## Chapter 1 — Computing systems ### Learning outcomes You will (1) describe the systems a city runs and where cryptography appears in them; (2) distinguish hardware, software and services; (3) identify cryptographic dependencies in everyday services. ### 1.1 The case Rosa Delgado is a first-year student in the three-year technologist programme at the fictional Pinecrest Polytechnic. Her work placement, which runs through all three years, is with the IT department of the fictional Harbourview City Council, under senior engineer Owen Pryce. The council runs a parking-permit portal, a document service for signed council decisions, a staff VPN, a geographic information system and payment integrations. Every system, person and figure in this book is synthetic. A technologist builds and runs integrated services, so Rosa's goal is to make these services trustworthy in daily operation, not to invent new cryptography. ### 1.2 Hardware, software and services Rosa sorts the council's systems into hardware, such as servers, laptops and network appliances; software, such as operating systems, web servers and databases; and services bought from outside, such as the payment provider and the email platform. Cryptography shows up in each: laptops encrypt disks, web servers terminate TLS, databases encrypt backups and the payment provider signs notifications. Owen asks her to note for each item who controls the keys. She finds that for outside services the provider holds the keys, which means the council must rely on contracts and the provider's controls rather than its own configuration. ### 1.3 Everyday dependencies Rosa traces one citizen action, buying a parking permit, from start to finish. The browser connects to the portal over TLS; the portal checks the citizen's password against a stored hash; it calls the payment provider, which later sends a signed notification back; and the permit record is stored in an encrypted database with nightly encrypted backups. Five separate cryptographic mechanisms support one simple task. If any one fails, for example an expired certificate or a wrong webhook secret, citizens see errors. This exercise shows Rosa why service integration and operations are central to applied cryptography. ### Worked example Rosa maps the permit purchase through TLS, password hashing, a signed payment notification and encrypted storage, and notes who holds each key. > **Synthetic case.** Harbourview, Pinecrest and all systems are invented. ### Errors and limits Diagrams of one transaction miss background processes such as backups and logging. Outside services move key control to providers, so contracts matter. ### Exercises - **EX001 — Placement setting.** Where does Rosa's placement take place and what does a technologist focus on? *Rubric:* 3 = Harbourview City Council IT; making integrated services trustworthy in operation;; 2 = setting only;; 1 = inventing cryptography;; 0 = none. - **EX002 — Provider keys.** Who holds the keys for outside services, and what follows? *Rubric:* 3 = the provider; council relies on contracts and provider controls;; 2 = provider;; 1 = council;; 0 = none. - **EX003 — Permit mechanisms.** Name four cryptographic mechanisms in a permit purchase. *Rubric:* 3 = four of TLS, password hash, signed notification, database encryption, backup encryption;; 2 = three;; 1 = one;; 0 = none. ### Synthesis Even simple public services depend on several cryptographic mechanisms whose keys and owners must be known. ### Continue studying — chapter 01 of 30 [← Course home](../../README.md) · [Course chapter index](../SUBJECTS.md) · [Chapter 02 (draft) →](#ch-02) ## Worked answers **EX001.** At the council's IT department, focusing on building and running integrated services reliably and securely. **EX002.** The provider holds them, so the council must rely on contracts and the provider's own controls. **EX003.** TLS to the portal, a password hash check, a signed payment notification and an encrypted database.