Chapter 10 — Research reading and critique
Lesson map
Lesson 10 published. Map, example, EX046.
flowchart TD
N0["Learning outcomes"]
N1["10.1 Reading as a practitioner"]
N2["10.2 Evaluating attack claims"]
N3["10.3 Evaluating performance claims"]
N4["10.4 Translating research"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX046"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["10.1 Reading as a practitioner"]
N2["10.2 Evaluating attack claims"]
N3["10.3 Evaluating performance claims"]
N4["10.4 Translating research"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX046"]
[Learning outcomes]
|
v
[10.1 Reading as a practitioner]
|
v
[10.2 Evaluating attack claims]
|
v
[10.3 Evaluating performance claims]
|
v
[10.4 Translating research]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX046]
Learning outcomes
You will (1) read cryptographic research critically as a practitioner; (2) evaluate claims about attacks and performance; (3) translate research into organisational relevance.
10.1 Reading as a practitioner
Leila's cohort reads research papers and standards on topics affecting Corvane: side-channel attacks on post-quantum implementations, studies of TLS deployment and analyses of certificate ecosystems. Prof. Rao teaches a reading method: identify the claim, the threat model, the evidence and the conditions under which the claim holds. Leila applies it to Boneh and Shoup's chapters on authenticated encryption and to Shoup's paper on sequences of games, published on the IACR ePrint archive, learning how security proofs structure their arguments step by step.
10.2 Evaluating attack claims
Many headlines announce that an algorithm is "broken". Leila learns to ask whether the attack is practical, what resources it needs, whether it targets the algorithm or a specific implementation and whether patches exist. A side-channel attack on one implementation, requiring physical access, does not mean the standard is broken. Conversely, a cryptanalytic attack on an algorithm's structure, even if not yet practical, signals the need to plan migration. She writes one-paragraph briefs translating papers into "what this means for Corvane".
10.3 Evaluating performance claims
Performance studies of post-quantum algorithms report handshake times and sizes. Leila checks the hardware, software versions and network conditions, comparing them with Corvane's environment. A study on server-grade processors says little about telematics units. She replicates one benchmark on Corvane's own test devices using vendor libraries and finds results close to published figures for servers but slower on telematics units, confirming that local testing is needed for constrained systems. She publishes her measurement method internally so other teams can repeat it on their own devices before planning migrations.
10.4 Translating research
Leila maintains a research watch list for the programme: topics, key papers, standards status and relevance ratings. Each quarter she briefs the steering committee on changes, such as a new IETF document on hybrid key exchange or an implementation vulnerability in a library Corvane uses. She avoids flooding executives with papers; she reports only items that change risk or plans. Research reading thus becomes a programme input rather than an academic exercise. Executives say the brief is the most useful page in their pack.
Worked example
Leila applies a claim-threat-evidence-conditions method, separates implementation attacks from algorithm breaks, replicates a benchmark on telematics units and maintains a quarterly research watch list.
Synthetic case. The watch list and benchmarks are invented; Boneh–Shoup and Shoup (2004) are real.
Errors and limits
Headlines exaggerate; read the paper. Benchmarks rarely transfer across hardware.
Exercises
- EX046 — Reading method. What four elements does Prof. Rao's method identify? Rubric: 3 = claim, threat model, evidence, conditions;; 2 = three;; 1 = one;; 0 = none.
- EX047 — Broken claims. What questions does Leila ask of a "broken" headline? Rubric: 3 = practicality, resources, algorithm vs implementation, patches;; 2 = three;; 1 = vague;; 0 = none.
- EX048 — Side-channel meaning. Does a physical side-channel attack on one implementation break the standard? Rubric: 3 = no; it targets an implementation needing physical access;; 2 = no;; 1 = yes;; 0 = none.
- EX049 — Benchmark replication. What did Leila's replication show? Rubric: 3 = close to published figures on servers, slower on telematics units;; 2 = both;; 1 = one;; 0 = none.
- EX050 — Watch list rule. What does Leila report to executives from the watch list? Rubric: 3 = only items that change risk or plans;; 2 = filter;; 1 = everything;; 0 = none.
Synthesis
Practitioners read research for claims, threat models and conditions, then translate only what changes organisational risk.
Continue studying — chapter 10 of 12
← Chapter 09 (draft) · Course chapter index · Chapter 11 (draft) →