Chapter 29 — Cryptography and trust services: measurement
Lesson map
Lesson 29 published. Map, example, EX085.
flowchart TD
N0["Learning outcomes"]
N1["29.1 What to measure"]
N2["Lab — Cryptoperiod audit"]
N3["29.2 Reading the audit"]
N4["29.3 Dashboards that drive action"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX085"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["29.1 What to measure"]
N2["Lab — Cryptoperiod audit"]
N3["29.2 Reading the audit"]
N4["29.3 Dashboards that drive action"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX085"]
[Learning outcomes]
|
v
[29.1 What to measure]
|
v
[Lab — Cryptoperiod audit]
|
v
[29.2 Reading the audit]
|
v
[29.3 Dashboards that drive action]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX085]
Learning outcomes
You will (1) measure key-management health with inventory data; (2) report overdue keys against cryptoperiods; (3) build a measurement dashboard that drives action.
29.1 What to measure
Aiyana designs metrics for the trust service: share of keys within their cryptoperiod, days to expiry for certificates, verification failure rates, firmware version spread across meters, and time to revoke a compromised key in exercises. SP 800-57 Part 1 recommends cryptoperiods for key types; measuring adherence turns that guidance into management information. Each metric has a definition, data source and target, so two analysts produce the same number from the same data. She keeps the list short, because a dashboard with fifty metrics hides the few that matter, and agrees each definition with the team that owns the data.
Lab — Cryptoperiod audit
"""Key inventory ages against a 365-day cryptoperiod (synthetic utility keys, fixed audit date)."""
from datetime import date
AUDIT = date(2026, 6, 30); PERIOD = 365
KEYS = [("telemetry-tls", date(2026, 1, 10)), ("fw-signing", date(2024, 2, 1)),
("db-at-rest", date(2025, 9, 1)), ("webhook-hmac", date(2025, 5, 20)), ("backup-wrap", date(2023, 11, 5))]
def main():
over = 0
for name, made in KEYS:
age = (AUDIT - made).days; late = age > PERIOD; over += late
print(f"{name:<14} age {age:>4} d {'OVERDUE' if late else ''}")
print(f"overdue {over}/{len(KEYS)}")
if __name__ == "__main__":
main()
Run with python3 lab_rotation.py. Verified output:
telemetry-tls age 171 d
fw-signing age 880 d OVERDUE
db-at-rest age 302 d
webhook-hmac age 406 d OVERDUE
backup-wrap age 968 d OVERDUE
overdue 3/5
29.2 Reading the audit
On the synthetic audit date of 30 June 2026, three of five sampled keys exceed a 365-day cryptoperiod: the firmware signing intermediate at 880 days, the webhook HMAC key at 406 and the backup wrapping key at 968. Only the telemetry TLS key and the database key are within period. Aiyana does not panic: an overdue key is not necessarily compromised, but the longer a key is used, the more data it protects and the greater the impact of undiscovered exposure. She schedules rotations by risk, starting with the firmware intermediate.
29.3 Dashboards that drive action
Aiyana's dashboard shows each metric with its target, trend and owner. Overdue keys appear as a list with owners and planned rotation dates, not just a percentage. Monthly reviews ask why metrics moved. She avoids vanity metrics, such as counting keys generated, which say nothing about safety. When the firmware intermediate is rotated, the dashboard records the change, and the overdue share drops from three of five to two of five, giving the team visible progress. Owners must explain any red item at the next review.
Worked example
Aiyana's audit finds three of five keys overdue, schedules rotation starting with the firmware intermediate, and builds a dashboard of owned metrics with targets.
Synthetic case. The keys and dates are invented; SP 800-57 Part 1 is real.
Errors and limits
Metrics can encourage gaming, such as renaming keys to reset ages. Cryptoperiods are guidance to be adapted to risk, not universal constants.
Exercises
- EX085 — Overdue keys. Which sampled keys were overdue and by age? Rubric: 3 = fw-signing 880, webhook-hmac 406, backup-wrap 968 days;; 2 = names;; 1 = count only;; 0 = none.
- EX086 — Overdue meaning. Does overdue mean compromised? Explain. Rubric: 3 = no; longer use increases data protected and impact of undetected exposure;; 2 = no;; 1 = yes;; 0 = none.
- EX087 — Vanity metric. Give an example of a vanity metric Aiyana avoids. Rubric: 3 = counting keys generated;; 2 = similar;; 1 = real metric;; 0 = none.
Synthesis
Measuring adherence to cryptoperiods and other key-health metrics, with owners and targets, turns standards into action.
Continue studying — chapter 29 of 50
← Chapter 28 (draft) · Course chapter index · Chapter 30 (draft) →