Chapter 11 — Applied project | Postgraduate Cryptography and trust services

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 11 published. Map, example, EX051.

flowchart TD
  N0["Learning outcomes"]
  N1["11.1 Project definition"]
  N2["11.2 Partner transition"]
  N3["11.3 Technical changes"]
  N4["11.4 Outcomes and residual risk"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX051"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["11.1 Project definition"]
  N2["11.2 Partner transition"]
  N3["11.3 Technical changes"]
  N4["11.4 Outcomes and residual risk"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX051"]

[Learning outcomes]
    |
    v
[11.1 Project definition]
    |
    v
[11.2 Partner transition]
    |
    v
[11.3 Technical changes]
    |
    v
[11.4 Outcomes and residual risk]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX051]

Learning outcomes

You will (1) deliver an applied project retiring legacy EDI cryptography; (2) coordinate partners through a transition; (3) measure outcomes and residual risk.

11.1 Project definition

Leila's applied project retires legacy cryptography on the EDI platform: twelve endpoints accepting TLS 1.1 or older, two-year manual certificates and RSA 2048 keys. The aim is that every EDI endpoint meets the baseline, certificates renew automatically, and all active partners migrate without lost shipments. Scope includes 140 partners, ranging from global carriers to small customs brokers. She defines success measures, risks and a communication plan before any technical change. She also secures a budget line for partner support, recognising that most of the effort will be human rather than technical, and agrees it with the finance director.

11.2 Partner transition

Leila segments partners by readiness. Large partners already support TLS 1.3 and move in the first month. Medium partners need configuration help, provided through a support desk. Small brokers using old client software receive free updated clients and step-by-step guides, with a test endpoint where they can check connections before the deadline. Monthly reminders show each partner's status. She negotiates a short extension for three brokers affected by a local internet outage, documenting the exception and its compensating controls. Weekly status dashboards help her focus effort.

11.3 Technical changes

The team deploys new EDI gateways configured to the baseline, with certificates from the internal ACME service renewed every ninety days and keys generated on the gateways. Old endpoints run in parallel during migration, monitored for remaining connections. When traffic on an old endpoint drops to zero for two weeks, it is shut down. Leila insists on vendor-supported configuration and no custom cryptographic code, and runs the pre-change compatibility scan from Chapter 7 before each cut-over. Each cut-over has a named engineer on call.

11.4 Outcomes and residual risk

After six months, all twelve legacy endpoints are retired; 138 of 140 partners have migrated, and the remaining two, inactive for a year, are formally offboarded. No shipments were lost, though four partners had delays of under a day. Certificates now renew automatically. Residual risks include RSA 2048 keys on some partner sides, outside Corvane's control, and the EDI protocol's message-size limit, which may complicate post-quantum signatures. Leila records both in the risk register with owners. She presents the outcomes to the steering committee.

Worked example

Leila's project retires all twelve legacy EDI endpoints, migrates 138 of 140 partners with no lost shipments, automates certificates and records residual risks.

Synthetic case. Partner counts and outcomes are invented.

Errors and limits

Hard deadlines without support harm small partners; exceptions need compensating controls. Parallel running must end, or old endpoints linger.

Exercises

EX051 — Project aim. State the project's aim.
Show marking criteria
Rubric: 3 = every EDI endpoint meets baseline, automatic renewal, all active partners migrate without lost shipments;; 2 = partial;; 1 = vague;; 0 = none.
EX052 — Small broker support. What support did small brokers receive?
Show marking criteria
Rubric: 3 = free updated clients, guides, a test endpoint, reminders;; 2 = two;; 1 = vague;; 0 = none.
EX053 — Shutdown rule. When is an old endpoint shut down?
Show marking criteria
Rubric: 3 = after traffic is zero for two weeks;; 2 = rule;; 1 = immediately;; 0 = none.
EX054 — Migration result. How many partners migrated, and what happened to the rest?
Show marking criteria
Rubric: 3 = 138 of 140; two inactive partners offboarded;; 2 = count;; 1 = wrong;; 0 = none.
EX055 — Residual EDI risk. Name one residual risk recorded.
Show marking criteria
Rubric: 3 = partner-side RSA 2048 keys or EDI message-size limit for PQ signatures;; 2 = one;; 1 = vague;; 0 = none.

Synthesis

Applied projects succeed when technical change is paired with partner support, monitored parallel running and honest residual-risk records.

Continue studying — chapter 11 of 12

← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →