Chapter 41 — Quantum and post-quantum security: system optimization
Lesson map
Lesson 41 published. Map, example, EX081.
flowchart TD
N0["Learning outcomes"]
N1["41.1 Parameter choices"]
N2["41.2 Overhead reduction"]
N3["41.3 Risk-reduction prioritization"]
N4["Engineering note"]
N5["41.6 Optimisation that must not weaken security"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX081"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["41.1 Parameter choices"]
N2["41.2 Overhead reduction"]
N3["41.3 Risk-reduction prioritization"]
N4["Engineering note"]
N5["41.6 Optimisation that must not weaken security"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX081"]
[Learning outcomes]
|
v
[41.1 Parameter choices]
|
v
[41.2 Overhead reduction]
|
v
[41.3 Risk-reduction prioritization]
|
v
[Engineering note]
|
v
[41.6 Optimisation that must not weaken security]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX081]
Learning outcomes
You will (1) optimize parameter and algorithm choices across a system; (2) reduce handshake overhead with resumption and caching; (3) balance security categories against cost; and (4) prioritize remaining migration work for maximum risk reduction. It builds on Chapters 6, 36 and 39.
41.1 Parameter choices
ML-KEM-768 (category 3) is the common default for hybrid TLS; ML-KEM-1024 where policy requires category 5 (CNSA 2.0). ML-DSA-44 versus -65 trades size against margin. Choose per context with documented rationale, not "maximum everywhere".
For BPA, ML-KEM-768 fits the 1,300-byte budget and gives category 3, which suits its data. ML-DSA-65 is used for bills of lading where a few extra kilobytes per document are irrelevant, while ML-DSA-44 suits the crane bootloader with its tight memory. Each choice and its reason are recorded in the decision log.
41.2 Overhead reduction
Session resumption avoids repeated full handshakes; connection reuse amortizes certificate cost; certificate compression (RFC 8879) helps classical chains but compresses random-looking post-quantum keys and signatures poorly; trimming intermediate certificates where clients cache them reduces bytes.
Compression works on classical certificates because they contain repeated structures; ML-DSA keys and signatures are close to random, so there is little to remove. For BPA's vessels, resumption is the most effective measure because each ship reconnects many times a day and needs the full chain only on the first connection.
41.3 Risk-reduction prioritization
With limited budget, rank remaining work by exposure reduced per unit effort: flows carrying long-lived data × volume ÷ effort. A greedy ordering is usually good enough and transparent.
For example, a flow carrying 25-year customs data at high volume that needs a single configuration change scores far higher than a low-volume flow that needs an appliance replacement. Publishing the scores lets stakeholders see why their system is not first. Rerunning the ranking after each completed item keeps the list current as effort estimates change and new flows appear.
41.4 Worked example
BPA's remaining items: vessel links (high latency cost of large chains; moderate data lifetime), legacy VPN (high lifetime, appliance replacement cost), internal telemetry (low lifetime). Optimization: vessel links get hybrid key exchange only (cheap) with classical certificates and tuned resumption; legacy VPN gets PSK mixing now and appliance replacement next budget cycle; telemetry waits.
The vessel decision follows from the latency measurements: hybrid key exchange adds little, while a post-quantum chain adds a 600-millisecond round trip. Splitting the change gets protection against harvest now without that cost.
41.5 Common errors and limits
- Category 5 everywhere without need.
- Expecting compression to shrink PQC signatures.
- Prioritizing by ease rather than exposure.
Category 5 everywhere adds bytes and computation for data that does not need it, as with ML-KEM-1024's larger 1,568-byte key against the 1,300-byte budget. Compression helps classical chains but cannot shrink random-looking post-quantum material much. Choosing work by ease rather than exposure leaves the 25-year customs flows waiting while simpler, low-value items are completed. BPA's ranking uses exposure divided by effort for every item and publishes the list so that each choice can be questioned.
Engineering note
Optimization decisions should be revisited when inputs change. A new browser release that supports post-quantum certificates, a firmware update that fixes a middlebox, or a revised policy date can reorder the remaining work. Keep the ranking as a small, version-controlled table with the assumptions written beside each score, and recompute it at every quarterly review rather than treating the first ranking as a permanent plan.
41.6 Optimisation that must not weaken security
Shrinking handshake size by dropping intermediate certificates or caching keys for longer can save milliseconds, but each such change is reviewed against BPA's confidentiality horizon. An optimisation that shortens latency but reintroduces a classical-only path for the 25-year customs data is rejected, however large the gain.
Each optimisation proposal therefore states which flows it affects and their data lifetimes. Reviewers check whether the change could remove the post-quantum share from any of those flows, for example by enabling a fallback path. Proposals that only touch certificates on short-lived sessions, such as resumption tuning for vessels, usually pass quickly.
Exercises
- EX081 — Rank. Rank five remaining BPA items by exposure ÷ effort with stated numbers. Rubric: 3 = method transparent and sensitivity noted.
- EX082 — Resumption. Explain how resumption changes the cost of large PQC chains for repeat clients. Rubric: 3 = correct with caveat about resumption and forward secrecy settings.
Synthesis
System optimization chooses parameters per context, reduces repeated overhead and orders remaining work by exposure reduced per unit effort.
Continue studying — chapter 41 of 50
← Chapter 40 (draft) · Course chapter index · Chapter 42 (draft) →