Chapter 4 — Quantum and post-quantum security: guided lab and applied synthesis
Lesson map
Lesson 04 published. Map, example, EX040.
flowchart TD
N0["Learning outcomes"]
N1["4.1 The guided lab — Lab T"]
N2["4.2 Offered versus used"]
N3["4.3 Checking your own browser with permission"]
N4["4.4 Writing a readiness note"]
N5["4.5 Questions for providers"]
N6["4.6 Applied synthesis"]
N7["4.7 Next steps"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX040"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["4.1 The guided lab — Lab T"]
N2["4.2 Offered versus used"]
N3["4.3 Checking your own browser with permission"]
N4["4.4 Writing a readiness note"]
N5["4.5 Questions for providers"]
N6["4.6 Applied synthesis"]
N7["4.7 Next steps"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX040"]
[Learning outcomes]
|
v
[4.1 The guided lab — Lab T]
|
v
[4.2 Offered versus used]
|
v
[4.3 Checking your own browser with permission]
|
v
[4.4 Writing a readiness note]
|
v
[4.5 Questions for providers]
|
v
[4.6 Applied synthesis]
|
v
[4.7 Next steps]
|
v
[Worked example] --> [Exercise EX040]
Learning outcomes
You will (1) read a simple configuration audit; (2) explain "offered" versus "used"; (3) check, with permission, whether your own browser uses hybrid protection; (4) write a short readiness note for an owner; (5) list questions for providers; and (6) plan your next learning steps.
4.1 The guided lab — Lab T
This lab checks made-up configurations for four BBO services. It asks two questions: does the service offer the new hybrid method, and does it prefer it?
# Lab T (ch 4): audit synthetic TLS server configurations for post-quantum key exchange and preference order.
configs = { # service: ordered list of offered groups (server preference) - synthetic
"online-shop": ["X25519MLKEM768", "X25519", "secp256r1"],
"staff-portal": ["X25519", "X25519MLKEM768", "secp256r1"],
"supplier-sftp": ["ecdh-sha2-nistp256"],
"till-dashboard": ["X25519", "secp384r1"]}
HYBRID = {"X25519MLKEM768", "SecP256r1MLKEM768", "SecP384r1MLKEM1024"}
for svc, groups in configs.items():
offered = [g for g in groups if g in HYBRID]
if not offered: verdict = "CLASSICAL ONLY"
elif groups[0] in HYBRID: verdict = "OK (hybrid preferred)"
else: verdict = "WARN hybrid offered but not preferred"
print(f"{svc:17s} {verdict}")
Expected output:
online-shop OK (hybrid preferred)
staff-portal WARN hybrid offered but not preferred
supplier-sftp CLASSICAL ONLY
till-dashboard CLASSICAL ONLY
The online shop offers and prefers hybrid. The staff portal offers hybrid but prefers the older method, so most connections will still use the older one — like having a new lock fitted but still using the old one by habit. The supplier file transfer and till dashboard use only older methods.
The lab looks only at the order of groups in each made-up configuration. It does not connect to anything, so it is safe to run on your own computer. Try moving X25519MLKEM768 to the front of the staff portal's list and run it again to see the verdict change.
4.2 Offered versus used
A setting that offers the new method is not the same as connections that use it. What matters is what happens when a connection is made. Technical staff check this with connection logs or tools; as a learner, you can see it for your own browser.
At the bakery the staff portal is the clear example: it offers the hybrid method but lists the older one first, so most connections will use the older method. Your note to Priya should say offered but not preferred, not protected.
4.3 Checking your own browser (with permission)
On your own computer, using a website you normally visit, you can look at the connection details. In some browsers the security panel or developer tools show the "key exchange" used, and you may see X25519MLKEM768 for sites that use hybrid protection. This is ordinary use of your own browser — you are not probing the site. Do not use scanning tools against websites.
Record what you saw with the date, the site and where in the browser you found it, and keep the note in the shared folder. A screenshot of your own connection details is fine. If the panel shows an older key exchange, simply note it; do not try other tools to find out more.
4.4 Writing a readiness note
A readiness note for an owner should be short and calm: what you looked at, what you found, what it means and what to do. Example for Priya:
"Quantum readiness note — Bluebird Bakery Online (synthetic), 30 October. What I reviewed: our list of services, provider documentation and my own browser's connection to our online shop. Findings: the online shop uses the new hybrid protection; our staff portal offers it but does not prefer it; supplier file transfers and the till dashboard use older methods; the payroll provider and oven controller are unknown. What it means: no immediate danger, but payroll and email hold information that must stay private for many years. Suggested actions: ask the staff-portal and file-transfer providers to prefer the new method; ask the payroll and email providers for their post-quantum plans and dates; keep all devices and accounts updated; review again in six months."
4.5 Questions for providers
Good questions are specific and answerable: "Do your connections use post-quantum or hybrid key exchange (for example X25519MLKEM768)? If not, when? Which of our data do you keep, and for how long? How will you tell us about changes?"
Send the questions by email so that the answer is written down, and save the reply with the date. If a provider does not reply, ask again after a few weeks. Keep the questions short so that a support team can answer them without escalating.
4.6 Applied synthesis
Putting the month together: you can now explain what quantum computers threaten and what they do not (Chapter 1), work safely with permission (Chapter 2), map a small organization's services, data and controllers (Chapter 3), read a simple audit and write an owner's note (this chapter). That is a complete, useful first task.
The month's work produces three things the bakery can keep: a service list with lifetimes and controllers, a readiness note, and a set of provider questions. Together they let Priya act without needing to understand the mathematics.
4.7 Next steps
If you want to go further: the professional course teaches the full migration workflow; the technical course teaches hands-on configuration and verification. Keep up with news from reliable sources such as NIST, and be sceptical of headlines.
Before moving on, check that you can explain to someone else what harvest now, decrypt later means and why AES-256 stays strong. Revisit any exercises you scored below 3. Keep the readiness note as an example for later courses. Note the date you finished.
4.8 Worked example
Priya reads the note and asks: "So do we need to spend money?" Answer: "Not now. Our main actions are emails to providers and keeping things updated. If the payroll provider has no plan, we can consider switching at the next contract renewal."
The answer keeps the decision small and specific: send emails, keep updating, and revisit at contract renewal. If a provider's answer later shows a real problem, the next readiness note will say so, and spending can be discussed then.
4.9 Practice activities
- Rewrite the readiness note for your household or club. 2. Draft one provider email from the questions above. 3. Explain "offered versus used" to a friend using an everyday analogy.
For the first activity, use the same four parts as the bakery note: what you reviewed, findings, what it means and suggested actions. For the second, pick one question from the provider list and address it to a real service you use. For the third, test your analogy on a friend. Share your work only with people you trust.
4.10 Common mistakes
- Reporting "offered" as "used".
- Scanning websites instead of looking at your own browser.
- Alarmist notes that ask for spending without need.
- Forgetting to set a review date.
Each mistake has a simple correction. Write offered but not preferred when that is what a configuration shows. Use your own browser, never scanning tools. Keep the tone calm and spending suggestions small. Put a review date on every note. Ask the owner whether the note was clear, and improve the next one using their answer.
Exercises
- EX040 — Lab T reading. Which service in Lab T offers hybrid but does not prefer it? Rubric: 3 = staff-portal.
- EX041 — Classical only. Which services in Lab T use only older methods? Rubric: 3 = supplier-sftp and till-dashboard.
- EX042 — Analogy. Give an everyday analogy for "offered versus used". Rubric: 3 = clear and accurate.
- EX043 — Own browser. Why is checking your own browser's connection details acceptable but scanning a site not? Rubric: 3 = ordinary use vs probing without permission.
- EX044 — Note sections. List the four parts of a readiness note. Rubric: 3 = reviewed, findings, meaning, actions.
- EX045 — Calm tone. Rewrite: "We are in huge danger from quantum hackers!" Rubric: 3 = calm, accurate.
- EX046 — Provider question. Write one specific question for the staff-portal provider. Rubric: 3 = asks to prefer hybrid/date.
- EX047 — Review date. Why include a review date? Rubric: 3 = standards and services change.
- EX048 — Spending. When might the bakery need to spend money? Rubric: 3 = provider has no plan → switch at renewal, or device replacement.
- EX049 — Hybrid name. What is the name of the hybrid method commonly used in browsers? Rubric: 3 = X25519MLKEM768.
- EX050 — What it does not fix. Name one thing hybrid key exchange does not fix. Rubric: 3 = signatures/certificates still classical (or data recorded earlier).
- EX051 — Next course. Which course would you take next to learn configuration, and which for workflow? Rubric: 3 = technical; professional.
- EX052 — Final summary. Summarise the month in three sentences. Rubric: 3 = threat, safe practice, mapping and action.
Synthesis
The guided lab shows the difference between offering and using new protection; a short, calm readiness note and specific provider questions turn the month's learning into a useful first task for a real owner.
Continue studying — chapter 04 of 04
← Chapter 03 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →