Chapter 3 — Quantum and post-quantum security: systems, data and dependencies
Lesson map
Lesson 03 published. Map, example, EX027.
flowchart TD
N0["Learning outcomes"]
N1["3.1 Listing services"]
N2["3.2 Data and lifetimes"]
N3["3.3 Who controls security"]
N4["3.4 Recording facts with their source"]
N5["3.5 Unknowns are questions"]
N6["3.6 Practical activity — Lab J"]
N7["3.7 Choosing priorities"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX027"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["3.1 Listing services"]
N2["3.2 Data and lifetimes"]
N3["3.3 Who controls security"]
N4["3.4 Recording facts with their source"]
N5["3.5 Unknowns are questions"]
N6["3.6 Practical activity — Lab J"]
N7["3.7 Choosing priorities"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX027"]
[Learning outcomes]
|
v
[3.1 Listing services]
|
v
[3.2 Data and lifetimes]
|
v
[3.3 Who controls security]
|
v
[3.4 Recording facts with their source]
|
v
[3.5 Unknowns are questions]
|
v
[3.6 Practical activity — Lab J]
|
v
[3.7 Choosing priorities]
|
v
[Worked example] --> [Exercise EX027]
Learning outcomes
You will (1) list the services a small organization depends on; (2) note what data each holds and for how long; (3) identify who controls the security of each service; (4) record facts with their source; (5) treat unknowns as questions; and (6) choose priorities.
3.1 Listing services
Start with what the business uses every day: the online shop, card payments, email, the staff portal, supplier file transfers, office Wi-Fi, the shop tills and any connected equipment such as an oven controller. Write each down with a one-line description.
Include things that are easy to forget because they just work: the office router, the card readers at the tills, and the cloud drive where Priya keeps receipts. For each service write who provides it and what it is for. A list made in ten minutes with Priya is a good start; it can be corrected later.
3.2 Data and lifetimes
For each service, note the kind of data it handles and how long that data must stay private. At BBO: customer accounts (names, addresses, order history; kept about ten years for tax and loyalty records); payroll files (twelve years); supplier contracts (seven years); order confirmations (useful for months). Long lifetimes mean harvest-now-decrypt-later matters more.
Ask Priya or her accountant how long each kind of record must be kept, rather than guessing. Write the lifetime in years next to each service, as Lab M uses them. These numbers drive the priorities later in this chapter, so a wrong lifetime can push an important service down the list.
3.3 Who controls security
Small organizations rarely run their own servers. The web-shop provider controls the shop's connections; the payment company controls card security; the email provider controls email; the router maker controls Wi-Fi equipment updates. BBO controls choices like which providers to use, keeping devices updated, and asking questions. Writing down the controller tells you whom to ask.
For each service on the list, add one line: who controls its security, and how to contact them. At the bakery most entries name a provider, which means the main action is asking them questions. Where Priya does control something, such as updating the office router, note that too.
3.4 Recording facts with their source
Each fact should say where it came from: "Provider help page, 8 October", "Router settings page, version 2.1", "Asked Priya". Facts from documentation are less certain than facts you observed directly, such as your browser showing the connection details.
At the bakery, the online shop's hybrid key exchange was seen in your own browser's connection details, which is stronger evidence than a help page. The email provider's statement that post-quantum key exchange is rolling out is a claim from documentation and should be checked again later. Write the date beside each source, because pages change.
3.5 Unknowns are questions
If you do not know something — which security settings the oven controller uses — write "unknown" and turn it into a question for the right person. Unknown is not the same as safe.
Write each question to the person who can answer it: the oven-controller maker for its connections, the payroll provider for its post-quantum plans. Note when you sent the question and when you expect an answer. When an answer arrives, replace the unknown with the fact and its source.
3.6 Practical activity — Lab J
# Lab J (ch 3): parse a synthetic JSON export of TLS endpoints and summarise key exchange by site.
import json, collections
export = json.loads("""[
{"site": "shop", "host": "web-01", "group": "X25519MLKEM768"},
{"site": "shop", "host": "till-02", "group": "secp256r1"},
{"site": "bakery", "host": "web-01", "group": "X25519"},
{"site": "bakery", "host": "oven-ctl", "group": null},
{"site": "office","host": "web-01", "group": "X25519MLKEM768"}]""")
summary = collections.defaultdict(collections.Counter)
for e in export:
g = e["group"]
kind = "unknown" if g is None else ("hybrid" if "MLKEM" in g else "classical")
summary[e["site"]][kind] += 1
for prop, c in sorted(summary.items()):
print(f"{prop:9s} hybrid={c['hybrid']} classical={c['classical']} unknown={c['unknown']}")
Expected output:
bakery hybrid=0 classical=1 unknown=1
office hybrid=1 classical=0 unknown=0
shop hybrid=1 classical=1 unknown=0
The bakery's oven controller has no recorded information, so it shows as unknown. The till at the shop and the web server at the bakery use older classical methods. The web servers at the shop and office already use hybrid protection, probably because their provider updated them.
Lab J groups made-up connection records by site and counts each kind. A record with no group is counted as unknown, not as safe. Run it and check that your output matches; then change one entry to see how the counts move.
3.7 Choosing priorities
Combine lifetimes and control. First: services holding long-lived data that BBO can influence — ask the payroll and email providers about their post-quantum plans and keep accounts updated. Next: services with unknowns — ask the oven-controller maker. Last: short-lived data such as order confirmations.
Write the priorities as a short numbered list with an owner for each item, usually Priya, and a date to check back. Payroll and email come first because their data lasts longest and the bakery can ask their providers directly. The list should fit on one page.
3.8 Worked example
BBO's list (synthetic): online shop (provider; customer accounts 10 years; hybrid key exchange seen in your browser's connection details, 8 October); payroll service (provider; 12 years; unknown — ask); email (provider; payroll attachments; "rolling out" — ask for date); supplier file transfer (provider; contracts 7 years; classical — ask); oven controller (manufacturer; no personal data; unknown — ask about updates). Priorities: payroll and email questions first.
The list mixes facts and unknowns, and each unknown ends with ask, which turns it into a task. It also records where each fact came from, such as your browser's connection details for the online shop. Priya can read it in two minutes and see what to do first.
3.9 Practice activities
- List the services your household or a club you belong to depends on. 2. For each, write the data held, lifetime and controller. 3. Turn two unknowns into questions.
Use the same columns as the bakery list: service, data held, lifetime, who controls it. For the unknowns, write a question addressed to a named person or company. Keep the result private if it includes information about other people. Ask someone in the household or club to check your lifetimes, since they may know rules you do not.
3.10 Common mistakes
- Forgetting equipment such as tills and controllers.
- Treating unknown as safe.
- Writing facts without sources.
- Assuming the provider has it handled without asking.
Each mistake has a simple remedy. Walk round the premises to find equipment such as tills and controllers. Write unknown and add a question. Put a source and date beside every fact. And ask providers directly; a short email is cheap and the answer is useful. Review the list with the owner once a year, or when a provider changes.
Exercises
- EX027 — Service list. List six BBO services. Rubric: 3 = six plausible services.
- EX028 — Lifetimes. Give data and lifetime for three services. Rubric: 3 = plausible pairs.
- EX029 — Controller. Who controls the security of the online shop's connections? Rubric: 3 = web-shop provider.
- EX030 — Source. Rewrite "email is quantum-safe" with a source and date. Rubric: 3 = sourced, dated, accurate wording.
- EX031 — Unknown. Turn "oven controller: unknown" into a question for the manufacturer. Rubric: 3 = clear, answerable question.
- EX032 — Lab J counts. From Lab J, how many endpoints are hybrid, classical and unknown in total? Rubric: 3 = 2, 2, 1.
- EX033 — Lab J reading. Which site needs follow-up first and why? Rubric: 3 = bakery: classical web server and unknown controller.
- EX034 — Priority. Why ask the payroll provider first? Rubric: 3 = longest lifetime, provider-controlled.
- EX035 — Observed vs documented. Which is stronger evidence: your browser's connection details or a help page? Rubric: 3 = observed, with reason.
- EX036 — Low priority. Why are order confirmations low priority? Rubric: 3 = short lifetime.
- EX037 — Equipment. Why include the till and oven controller? Rubric: 3 = connected devices can hold or carry data, need updates.
- EX038 — Question list. Write two questions for the email provider. Rubric: 3 = PQ plans/dates and what customers should do.
- EX039 — Household. Name one long-lived household data type and its service. Rubric: 3 = e.g. tax records in cloud storage.
Synthesis
Mapping services, data lifetimes and who controls each service, with sourced facts and unknowns turned into questions, shows a small organization where to focus.
Continue studying — chapter 03 of 04
← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →