Chapter 25 — Design studio I
Lesson map
Lesson 25 published. Map, example, EX049.
flowchart TD
N0["Learning outcomes"]
N1["25.1 Brief"]
N2["25.2 Studio method"]
N3["25.3 Reference solution outline"]
N4["25.4 Critique examples"]
N5["Engineering note"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX049"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["25.1 Brief"]
N2["25.2 Studio method"]
N3["25.3 Reference solution outline"]
N4["25.4 Critique examples"]
N5["Engineering note"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX049"]
[Learning outcomes]
|
v
[25.1 Brief]
|
v
[25.2 Studio method]
|
v
[25.3 Reference solution outline]
|
v
[25.4 Critique examples]
|
v
[Engineering note]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX049]
Learning outcomes
You will (1) run a structured design studio on a real-shaped problem; (2) produce a design for hybrid key exchange at BPA's edge; (3) present and defend it with evidence; and (4) incorporate critique. It integrates Chapters 20–24.
25.1 Brief
Design quantum-resistant key establishment for BPA's public portal and partner API edge: 2 million connections per day, mixed client population (browsers, partner software, old handheld scanners), an inspection proxy on one path and a CDN in front of the portal. Constraints: no availability regression beyond the requirement in Chapter 21, budget for one appliance upgrade, six-month timeline.
The constraints pull in different directions. Two million daily connections mean even small failure rates produce many incidents; the old scanners may never support hybrid groups; one appliance budget cannot replace every device. Good designs say explicitly which constraint they relax and why.
25.2 Studio method
Teams produce: context diagram; requirements subset; two alternatives; trade study; chosen design with configuration sketch; test plan; risks. Each team presents for ten minutes and receives critique from a panel playing operations, security, partners and finance.
Presenting two alternatives forces teams to justify their choice instead of defending the first idea. The panel roles reflect real reviewers BPA would face: operations asks about monitoring, finance about cost, partners about compatibility. Teams that prepare evidence for each role, such as a test plan showing the proxy firmware has been checked, usually handle critique better than those relying on general arguments. The critique is recorded so teams can revise their design afterwards.
25.3 Reference solution outline
Terminate TLS at the CDN and edge proxy with X25519MLKEM768 offered first and X25519 as fallback for clients that do not support the hybrid group (RFC 10024); upgrade the inspection proxy firmware or bypass inspection for TLS 1.3 to partner APIs; leave handheld scanners on classical groups behind a short-term exception with a replacement date; measure negotiated groups via logs; staged rollout with canary gates. Note: hybrid key exchange protects against recording; certificates remain classical for now — documented as a known gap with a later work package.
25.4 Critique examples
Operations asks how fallback is monitored; security asks whether fallback could be forced (in TLS 1.3, only by breaking authentication or exploiting application-level retry logic, which must be checked); partners ask about their clients' library versions; finance asks about appliance costs. Good teams answer with evidence or add work items.
The security question is the subtlest: if an application retries every failed handshake without the hybrid group, an attacker can force failures and obtain classical connections. A good answer checks the portal's retry logic and logs any fallback.
25.5 Common errors and limits
- Designs that ignore the old client population.
- No measurement plan for negotiated groups.
- Claiming the portal is "quantum-safe" while certificates are classical.
The handheld scanners cannot be ignored: they need an exception with a replacement date, as the reference outline shows. Without measuring negotiated groups, nobody knows whether the rollout worked. Calling the portal "quantum-safe" while certificates remain classical misleads stakeholders, since active attacks with a future CRQC would still be possible; the outline documents this gap instead, with a later work package.
Engineering note
Studios also train the habit of writing down what the design does not do. The reference solution protects recorded key exchanges but not authentication, does not cover handheld scanners until replacement, and relies on vendor firmware for the inspection proxy. Listing these explicitly in the design record turns them into tracked work packages with owners, instead of discoveries made by an auditor. A design that states its gaps is easier to approve than one that appears complete but is not.
Exercises
- EX049 — Studio deliverable. Produce the context diagram (with text alternative) and the trade study for the brief. Rubric: 3 = two real alternatives, weights before scores.
- EX050 — Critique response. Answer the security panel's fallback question in 150 words. Rubric: 3 = TLS 1.3 transcript protection and application retry risk both addressed.
Synthesis
A design studio turns standards into a configured, measured and staged design whose gaps are stated and whose critics have been answered.
Continue studying — chapter 25 of 50
← Chapter 24 (draft) · Course chapter index · Chapter 26 (draft) →