Chapter 13 — Quantum and post-quantum security: troubleshooting
Lesson map
Lesson 13 published. Map, example, EX037.
flowchart TD
N0["Learning outcomes"]
N1["13.1 Method"]
N2["13.2 Practical activity — Lab H"]
N3["13.3 Typical fixes"]
N4["13.4 Recording"]
N5["13.6 Hands-on activity"]
N6["13.7 Asking for help"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX037"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["13.1 Method"]
N2["13.2 Practical activity — Lab H"]
N3["13.3 Typical fixes"]
N4["13.4 Recording"]
N5["13.6 Hands-on activity"]
N6["13.7 Asking for help"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX037"]
[Learning outcomes]
|
v
[13.1 Method]
|
v
[13.2 Practical activity — Lab H]
|
v
[13.3 Typical fixes]
|
v
[13.4 Recording]
|
v
[13.6 Hands-on activity]
|
v
[13.7 Asking for help]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX037]
Learning outcomes
You will (1) follow a step-by-step troubleshooting method; (2) triage failure logs into likely causes; (3) fix common problems without removing protection broadly; and (4) record the cause and fix.
13.1 Method
Reproduce → isolate → hypothesise → test → fix → verify → record. Reproduce with the same client and path in the lab if possible. Isolate by trying a direct path, a different client, or hybrid off for one test connection. Change one thing at a time.
At HHG, the Summit timeout was reproduced in the lab with the same firewall firmware before any fix was chosen. Write down each hypothesis and the test that confirmed or ruled it out, so the record shows how the cause was found.
13.2 Practical activity — Lab H
# Lab H (ch 13): triage synthetic handshake failure logs into likely causes.
import re, collections
logs = """2026-10-01T10:00Z client=10.0.4.7 err=handshake_timeout size_clienthello=1530 path=proxy-b
2026-10-01T10:01Z client=10.0.4.9 err=handshake_timeout size_clienthello=1530 path=proxy-b
2026-10-01T10:02Z client=10.0.7.2 err=no_shared_group offered=x25519mlkem768
2026-10-01T10:03Z client=10.0.4.8 err=handshake_timeout size_clienthello=1530 path=proxy-b
2026-10-01T10:04Z client=10.0.9.1 err=bad_certificate alg=mldsa65
2026-10-01T10:05Z client=10.0.4.3 err=handshake_timeout size_clienthello=300 path=direct""".splitlines()
causes = collections.Counter()
for line in logs:
f = dict(re.findall(r"(\w+)=(\S+)", line))
if f["err"] == "handshake_timeout" and int(f.get("size_clienthello", 0)) > 1400: c = "large ClientHello dropped (" + f["path"] + ")"
elif f["err"] == "no_shared_group": c = "client/server group mismatch"
elif f["err"] == "bad_certificate": c = "client cannot verify PQ certificate"
else: c = "other / investigate"
causes[c] += 1
for c, n in causes.most_common(): print(f"{n} {c}")
Expected output:
3 large ClientHello dropped (proxy-b)
1 client/server group mismatch
1 client cannot verify PQ certificate
1 other / investigate
Three timeouts share one proxy and a large first message: the proxy is the likely cause. The group mismatch and certificate error need separate tickets.
The script reads six synthetic log lines and assigns each to a likely cause using simple rules: a timeout with a first message above 1,400 bytes points to a large message being dropped, while group and certificate errors map directly. The last timeout had a small message on a direct path, so it is left for investigation. Note how grouping by path shows that proxy-b is the common factor. Add a line of your own and check the result.
13.3 Typical fixes
Proxy or firewall drops large messages → firmware update or configuration fix on that device; meanwhile route affected users to a compatible listener. No shared group → restore classical fallback on the server or upgrade the client. Certificate verification failure → add the new root to the client's trust store or keep the classical certificate for that client group. Silent fallback → fix the group order and add an alert.
Choose the narrowest fix that restores service, and record any interim step as an exception with an end date. At HHG, Summit's routing to a listener without hybrid was removed once the firewall firmware was updated.
13.4 Recording
Write the symptoms, evidence, cause, fix, verification and anything left to do. Link related tickets so patterns are visible: three properties with the same firewall model should become one vendor case.
At HHG, the Summit ticket recorded the timeouts, the lab reproduction, the interim routing, the firmware fix and the confirmation. If another property reports the same symptoms, the linked tickets show the pattern at once, and the vendor case can cover all affected sites. Close it only after verification.
13.5 Worked example
Ticket: "Summit front desk cannot load guest portal since Monday." Evidence: timeouts only from Summit; Lab H-style triage shows large ClientHello via the property firewall. Lab test with the same firewall firmware reproduces it. Interim: a policy routes Summit's front-desk subnet to a listener without the hybrid group, recorded as an exception. Fix: firewall firmware update Thursday; exception removed; hybrid negotiations from Summit confirmed.
The operator reproduced the fault before fixing it and kept the interim measure narrow and recorded.
13.6 Hands-on activity
Using Lab H's output, write three tickets — one per distinct cause — with first checks.
Write one ticket for the proxy-b timeouts, one for the group mismatch and one for the certificate error. For each, give the symptoms with the log lines, a likely cause marked as such, the first checks to confirm it, the narrow interim measure if needed, and the owner. Note the single direct-path timeout separately as an item to investigate. Link the tickets if you suspect a shared cause.
13.7 Asking for help
Escalate when the cause is outside your control or the fix needs a change you are not authorized to make. Include evidence, what you tried and what you need. Good escalations are short, specific and reproducible; they are answered faster.
At HHG, the Summit firewall fix needed Network Ops and the firewall vendor, so the operator escalated with the lab reproduction and firmware version attached. Say what you have already ruled out, so the person helping does not repeat your checks. Agree when you will hear back.
13.8 Common errors and limits
- Turning hybrid off everywhere.
- Changing several settings at once.
- Fixes without verification.
Each error makes troubleshooting worse. Turning hybrid off everywhere because of one path, such as Summit's firewall, removes protection from every other property. Changing several settings at once means nobody knows which change fixed the problem or caused a new one. A fix without verification may not work, and the ticket will be reopened. Check every troubleshooting ticket for all three before closing it. Correct any you find.
Exercises
- EX037 — Triage. In Lab H, which cause would you investigate first and why? Rubric: 3 = proxy timeouts, most frequent and shared pattern.
- EX038 — Interim fix. Describe a narrow interim fix for the Summit problem. Rubric: 3 = route subnet to compatible listener with exception and expiry.
- EX039 — Escalation. Write a three-line escalation to the firewall vendor. Rubric: 3 = product/version, evidence, request.
Synthesis
Methodical troubleshooting, log triage and narrow interim fixes resolve post-quantum problems while keeping protection for everyone else.
Continue studying — chapter 13 of 18
← Chapter 12 (draft) · Course chapter index · Chapter 14 (draft) →