = replacement includes unknown share.
- EX007 — Bounded protocol. Objective: write a reviewable protocol. Steps: one page covering authorization, collection mode, tiers, stop authority, disclosure and metrics for the Ciphertrail Study. Evidence: the protocol. Rubric: 3 = every element present and consistent with 1.4–1.6.
Chapter synthesis
PQC research measures a transition whose most important quantity — when a CRQC exists — cannot be observed. Rigour therefore comes from labelled claims, timelines treated as swept assumptions, observation that cannot harm the observed, tiered data and metrics whose denominators an adversarial reader can audit.