◇ OpenCyber Academy
Postgraduate · Chapter 2 · English

Chapter 2 — Cryptography and trust services: current practice

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 2 — Cryptography and trust services: current practice

Lesson map

Lesson 02 published. Map, example, EX006.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 What current practice means"]
  N2["Lab — Endpoint inventory"]
  N3["2.2 Reading the inventory"]
  N4["2.3 Key types and certificates"]
  N5["2.4 Where Corvane lags"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX006"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 What current practice means"]
  N2["Lab — Endpoint inventory"]
  N3["2.2 Reading the inventory"]
  N4["2.3 Key types and certificates"]
  N5["2.4 Where Corvane lags"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX006"]

[Learning outcomes]
    |
    v
[2.1 What current practice means]
    |
    v
[Lab — Endpoint inventory]
    |
    v
[2.2 Reading the inventory]
    |
    v
[2.3 Key types and certificates]
    |
    v
[2.4 Where Corvane lags]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX006]

Learning outcomes

You will (1) survey current cryptographic practice from standards; (2) build an endpoint inventory and read it; (3) identify where an organisation lags current practice.

2.1 What current practice means

Current practice is set by standards and widely deployed defaults, not by vendor marketing. For transport security it is TLS 1.3 from RFC 8446, with TLS 1.2 still acceptable when configured carefully, and older versions retired. For key exchange it is ephemeral elliptic-curve Diffie-Hellman such as X25519 from RFC 7748; for signatures, ECDSA or EdDSA under FIPS 186-5; for symmetric encryption, AES-GCM under SP 800-38D. Key management follows SP 800-57 Part 1, and algorithm transitions follow SP 800-131A. Leila writes a one-page summary of these references for Corvane's engineers so that later debates start from shared ground.

Lab — Endpoint inventory

"""Summarise a synthetic TLS endpoint inventory for an organisation-scale decision."""
from collections import Counter
# (business unit, highest TLS version offered, accepts legacy <=1.1?, cert key type)
EP = ([("ports", "1.3", False, "ecdsa")] * 46 + [("ports", "1.2", True, "rsa2048")] * 9 +
      [("fleet", "1.3", False, "ecdsa")] * 38 + [("fleet", "1.2", False, "rsa2048")] * 21 +
      [("finance", "1.3", False, "rsa3072")] * 30 + [("finance", "1.2", True, "rsa2048")] * 4 +
      [("legacy-edi", "1.2", True, "rsa2048")] * 12)

def main():
    n = len(EP)
    print(f"endpoints {n}")
    for v, c in sorted(Counter(e[1] for e in EP).items()):
        print(f"  max TLS {v}: {c} ({100 * c / n:.1f}%)")
    leg = Counter(e[0] for e in EP if e[2])
    print("legacy-accepting by unit:", dict(leg), "total", sum(leg.values()))

if __name__ == "__main__":
    main()

Run with python3 lab_inventory.py. Verified output:

endpoints 160
  max TLS 1.2: 46 (28.8%)
  max TLS 1.3: 114 (71.2%)
legacy-accepting by unit: {'ports': 9, 'finance': 4, 'legacy-edi': 12} total 25

2.2 Reading the inventory

Corvane's synthetic inventory lists 160 TLS endpoints. Of these, 114 (71.2 percent) offer TLS 1.3 and 46 (28.8 percent) top out at TLS 1.2. Twenty-five endpoints still accept TLS 1.1 or older: nine in ports, four in finance and all twelve on the legacy EDI platform. Leila notes that the fleet unit has many TLS 1.2-only endpoints but none accepting legacy versions, so it is behind but not dangerous, whereas legacy EDI is both behind and exposed. The inventory changes the conversation from "Corvane is insecure" to a specific list of units, counts and owners.

2.3 Key types and certificates

The inventory also shows certificate key types: ECDSA on modern endpoints, RSA 3072 in finance and RSA 2048 on older services. RSA 2048 remains acceptable under current NIST guidance for now, but Leila records it as a migration candidate because certificates and keys with long lifetimes will need to move to stronger or post-quantum alternatives. She checks certificate lifetimes and finds that the EDI platform uses certificates valid for two years, renewed by hand, while most other units use automated ninety-day certificates through ACME, RFC 8555. Lifetimes are a proxy for automation maturity.

2.4 Where Corvane lags

Leila summarises gaps against current practice: legacy protocol acceptance in three units; manual certificate management on EDI; no central record of which applications use which keys; and no post-quantum readiness assessment. She ranks them by exposure and effort. Legacy acceptance on internet-facing EDI endpoints ranks first because partners connect over the internet. She avoids overstating: none of the gaps implies a known breach, and several have compensating controls such as network restrictions. Presenting gaps with context keeps executives focused rather than alarmed.

Worked example

Leila reads a 160-endpoint inventory, finds 25 legacy-accepting endpoints concentrated in EDI, ports and finance, and ranks four gaps with context.

Synthetic case. The inventory is invented; the cited standards are real.

Errors and limits

Inventories from scanning miss internal-only services and client-side settings. RSA 2048 is acceptable today but is not a long-term choice.

Exercises

Synthesis

Current practice is defined by standards; an inventory translates it into specific, owned gaps ranked by exposure.

Continue studying — chapter 02 of 12

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →