Do you evaluate the strength of the algorithms themselves?

No. Assessing a primitive's mathematical strength is cryptanalysis and requires separately qualified specialists. This work examines how established mechanisms are chosen, parameterized, implemented and operated, and whether the resulting protection matches the adversary the owner has in mind.

We have no cryptographic inventory. Is that a problem?

It is the normal starting position and often the first deliverable. Building the inventory is usually where the useful findings appear: keys with no identified holder, certificates nobody tracked and dependencies that would fail if one were revoked. Scoping allows for building it rather than assuming it exists.

Is post-quantum work premature?

It depends on how long your data must stay confidential and how long a change would take. Where confidentiality lifetimes are long and dependencies are numerous, the work is about sequencing and agility rather than urgency. The diagnostic exists to answer that question with your own inventory rather than with a general position.

Can you assess a system you cannot access directly?

Partly. Design documentation, message formats and configuration can support a useful assessment, but findings must distinguish what was directly observed from what was reviewed only in documentation. Where access is constrained, the report states the limits on what the evidence supports.

Does this include operating our key management?

No. The engagements design, review and specify; they do not operate a key management service or hold your keys. Where a procedure needs to be exercised, your team performs it with the design and separation of duties agreed during the work.

Does a review satisfy an auditor or regulator?

It may supply evidence an auditor finds useful, but it is not an accredited audit, a certification or a compliance attestation. The findings and their limits are written so that your accountable owner can present them accurately, without implying a status the work does not confer.

Capability family

Cryptographic engineering

Cryptography fails at its edges, not in its mathematics.

Cryptographic engineering connects algorithm choice to keys, certificates, hardware, protocols and the people who rotate them. Examine the whole lifecycle, because a sound primitive with an unmanaged key still leaves the protected data exposed.

Book a 30 minute readiness call

A mechanism protects only what its key custody allows

Protected asset: The data or action the mechanism is meant to defend.
Adversary: The party the mechanism is meant to exclude.
Key custody: Who can use the key, and under what conditions.
Residual exposure: Where plaintext or unverified data still exists.

Conceptual model of the discipline; the engagement boundary requires separate agreement.

Discipline model

The interesting question is who holds the key

The relationships that define the discipline

Mechanism: Algorithm, mode and parameters chosen for a stated purpose.
Lifecycle: Generation, custody, rotation, revocation and destruction.
Trust anchor: The certificates and roots other systems rely on.
Agility: What a change of algorithm or anchor would cost.

Use these connected areas to identify which specialist questions matter for the system.

Most cryptographic failures in production are not breaks of a primitive. They are keys held where the adversary already stands, certificates nobody tracked until they expired, algorithm identifiers frozen into a stored format, and revocation procedures that have never been exercised. This discipline treats the mechanism and its lifecycle as one object, because the protection a system actually has is the weaker of the two.

Illustrative situation

Encryption that excludes nobody in particular

A constructed situation and the question it raises

Illustrative scenario

The control
A service encrypts a sensitive database column.
The custody
The decryption key sits in that service's own configuration.
The question
Which adversary does this actually exclude?

Fictional example; no engagement, executed test or measured outcome is implied.

A column is encrypted, so the control appears in place. The key, however, is readable by the same service that reads the column. Against an attacker who compromises the service, the mechanism adds nothing; against loss of a storage medium or a backup, it adds a great deal. Both facts are true. The useful outcome is a control whose stated purpose matches what it does.

Working approach

Name the adversary before assessing the mechanism

From stated purpose to residual exposure

State the purpose
Name the asset and the adversary the mechanism excludes.
Follow the key
Trace custody, use, rotation and revocation across the lifetime.
Record what remains
Identify plaintext, unverified data and untested procedures.

Proposed sequence; scope, access and delivery availability are agreed separately.

The work begins with a sentence nobody has usually written down: this mechanism protects this asset against this adversary. Everything else follows from it. Algorithm and parameter review, key custody, certificate lifecycle and agility all become answerable once the purpose is explicit, and a mechanism that cannot be described that way is usually protecting something other than what its owner assumed.

Working artefact

An inventory the organisation can act on

What a cryptographic assessment carries with it

Illustrative working format

Inventory: Keys, certificates and trust anchors with holders and dependants.
Lifecycle findings: The stages that exist and the stages never exercised.
Change cost: What replacing an algorithm or anchor would require.

Illustrative structure, not a completed engagement or an observed result.

Cryptographic work produces artefacts other teams use for years: an inventory of keys and trust anchors with the systems that depend on each, a lifecycle position that names the untested stages, and a change-cost rating that turns post-quantum guidance into a defensible priority order. These are operational records rather than reports, and they are written to be kept current.

Scope and next decision

What an engineering review can and cannot settle

What this work does and does not establish

Included: Mechanism use, key lifecycle, certificates and migration design.
Excluded: Cryptanalysis, accredited audit and compliance attestation.
Retained: Your owner keeps the architecture and risk decisions.

Bring the system, the obligation that prompted the question and the inventory you hold.

This is applied engineering, not cryptanalysis. Evaluating a primitive's mathematical strength requires separately qualified specialists, and an accredited audit of a certificate authority is a different exercise with a different scope. Post-quantum work follows published guidance and the standards current when it is performed; no forecast about quantum computing timelines is asserted here.

Explore the discipline

Specialist areas within this capability

Choose a question to explore its methods, boundaries and indicative outputs.

Search this capability family