Chapter 42 — Quantum and post-quantum security: applied research
Lesson map
Lesson 42 published. Map, example, EX083.
flowchart TD
N0["Learning outcomes"]
N1["42.1 Questions from practice"]
N2["42.2 Small studies"]
N3["42.3 Reading research"]
N4["42.4 Contributing back"]
N5["Engineering note"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX083"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["42.1 Questions from practice"]
N2["42.2 Small studies"]
N3["42.3 Reading research"]
N4["42.4 Contributing back"]
N5["Engineering note"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX083"]
[Learning outcomes]
|
v
[42.1 Questions from practice]
|
v
[42.2 Small studies]
|
v
[42.3 Reading research]
|
v
[42.4 Contributing back]
|
v
[Engineering note]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX083]
Learning outcomes
You will (1) formulate an applied research question from engineering work; (2) design a small study with measurable outcomes; (3) read and assess PQC research critically; and (4) contribute findings back to the community responsibly. It builds on Chapters 29, 36 and 38.
42.1 Questions from practice
Engineering raises research-worthy questions: how often do middleboxes mishandle large ClientHellos in a given sector? What is the real time-to-replace for different architectures? How accurate are inventory tools against adjudicated ground truth? The master's and doctoral books in this area develop such studies in depth.
Questions like these come from operations data that most organizations already have, such as handshake failure logs and change records, so a study can often start without new data collection.
42.2 Small studies
Define question, population, measurements, comparison and analysis before collecting data; use synthetic or authorized data; report intervals and limits. An engineering thesis (Chapter 49) can include one such study.
Fixing the analysis beforehand prevents choosing the comparison that gives the most interesting result after seeing the data. A study at BPA might ask whether hybrid handshakes fail more often on one proxy model than another, with the population being one month of synthetic replay traffic and the result reported as a difference in failure rates with its confidence interval. The written limits state what the replay cannot represent, such as real client diversity.
42.3 Reading research
Check what a paper's numbers measure (configured or negotiated? lab or field?), whether baselines are fair, whether code and data are available, and how old the results are — the field moves quickly, and results about draft algorithms may not apply to final standards.
A paper reporting hybrid adoption based on configured settings may overstate real protection, as BPA's own experience with configured and negotiated figures showed. Results measured on draft Kyber may differ in performance or interoperability from final ML-KEM. Checking whether code and data are published tells a reader whether the result can be reproduced or must be taken on trust. BPA's engineers note these points when citing a paper in a decision record.
42.4 Contributing back
Report interoperability bugs to implementers, publish anonymized aggregate findings, contribute test vectors, and participate in standards discussions. Coordinate disclosure of vulnerabilities.
BPA's report of the obsolete-codepoint issue to the partner's library maintainers helped other users of that library, not just BPA. Contributions of test vectors improve every implementation that runs them. Before publishing aggregate figures, the team checks that no partner or system can be identified from them. Participation in standards discussions lets operators raise practical problems, such as handshake size limits, while designs can still change.
42.5 Worked example
BPA's engineers ask whether their passive telemetry under-counts hybrid negotiation because of TLS 1.3 encrypted extensions. A small study compares server-log and wire-capture determinations on 1,000 synthetic sessions in the lab and finds agreement on the key-exchange group (visible in clear in ServerHello) but not on certificate algorithms (encrypted) — an applied finding that changes the measurement design.
The finding explains why the dashboard can report hybrid key exchange from passive data but must use configuration for certificate algorithms, a limit stated later in the thesis guidance.
42.6 Common errors and limits
- Studies designed after data collection.
- Applying draft-algorithm results to final standards.
- Publishing identifiable organizational data.
A study designed after seeing data tends to find what the team hoped to find, which is why the question and analysis are fixed first. Results on draft algorithms can mislead when applied to final standards, since details changed. Publishing identifiable data can expose partners or weaknesses; BPA aggregates and checks every figure before release, and a second engineer confirms that no partner can be recognized from the published tables.
Engineering note
Applied studies must respect the same authorization and minimization rules as operations. Use synthetic data or data from systems you are authorized to study, minimize identifiers at collection, get approval from the data owner before publishing aggregates, and route any product weakness through coordinated disclosure. These constraints rarely weaken an engineering study; they usually sharpen its question to what the organization actually needs to know.
Exercises
- EX083 — Question. Write an applied research question from your own engineering context with measurement plan. Rubric: 3 = measurable and bounded.
- EX084 — Paper check. Apply the 42.3 checklist to a PQC performance paper of your choice. Rubric: 3 = each check answered with evidence.
Synthesis
Applied research grows from engineering questions, uses small pre-planned studies, reads literature critically and contributes back responsibly.
Continue studying — chapter 42 of 50
← Chapter 41 (draft) · Course chapter index · Chapter 43 (draft) →