◇ OpenCyber Academy
Professional · Chapter 5 · English

Chapter 5 — Quantum and post-quantum security: tools and interpretation

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 5 — Quantum and post-quantum security: tools and interpretation

Lesson map

Lesson 05 published. Map, example, EX021.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 What tools show"]
  N2["5.2 Practical activity — Lab T"]
  N3["5.3 Blind spots"]
  N4["5.4 Interpreting questionnaires"]
  N5["5.5 From output to finding"]
  N6["5.7 Practice task"]
  N7["5.8 Asking the right follow-up"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX021"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 What tools show"]
  N2["5.2 Practical activity — Lab T"]
  N3["5.3 Blind spots"]
  N4["5.4 Interpreting questionnaires"]
  N5["5.5 From output to finding"]
  N6["5.7 Practice task"]
  N7["5.8 Asking the right follow-up"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX021"]

[Learning outcomes]
    |
    v
[5.1 What tools show]
    |
    v
[5.2 Practical activity — Lab T]
    |
    v
[5.3 Blind spots]
    |
    v
[5.4 Interpreting questionnaires]
    |
    v
[5.5 From output to finding]
    |
    v
[5.7 Practice task]
    |
    v
[5.8 Asking the right follow-up]
    |
    v
[Worked example] --> [Exercise EX021]

Learning outcomes

You will (1) read the output of configuration audits and inventory tools; (2) distinguish "offered" from "negotiated"; (3) recognise tool blind spots; (4) interpret supplier questionnaire answers; and (5) turn tool output into findings.

5.1 What tools show

Configuration audits show what a service offers and in which order. Log summaries from technical teams show what was negotiated. Certificate inventories show signature algorithms and expiry dates. Supplier questionnaires show claims. As a practitioner you will rarely run active tools yourself; you will read and interpret their output.

At MTI the configuration audit in Lab T showed what the claims portal offered; only log summaries could show what it negotiated. Keep the type of each output beside your finding so readers know whether it describes intent or operation.

5.2 Practical activity — Lab T

# Lab T (ch 5): audit synthetic TLS server configurations for post-quantum key exchange and preference order.
configs = {  # service: ordered list of offered groups (server preference) - synthetic
    "quote-api": ["X25519MLKEM768", "X25519", "secp256r1"],
    "claims-portal": ["X25519", "X25519MLKEM768", "secp256r1"],
    "insurer-sftp": ["ecdh-sha2-nistp256"],
    "hr-intranet": ["X25519", "secp384r1"]}
HYBRID = {"X25519MLKEM768", "SecP256r1MLKEM768", "SecP384r1MLKEM1024"}
for svc, groups in configs.items():
    offered = [g for g in groups if g in HYBRID]
    if not offered: verdict = "CLASSICAL ONLY"
    elif groups[0] in HYBRID: verdict = "OK (hybrid preferred)"
    else: verdict = "WARN hybrid offered but not preferred"
    print(f"{svc:17s} {verdict}")

Expected output:

quote-api         OK (hybrid preferred)
claims-portal     WARN hybrid offered but not preferred
insurer-sftp      CLASSICAL ONLY
hr-intranet       CLASSICAL ONLY

The claims portal "offers but does not prefer" hybrid: a configuration audit that only checked presence would report it as done, but most connections will still use classical key exchange. Always ask whether a tool checks preference and actual negotiation.

The script checks two things for each service: whether a hybrid group is offered at all, and whether it is first in the server's preference order. The quote API passes both checks. The SFTP server and the HR intranet fail the first. Note that the script works on configurations only; it cannot show what clients actually negotiate.

5.3 Blind spots

A passive sensor in TLS 1.3 sees the negotiated group but not the certificate, which is encrypted. An active scanner with an old library reports everything as classical. A configuration export may be stale. A questionnaire may describe a product version MTI does not run. Write the blind spot next to each result.

For MTI's broker portal, a passive sensor can show X25519MLKEM768 but not the RSA-2048 certificate, which came from configuration. Always pair a result with the source that covers its blind spot before reporting it.

5.4 Interpreting questionnaires

Good answers name algorithms and parameter sets (ML-KEM-768 per FIPS 203), protocols (TLS 1.3 hybrid group per RFC 10024; IKEv2 per RFC 9370), product versions and dates, and offer test access. Weak answers say "PQC-ready" or "roadmap under review". Score answers consistently, for example 0 = no answer, 1 = undated claim, 2 = dated roadmap naming algorithms and protocols, 3 = shipped and verifiable.

Apply the same scale to every supplier and keep the answer text with the score, so a reviewer can check it. A score of 2 is still a D grade until the product is observed. Where a supplier offers test access, ask MTI's technical staff to use it and raise the grade with what they find.

5.5 From output to finding

A finding states observation, source, date, impact, recommendation and owner. "Claims portal: hybrid group offered but X25519 preferred (configuration audit, 6 October). Impact: claims sessions remain HNDL-exposed. Recommendation: reorder groups to prefer X25519MLKEM768; verify with logs. Owner: Web Platform."

Each element has a purpose: the source and date let a reader judge freshness, the impact links the result to exposure, and the owner makes someone responsible. A finding missing any of them tends to be argued about instead of fixed. Write findings so the owner can act without asking you what you meant.

5.6 Worked example

The audit flags insurer-sftp as classical-only. The infrastructure team confirms the OpenSSH version predates hybrid support. Finding raised: upgrade and enable mlkem768x25519-sha256; coordinate with reinsurers whose clients may be old; owner Infrastructure; due in one quarter.

Note that the finding was raised only after the infrastructure team confirmed the version; the audit alone could have been stale. The reinsurer coordination is part of the finding because an upgrade on MTI's side protects only partners whose clients also support the hybrid method.

5.7 Practice task

Turn each Lab T line into a finding or an "as expected" note.

For each line, write observation, source, date, impact, recommendation and owner, or a one-line note explaining why no action is needed. The quote API should be an "as expected" note; the claims portal and both classical services need findings. Ask whether the HR intranet carries long-lived data before deciding its priority. Keep each finding to a few lines and name the owner. Ask a peer to review them.

5.8 Asking the right follow-up

When tool output surprises you, ask technical staff three questions before raising a finding: is the tool current enough to see post-quantum algorithms; is the data fresh; and does the result match another source? Many apparent findings disappear — or become more serious — after these checks.

At MTI, asking these questions about the insurer-sftp result led to the infrastructure team's version check, which turned a tool result into a confirmed finding. Record the answers to the three questions with the finding, so a reviewer can see what was checked and when.

5.9 Common errors and limits

Each error leads to a wrong report. Counting presence would have marked MTI's claims portal as done while most sessions stayed classical. Ignoring blind spots can hide a classical certificate behind a hybrid result. Inconsistent questionnaire scores make suppliers impossible to compare and invite complaints from those scored harshly. Check every tool-based finding against these three errors before it goes into the tracker. Correct any you find before reporting.

Exercises

Synthesis

Practitioners interpret tool and questionnaire output with attention to preference, negotiation and blind spots, and turn it into precise findings.

Continue studying — chapter 05 of 12

← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →