Chapter 5 — Cryptography and trust services: tools and interpretation
Lesson map
Lesson 05 published. Map, example, EX021.
flowchart TD
N0["Learning outcomes"]
N1["5.1 An inventory check"]
N2["Lab — Baseline flags"]
N3["5.2 Interpreting output"]
N4["5.3 Noise and false positives"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX021"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["5.1 An inventory check"]
N2["Lab — Baseline flags"]
N3["5.2 Interpreting output"]
N4["5.3 Noise and false positives"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX021"]
[Learning outcomes]
|
v
[5.1 An inventory check]
|
v
[Lab — Baseline flags]
|
v
[5.2 Interpreting output]
|
v
[5.3 Noise and false positives]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX021]
Learning outcomes
You will (1) run an inventory check over certificates and algorithms; (2) interpret tool output without over-claiming; (3) distinguish findings from tool noise.
5.1 An inventory check
Copperleaf keeps a simple inventory per client: each endpoint, its certificate expiry, its key type and size, its signature algorithm and the TLS versions it accepts. Dana writes a short script that reads Bayside's synthetic inventory and flags rows that break Copperleaf's baseline: certificates expiring within thirty days, RSA keys smaller than 2048 bits, SHA-1 signatures and acceptance of TLS 1.0 or 1.1. The baseline follows NIST guidance such as SP 800-131A Rev. 2 and SP 800-52 Rev. 2. The lab below shows the flags for five synthetic endpoints and the count of clean ones.
Lab — Baseline flags
# Flag synthetic endpoints against a simple baseline (NIST SP 800-131A/800-52 inspired).
import datetime
REVIEW = datetime.date(2026, 3, 1)
eps = [("book.bayside.example", "2026-03-18", "RSA", 2048, "sha256", ["1.2", "1.3"]),
("clinic-srv.bayside.lan", "2027-01-10", "RSA", 1024, "sha256", ["1.2"]),
("printer.bayside.lan", "2028-05-02", "RSA", 2048, "sha1", ["1.0", "1.2"]),
("mail-gw.bayside.example", "2026-09-30", "ECDSA", 256, "sha256", ["1.1", "1.2", "1.3"]),
("api.bayside.example", "2026-11-20", "ECDSA", 256, "sha256", ["1.3"])]
clean = 0
for host, exp, kt, bits, sig, vers in eps:
f = []
d = (datetime.date.fromisoformat(exp) - REVIEW).days
if d <= 30: f.append(f"expires in {d} d")
if kt == "RSA" and bits < 2048: f.append(f"RSA-{bits}")
if sig == "sha1": f.append("SHA-1 signature")
old = [v for v in vers if v in ("1.0", "1.1")]
if old: f.append("TLS " + "/".join(old))
if f: print(f"{host:26} " + "; ".join(f))
else: clean += 1
print("clean endpoints:", clean)
Run with python3 lab_inventory.py. Verified output:
book.bayside.example expires in 17 d
clinic-srv.bayside.lan RSA-1024
printer.bayside.lan SHA-1 signature; TLS 1.0
mail-gw.bayside.example TLS 1.1
clean endpoints: 1
5.2 Interpreting output
A flag is a question, not a verdict. The script flags the old clinic printer for TLS 1.0, but the printer sits on an isolated network and only the server talks to it. The flag remains true, yet the risk is lower than for a public site. Dana records the flag, adds the context and lets the risk rating reflect both. She also notes where the data came from and when, because an inventory exported last month can miss a certificate renewed yesterday. Interpreting output means stating what the tool measured, what it could not see and what that implies for the client.
5.3 Noise and false positives
Scanners often report items that are technically accurate but irrelevant, such as a self-signed certificate on an internal management page reachable only from one admin laptop, or they misread a configuration. Dana checks each flag manually on a sample before reporting: she connects with openssl s_client or reads the certificate with openssl x509 and confirms the value. Confirmed issues become findings; misreadings are recorded as tool noise with a short explanation. This practice keeps reports credible, because one obviously wrong finding makes a client doubt every other line in the report.
Worked example
Dana runs the inventory lab, confirms the expiring booking certificate manually, downgrades the isolated printer's TLS 1.0 flag with context and records one scanner misreading as noise.
Synthetic case. Endpoints, sizes and dates are synthetic; NIST SP 800-131A Rev. 2 and SP 800-52 Rev. 2 are real.
Errors and limits
Baselines lag new guidance; review them yearly. Manual sampling may miss rare misreadings.
Exercises
- EX021 — Baseline rules. List the four baseline rules in Dana's script. Rubric: 3 = expiry within 30 days, RSA under 2048, SHA-1 signature, TLS 1.0 or 1.1 accepted;; 2 = three;; 1 = one;; 0 = none.
- EX022 — Lab flag count. How many endpoints did the lab flag and how many were clean? Rubric: 3 = four flagged, one clean;; 2 = count of one side;; 1 = wrong;; 0 = none.
- EX023 — Printer context. Why is the printer's TLS 1.0 flag rated lower? Rubric: 3 = it is isolated and only the server reaches it;; 2 = isolation;; 1 = flag false;; 0 = none.
- EX024 — Manual confirmation. How does Dana confirm a flag before reporting it? Rubric: 3 = connects with openssl s_client or reads the certificate with openssl x509;; 2 = tool named;; 1 = trusts scanner;; 0 = none.
- EX025 — Credibility. What does one obviously wrong finding do to a report? Rubric: 3 = makes the client doubt every other finding;; 2 = doubt;; 1 = vague;; 0 = none.
Synthesis
Tools produce flags; practitioners turn them into findings by confirming them, adding context and stating limits.
Continue studying — chapter 05 of 12
← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →