Chapter 8 — Cryptography and trust services: difficult cases
Lesson map
Lesson 08 published. Map, example, EX036.
flowchart TD
N0["Learning outcomes"]
N1["8.1 TLS inspection"]
N2["8.2 Lawful access requests"]
N3["8.3 Availability versus protection"]
N4["8.4 Learning from difficult cases"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX036"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["8.1 TLS inspection"]
N2["8.2 Lawful access requests"]
N3["8.3 Availability versus protection"]
N4["8.4 Learning from difficult cases"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX036"]
[Learning outcomes]
|
v
[8.1 TLS inspection]
|
v
[8.2 Lawful access requests]
|
v
[8.3 Availability versus protection]
|
v
[8.4 Learning from difficult cases]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX036]
Learning outcomes
You will (1) analyse cases where good cryptography conflicts with operations or law; (2) handle lawful-access and inspection requests; (3) resolve conflicts between availability and key protection.
8.1 TLS inspection
Corvane's network team wants to decrypt outbound TLS traffic to detect malware, using inspection proxies that re-sign connections with a corporate authority. Leila analyses the trade-off: inspection may catch threats, but it breaks end-to-end guarantees, concentrates a powerful signing key in the proxy and can weaken connections if the proxy's TLS is outdated. She recommends limited inspection for high-risk categories, exemptions for banking, health and partner traffic, strict protection of the proxy key, and regular checks that the proxy itself meets the TLS baseline.
8.2 Lawful access requests
A customs authority asks Corvane to provide decrypted shipment records for an investigation. Leila works with legal counsel: the request is valid under applicable law, and Corvane holds the keys for its own data, so it can comply with the specific records requested. She ensures the process follows a documented procedure, with approvals, logging and minimal disclosure. She also notes the contrast with end-to-end encrypted systems, where Corvane would not hold keys, and explains that design choices determine what an organisation can be compelled to provide.
8.3 Availability versus protection
A port terminal's HSM fails during a peak period, and operations asks to export signing keys to a standby server without an HSM to restore service quickly. Leila refuses export in plaintext, which would violate the key's protection requirements, and instead activates the documented standby HSM, which takes two hours longer. She records the incident and proposes a second HSM at the site. Difficult cases test whether controls hold under pressure, and decisions made under stress should follow plans agreed in calm.
8.4 Learning from difficult cases
Leila writes up each case using the same structure: context, conflicting goals, options, decision, rationale and follow-up. She shares anonymised versions with her postgraduate cohort. Classmates from other industries describe similar conflicts, such as hospitals inspecting traffic or banks handling regulator requests. Prof. Rao emphasises that difficult cases rarely have perfect answers; the professional task is to make trade-offs visible, follow law and policy and leave an auditable record. Several cohort members adopt the same structure in their own organisations, and the shared cases become material for a later seminar on professional judgement.
Worked example
Leila limits TLS inspection with exemptions, handles a customs request through documented lawful process, and refuses plaintext key export during an HSM failure in favour of the standby HSM.
Synthetic case. The cases are invented; legal requirements vary by jurisdiction.
Errors and limits
Inspection proxies become high-value targets. Pressure during incidents is when controls most often get bypassed.
Exercises
- EX036 — Inspection risks. Name two risks of TLS inspection. Rubric: 3 = two of breaks end-to-end guarantees, concentrates signing key, outdated proxy TLS weakens connections;; 2 = one;; 1 = vague;; 0 = none.
- EX037 — Inspection exemptions. Which traffic did Leila exempt from inspection? Rubric: 3 = banking, health and partner traffic;; 2 = two;; 1 = vague;; 0 = none.
- EX038 — Lawful request. Why could Corvane comply with the customs request? Rubric: 3 = it holds keys for its own data and the request was valid; followed documented procedure;; 2 = holds keys;; 1 = refused;; 0 = none.
- EX039 — HSM failure. What did Leila do when operations asked to export signing keys? Rubric: 3 = refused plaintext export; activated standby HSM despite two-hour delay;; 2 = refused;; 1 = exported;; 0 = none.
- EX040 — Case structure. What structure does Leila use for case write-ups? Rubric: 3 = context, conflicting goals, options, decision, rationale, follow-up;; 2 = four;; 1 = vague;; 0 = none.
Synthesis
Difficult cases force trade-offs between security, operations and law; documented procedures and visible reasoning keep decisions defensible.
Continue studying — chapter 08 of 12
← Chapter 07 (draft) · Course chapter index · Chapter 09 (draft) →