Crypto agility and the post-quantum transition
You build the organisation’s cryptographic inventory and bill of materials, understand the risk from quantum computers and the new standards, try hybrid key exchange in the lab and write a migration plan that retires old algorithms.
Level 501 · 13 lessons · 12 practice labs
Lessons
Inventory
- The cryptographic inventory: algorithms, keys, certificates, libraries
- The cryptographic bill of materials
- Discovering crypto use from the network and the code
- Short task: build the cryptographic inventory of the lab environment
Post-quantum
- What quantum computers change: Shor and Grover in outline
- The harvest-now-decrypt-later risk and data lifetime
- Post-quantum standards: ML-KEM and ML-DSA
- Trying TLS with hybrid key exchange
- Short task: enable and verify hybrid key exchange on the lab server
Migration
- Agile design: making algorithms replaceable
- The migration plan: priority, testing and timeline
- Retiring old algorithms: SHA-1, RSA-1024, 3DES
- Capstone: prepare a cryptographic inventory and post-quantum migration plan for an organisation
Practice labs
- Inventory the cryptography used on a server: Extract algorithms and key lengths from the TLS, SSH and disk encryption settings on the lab server and fill in the inventory table.
- Produce a cryptography bill of materials from code: Find the libraries and algorithms used in the lab app's dependencies and code and produce a machine-readable bill of materials.
- Discover cryptography use from network traffic: Extract handshakes from the lab network capture, derive the version and algorithm distribution and compare it with the inventory to find gaps.
- Classify how long data must stay confidential: Set the confidentiality lifetime for ten of Çamlıbel Su İdaresi's data types and mark which are exposed to harvest-now-decrypt-later risk.
- Prioritise which connections to protect first: Score the connections in the lab inventory by data lifetime and algorithm and pick the first five for post-quantum migration, with reasons.
- Build a post-quantum risk register: Prepare a risk register from Yelkovan Bankası's lab inventory, adding impact, timeline and owner to each row.
- Test whether a server supports hybrid key exchange: List the key exchange groups the lab TLS server supports and record whether a hybrid group is present.
- Enable hybrid key exchange on the lab server and verify it: Enable the ML-KEM-based hybrid group on the lab web server, connect with a client and verify the chosen group in a capture.
- Move SSH to hybrid key exchange and test compatibility: Prefer the post-quantum hybrid algorithm on the lab SSH server, test compatibility with older clients and write the fallback plan.
- Find legacy algorithms in the inventory: Mark components using SHA-1, RSA-1024 and 3DES in the lab inventory and assign an owner to each.
- Make the algorithm configurable instead of hard-coded: Move the hard-coded signing algorithm in the lab app into configuration and show the algorithm can change without code changes.
- Prepare a cryptography inventory and post-quantum migration plan: Complete the inventory for Demirsu Enerji's lab environment and write a plan with a retirement schedule for legacy algorithms and migration tests.
About this course
You build the organisation’s cryptographic inventory and bill of materials, understand the risk from quantum computers and the new standards, try hybrid key exchange in the lab and write a migration plan that retires old algorithms.
What you will learn
- Inventory
- Post-quantum
- Migration
Prerequisites
You should be experienced in the topics of the same path up to level 401.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 501; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.