OpenCyber AcademyLearning outcomes
You will (1) describe the systems a city runs and where cryptography appears in them; (2) distinguish hardware, software and services; (3) identify cryptographic dependencies in everyday services.
1.1 The case
Rosa Delgado is a first-year student in the three-year technologist programme at the fictional Pinecrest Polytechnic. Her work placement, which runs through all three years, is with the IT department of the fictional Harbourview City Council, under senior engineer Owen Pryce. The council runs a parking-permit portal, a document service for signed council decisions, a staff VPN, a geographic information system and payment integrations. Every system, person and figure in this book is synthetic. A technologist builds and runs integrated services, so Rosa's goal is to make these services trustworthy in daily operation, not to invent new cryptography.
1.2 Hardware, software and services
Rosa sorts the council's systems into hardware, such as servers, laptops and network appliances; software, such as operating systems, web servers and databases; and services bought from outside, such as the payment provider and the email platform. Cryptography shows up in each: laptops encrypt disks, web servers terminate TLS, databases encrypt backups and the payment provider signs notifications. Owen asks her to note for each item who controls the keys. She finds that for outside services the provider holds the keys, which means the council must rely on contracts and the provider's controls rather than its own configuration.
1.3 Everyday dependencies
Rosa traces one citizen action, buying a parking permit, from start to finish. The browser connects to the portal over TLS; the portal checks the citizen's password against a stored hash; it calls the payment provider, which later sends a signed notification back; and the permit record is stored in an encrypted database with nightly encrypted backups. Five separate cryptographic mechanisms support one simple task. If any one fails, for example an expired certificate or a wrong webhook secret, citizens see errors. This exercise shows Rosa why service integration and operations are central to applied cryptography.
Worked example
Rosa maps the permit purchase through TLS, password hashing, a signed payment notification and encrypted storage, and notes who holds each key.
Synthetic case. Harbourview, Pinecrest and all systems are invented.
Errors and limits
Diagrams of one transaction miss background processes such as backups and logging. Outside services move key control to providers, so contracts matter.
Exercises
- EX001 — Placement setting. Where does Rosa's placement take place and what does a technologist focus on?
Show marking criteria
Rubric: 3 = Harbourview City Council IT; making integrated services trustworthy in operation;; 2 = setting only;; 1 = inventing cryptography;; 0 = none. - EX002 — Provider keys. Who holds the keys for outside services, and what follows?
Show marking criteria
Rubric: 3 = the provider; council relies on contracts and provider controls;; 2 = provider;; 1 = council;; 0 = none. - EX003 — Permit mechanisms. Name four cryptographic mechanisms in a permit purchase.
Show marking criteria
Rubric: 3 = four of TLS, password hash, signed notification, database encryption, backup encryption;; 2 = three;; 1 = one;; 0 = none.
Synthesis
Even simple public services depend on several cryptographic mechanisms whose keys and owners must be known.