Chapter 3 — Cryptography and trust services: specialist evidence | Postgraduate Cryptography and trust services

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 03 published. Map, example, EX011.

flowchart TD
  N0["Learning outcomes"]
  N1["3.1 Specialist questions"]
  N2["Lab — Post-quantum sizes"]
  N3["3.2 Reading the sizes"]
  N4["3.3 Where sizes matter at Corvane"]
  N5["3.4 Judging evidence quality"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX011"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["3.1 Specialist questions"]
  N2["Lab — Post-quantum sizes"]
  N3["3.2 Reading the sizes"]
  N4["3.3 Where sizes matter at Corvane"]
  N5["3.4 Judging evidence quality"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX011"]

[Learning outcomes]
    |
    v
[3.1 Specialist questions]
    |
    v
[Lab — Post-quantum sizes]
    |
    v
[3.2 Reading the sizes]
    |
    v
[3.3 Where sizes matter at Corvane]
    |
    v
[3.4 Judging evidence quality]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX011]

Learning outcomes

You will (1) gather specialist evidence on post-quantum readiness; (2) read standards for sizes and performance implications; (3) judge evidence quality for decisions.

3.1 Specialist questions

Post-quantum migration raises questions general staff cannot answer: which algorithms are standardised, how large their keys and signatures are, and what that means for protocols and devices. NIST published FIPS 203 (ML-KEM) for key establishment, FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) for signatures. Leila gathers evidence directly from these documents rather than from summaries, and records which parameter sets Corvane would likely use. She also notes that protocol integration, such as hybrid key exchange in TLS, is defined in IETF work that is still maturing, so dates and details must be rechecked.

Lab — Post-quantum sizes

"""Public-key and signature/ciphertext sizes in bytes, from RFC 7748/8032 and FIPS 203/204/205."""
ROWS = [("X25519 (RFC 7748)", "key share", 32, 32), ("ML-KEM-768 (FIPS 203)", "encaps key / ciphertext", 1184, 1088),
        ("Ed25519 (RFC 8032)", "public key / signature", 32, 64), ("ML-DSA-65 (FIPS 204)", "public key / signature", 1952, 3309),
        ("SLH-DSA-SHA2-128s (FIPS 205)", "public key / signature", 32, 7856)]

def main():
    for name, what, a, b in ROWS:
        print(f"{name:<29} {what:<24} {a:>5} / {b:>5}")
    print(f"ML-DSA-65 signature is {3309 / 64:.0f}x an Ed25519 signature")
    print(f"hybrid X25519+ML-KEM-768 client share: {32 + 1184} bytes")

if __name__ == "__main__":
    main()

Run with python3 lab_sizes.py. Verified output:

X25519 (RFC 7748)             key share                   32 /    32
ML-KEM-768 (FIPS 203)         encaps key / ciphertext   1184 /  1088
Ed25519 (RFC 8032)            public key / signature      32 /    64
ML-DSA-65 (FIPS 204)          public key / signature    1952 /  3309
SLH-DSA-SHA2-128s (FIPS 205)  public key / signature      32 /  7856
ML-DSA-65 signature is 52x an Ed25519 signature
hybrid X25519+ML-KEM-768 client share: 1216 bytes

3.2 Reading the sizes

The lab tabulates sizes from the standards. An X25519 key share is 32 bytes; an ML-KEM-768 encapsulation key is 1,184 bytes and its ciphertext 1,088. An Ed25519 signature is 64 bytes; an ML-DSA-65 signature is 3,309 bytes, about 52 times larger, and its public key 1,952 bytes. SLH-DSA-SHA2-128s keeps a 32-byte public key but produces 7,856-byte signatures. A hybrid TLS client share combining X25519 and ML-KEM-768 is 1,216 bytes. Leila concludes that bandwidth on modern networks is rarely the problem; constrained devices, certificate chains and protocols with fixed message limits are.

3.3 Where sizes matter at Corvane

Leila maps sizes onto Corvane's systems. Office and cloud traffic can absorb larger handshakes. Truck telematics units send small messages over expensive cellular links and verify firmware signatures with limited memory, so ML-DSA signatures and certificate chains need testing. Port terminal controllers run vendor firmware with long replacement cycles. The EDI platform's protocol has message-size limits that may break with large signatures. She classifies systems as ready, needing testing or blocked by vendors, and asks vendors for written migration plans rather than verbal reassurance.

3.4 Judging evidence quality

Leila grades evidence. Standards are authoritative on algorithms and sizes but say nothing about Corvane's vendors. Vendor statements are relevant but self-interested. Laboratory measurements on Corvane's own devices are strongest for local decisions but expensive. Public benchmarks may use different hardware. She records grades in her evidence table and uses the lowest-grade link in any argument to describe its overall strength. Prof. Rao notes that executives often treat vendor slides as facts, and that a postgraduate practitioner's value lies in showing where evidence is thin.

Worked example

Leila reads FIPS 203/204/205 sizes, finds ML-DSA-65 signatures 52 times larger than Ed25519, and classifies Corvane systems as ready, needing tests or vendor-blocked.

Synthetic case. Corvane's systems are invented; sizes come from RFC 7748, RFC 8032 and FIPS 203–205.

Errors and limits

Sizes alone do not determine performance; computation and memory matter too. IETF integration details change, so recheck before committing.

Exercises

EX011 — Standards map. Which FIPS standards cover ML-KEM, ML-DSA and SLH-DSA?
Show marking criteria
Rubric: 3 = FIPS 203, 204, 205 respectively;; 2 = two;; 1 = wrong;; 0 = none.
EX012 — Size ratio. How much larger is an ML-DSA-65 signature than Ed25519?
Show marking criteria
Rubric: 3 = 3,309 vs 64 bytes, about 52 times;; 2 = ratio;; 1 = wrong;; 0 = none.
EX013 — Hybrid share. What is the size of a hybrid X25519 plus ML-KEM-768 client share?
Show marking criteria
Rubric: 3 = 1,216 bytes;; 2 = close;; 1 = wrong;; 0 = none.
EX014 — Constrained systems. Which Corvane systems are most affected by size and why?
Show marking criteria
Rubric: 3 = telematics (cellular, memory), port controllers (vendor cycles), EDI (message limits);; 2 = two;; 1 = vague;; 0 = none.
EX015 — Evidence strength. How does Leila describe an argument's overall strength?
Show marking criteria
Rubric: 3 = by its lowest-grade evidence link;; 2 = weakest link;; 1 = average;; 0 = none.

Synthesis

Specialist evidence from standards and local testing, graded honestly, shows where post-quantum migration will hurt and where it will not.

Continue studying — chapter 03 of 12

← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →