Chapter 6 — Cryptography and trust services: system model
Lesson map
Lesson 06 published. Map, example, EX021.
flowchart TD
N0["Learning outcomes"]
N1["6.1 Parties, keys and verifiers"]
N2["6.2 Trust anchors"]
N3["6.3 Weakest link"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX021"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["6.1 Parties, keys and verifiers"]
N2["6.2 Trust anchors"]
N3["6.3 Weakest link"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX021"]
[Learning outcomes]
|
v
[6.1 Parties, keys and verifiers]
|
v
[6.2 Trust anchors]
|
v
[6.3 Weakest link]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX021]
Learning outcomes
You will (1) model Lumen's trust relationships as parties, keys and verifiers; (2) identify trust anchors; (3) explain why a trust chain fails at its weakest link.
6.1 Parties, keys and verifiers
Priya draws the trust model on a whiteboard. Each arrow has three parts: a party that holds a private key, a public key or certificate that represents it, and a verifier that checks the proof. Customers verify the portal through its TLS certificate. Lumen verifies the payment processor's callbacks through a shared HMAC secret. Partners verify the nightly files through Lumen's SSH host key. Drawing the model this way makes Tomás ask the same three questions everywhere: who holds the secret, what does the verifier check, and what happens if the secret leaks or the check is skipped.
6.2 Trust anchors
Every chain of verification ends at something trusted without further proof, called a trust anchor. For the public website, anchors are the root certificates that browsers and operating systems ship. For the depot Wi-Fi, the anchor is Lumen's own internal root, installed on handhelds by device management. For SSH, the anchor is the host key fingerprint recorded the first time a partner connected. Tomás learns that adding an anchor is a powerful act: any certificate signed under a new root becomes trusted. So anchor changes go through change control, and he never installs a root just to make a warning disappear.
6.3 Weakest link
A chain is only as strong as its weakest part. If the internal root's private key sits on an ordinary laptop, the careful TLS settings on every depot access point can be undone by anyone who steals that laptop. If the HMAC secret for payment callbacks is committed to a public repository, the signature check on the server becomes meaningless. Tomás reviews each arrow in the model and asks where the private material is stored and who could reach it. He marks two weak links: the internal root key location and an old shared SSH key used by two partners.
Worked example
Tomás draws six trust arrows with holder, artefact and verifier, labels three trust anchors and flags two weak links for Priya.
Synthetic case. The trust model, roots and keys are synthetic.
Errors and limits
Models omit humans who can override checks, such as staff clicking through warnings. Anchors installed by vendors are outside Lumen's control.
Exercises
- EX021 — Three questions. What three questions does Tomás ask about each trust arrow? Rubric: 3 = who holds the secret, what the verifier checks, what if the secret leaks or check is skipped;; 2 = two;; 1 = one;; 0 = none.
- EX022 — Depot anchor. What is the trust anchor for depot Wi-Fi certificates? Rubric: 3 = Lumen's internal root installed on handhelds;; 2 = internal root;; 1 = public CA;; 0 = none.
- EX023 — Adding a root. Why must installing a new root go through change control? Rubric: 3 = every certificate signed under it becomes trusted; it is a powerful act;; 2 = mentions trust scope;; 1 = harmless;; 0 = none.
- EX024 — Shared partner key. Why is one SSH key shared by two partners a weak link? Rubric: 3 = one partner's leak compromises both and access cannot be revoked separately;; 2 = mentions leak;; 1 = not weak;; 0 = none.
Synthesis
Trust models make every holder, anchor and verifier explicit, so the weakest link becomes visible.
Continue studying — chapter 06 of 18
← Chapter 05 (draft) · Course chapter index · Chapter 07 (draft) →