Chapter 15 — Security fundamentals
Lesson map
Lesson 15 published. Map, example, EX029.
flowchart TD
N0["Learning outcomes"]
N1["15.1 CIA in migration"]
N2["15.2 Security categories"]
N3["15.3 Attack models"]
N4["15.4 Defence in depth"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX029"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["15.1 CIA in migration"]
N2["15.2 Security categories"]
N3["15.3 Attack models"]
N4["15.4 Defence in depth"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX029"]
[Learning outcomes]
|
v
[15.1 CIA in migration]
|
v
[15.2 Security categories]
|
v
[15.3 Attack models]
|
v
[15.4 Defence in depth]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX029]
Learning outcomes
You will (1) apply confidentiality, integrity and availability to cryptographic migration; (2) explain security levels and NIST's five PQC categories; (3) distinguish attack models — passive recording, active man-in-the-middle and forgery; and (4) understand defence in depth. It prepares security architecture (Chapter 18).
15.1 CIA in migration
Confidentiality is threatened by recorded key exchanges; integrity and authenticity by future signature forgery on long-lived documents and firmware; availability by migration itself — oversized messages, incompatible clients, expired certificates. A plan that improves confidentiality but causes outages has failed on availability.
BPA's plan therefore lists, for each change, which property it improves and which it puts at risk. Hybrid TLS on the portal improves confidentiality and risks availability through larger handshakes; ML-DSA on bills of lading improves long-term integrity and risks availability for partners whose software cannot yet verify it. Each risk gets a mitigation, such as a canary or a dual-signature period.
15.2 Security categories
NIST defined five post-quantum security categories by comparison with the cost of breaking symmetric primitives: category 1 is at least as hard as key search on AES-128, category 3 as AES-192, category 5 as AES-256; categories 2 and 4 compare with SHA-256 and SHA-384 collisions. ML-KEM-512/768/1024 target categories 1/3/5 (FIPS 203). CNSA 2.0 requires the category-5 sets (ML-KEM-1024, ML-DSA-87) for national-security systems.
BPA does not handle national-security systems, so category 3 is its default, with category 5 only where data lifetimes are longest. The extra bytes of the larger sets are paid only where they buy something.
15.3 Attack models
Passive recording now, decryption later threatens confidentiality of anything protected by vulnerable key exchange today. Active attacks with a quantum computer — impersonating a server by forging signatures — require the CRQC to exist at the time of attack, so signature migration is less urgent for short-lived authentication but urgent for long-lived roots of trust. Forgery of archived signatures threatens documents whose signatures must remain meaningful for years.
Matching each BPA system to these models sets priorities: customs replication falls under the first, partner TLS authentication under the second, and bills of lading under the third.
15.4 Defence in depth
Hybrid key exchange is defence in depth across assumptions: an attacker must break both the traditional and the post-quantum component (RFC 9794). Agility is defence in depth across time: if one algorithm weakens, replace it quickly.
The two forms work together. Hybrid key exchange protects BPA if a flaw is found in ML-KEM, because X25519 still holds against classical attackers. Agility protects BPA if both weaken over time, since the policy file can switch algorithms without code changes. Neither helps if keys are stored carelessly, so storage controls remain a separate layer.
15.5 Worked example
BPA's bills of lading are signed with ECDSA and must be verifiable for 12 years. A CRQC within 12 years would allow forging a bill dated in the past unless the document carries a post-quantum signature or a trusted timestamp chain that is itself migrated. Priority: high — integrity of legal documents over long periods.
A trusted timestamp proves the document existed before a given date, so even a later forgery cannot be backdated past the stamp. BPA's choice is to re-stamp archived bills with a post-quantum timestamp authority and to sign new bills with ML-DSA-65, whose 3,309-byte signatures fit easily within document files.
15.6 Common errors and limits
- Treating PQC as confidentiality-only.
- Choosing category 5 everywhere without considering size and performance.
- Forgetting availability.
Treating PQC as a confidentiality problem only leaves bills of lading and firmware open to future forgery. Category 5 everywhere adds bytes and computation, for example ML-KEM-1024's 1,568-byte key against 768's 1,184, without a matching need for most BPA data. Availability failures, such as a middlebox rejecting large handshakes, can undo the whole programme's credibility. A plan that names its availability risks and mitigations up front keeps the support of operations teams when the first incident happens.
Exercises
- EX029 — Category choice. Recommend a category for BPA's portal and for a national-security partner link; justify. Rubric: 3 = category 3 (or 1) for portal with reasoning; category 5 per CNSA 2.0 for the partner.
- EX030 — Attack models. For VPN traffic, firmware signatures and bills of lading, state which attack model dominates. Rubric: 3 = recording; forgery of long-lived roots; archived-signature forgery.
Synthesis
Migration touches all of confidentiality, integrity and availability; categories tie PQC strength to symmetric benchmarks; urgency differs by attack model; hybrids and agility give depth.
Continue studying — chapter 15 of 50
← Chapter 14 (draft) · Course chapter index · Chapter 16 (draft) →