This page needs a newer browser to run its tools. You can still read everything here.

Applied Cryptography for Developers Module 13

Post-quantum cryptography interview questions

Interview questions on post-quantum cryptography: short warm-ups, then what each harder question tests, the first step of a good answer and its follow-ups.

8 questions: 3 warm-ups and 5 with model answers · Levels: Fresher to staff

Warm-up questions

Short questions with short answers, each answered in full.

Fresher to mid

Which of today's algorithms would a large quantum computer break, and which common primitives would it leave standing?

Answered in the lesson Post-quantum crypto: ML-KEM and ML-DSA
Fresher to mid

How does a key encapsulation mechanism differ from encrypting a key with a public key, and what does Encaps return?

Answered in the lesson Post-quantum crypto: ML-KEM and ML-DSA
Fresher to mid

What does it mean that a hybrid key exchange is secure if either half holds, and what does it not promise?

Answered in the lesson Hybrid post-quantum and crypto agility

Questions with model answers

What each question tests, the first step of a good answer and the follow-ups to expect.

Mid to senior

A service uses ECDHE in TLS and signs its release artefacts with ECDSA. Security wants both moved to post-quantum algorithms. Which do you move first, and what do you need to know before you set dates?
What it tests

Separating the recording risk of key exchange from the lifetime risk of signatures, and turning lifetimes into deadlines with Mosca's inequality.

First step

Ask, for each of the two, how long it must stay trustworthy and how long its migration takes. Call the first x and the second y, and compare x + y with the earliest time a large quantum computer could plausibly exist.
Follow-ups
- Which of the two has a deadline that starts today, and why?
- How can the key exchange move without waiting for the signatures?
- What changes if devices that you cannot update verify the artefacts?
From the lesson Post-quantum crypto: ML-KEM and ML-DSA
Model answer, Pro. Model answers open with any pass; prices are in the notice on this page.
Opening the model answers with your pass…
Model answers open with any MySmartCoPilot pass.
Pro pass · 1 week₹79$2.99
30 days₹179$5.99
1 year₹1,699$45
One payment; a pass never renews. The price shown is the total you pay: no fees or charges are added at checkout.
Passes can’t be bought right now, so the model answers can’t be opened at the moment. If you have a pass, enter your licence key.
Choose a pass I have a licence key
It also opens every other in-depth part in Learn and every Pro tool. Sales are final, except where the law gives you a right to withdraw, for example in the EU and the UK (refund policy).
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Mid to senior

Your API accepts ML-KEM-768 encapsulation keys from clients and encapsulates its responses to them. What do you check before encapsulating, where does each check come from, and how do you test that the checks work?
What it tests

Treating a peer's key as untrusted input, naming the two checks of FIPS 203 section 7.2, and testing them at their boundaries.

First step

Start from the fact that the key comes from the peer. List what a valid key looks like in bytes, then ask which of those properties your library already checks when it imports a key and which your own code has to check.
Follow-ups
- Which boundary values do you test for the modulus check?
- What does RFC 10024 require of a TLS server that receives a hybrid key share?
- Must the check run before every encapsulation, or can its result be reused?
From the lesson Post-quantum crypto: ML-KEM and ML-DSA
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Mid to senior

A teammate designs a file format that encrypts to a recipient with X25519 and ML-KEM-768 and derives the key as SHA-256 over the X25519 secret followed by the ML-KEM secret. Review the design: what is wrong, what do you change, and how do you test the change?
What it tests

Seeing that a combiner can lean on properties of its components, naming what a safer combiner hashes, and writing a test that exercises the difference.

First step

Write down what goes into the hash and what does not. Then ask what an attacker who can change a ciphertext, a public key or the format's version label could change without changing the hash input.
Follow-ups
- Why is a hash of the two secrets not enough, and what do you add?
- Does it matter that X25519 and ML-KEM-768 both pass the obvious tests today?
- How do you test the combiner so that a later change of component cannot slip through?
From the lesson Hybrid post-quantum and crypto agility
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Mid to senior

You are designing an encrypted file format that must still open in ten years, when its algorithms will have changed. What goes in the header, what does a reader do with it, and what do you do on the day an algorithm is retired?
What it tests

Putting an identifier in an authenticated header, keeping a registry with states, and planning a re-encryption job and a disable date.

First step

List what a reader needs to know before it can decrypt anything. Then decide which of those values an attacker who edits the file must not be able to change unnoticed, and where each value will sit.
Follow-ups
- Where does the version go, and what makes sure it was not edited?
- What states can a version have in the registry, and what does each one allow?
- How do you retire an algorithm without losing a single file?
From the lesson Hybrid post-quantum and crypto agility
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Mid to staff

You have two weeks to produce the first cryptographic inventory of a platform of 40 services and a plan to move it to post-quantum algorithms. What do you collect, how do you rank it, and what does the plan say when nobody knows when a quantum computer will arrive?
What it tests

Building an inventory with lifetimes and owners, ranking it with Mosca's inequality under a stated assumption, and finding keys that wrap other keys.

First step

Fix the row you will fill for every use of cryptography: the job, the algorithm and size, how long its data or trust must last, how long a move would take and who owns it. Then decide how you will find the uses, since a list built from memory is incomplete.
Follow-ups
- How do you find the uses that nobody remembers?
- Which two assets would you rank first, and what would make you change that?
- How do you present a plan whose key assumption is unknown?
From the lesson Hybrid post-quantum and crypto agility
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes

All Applied Cryptography for Developers interview questions · The Applied Cryptography for Developers track

Warm-up questions

Which of today's algorithms would a large quantum computer break, and which common primitives would it leave standing?

How does a key encapsulation mechanism differ from encrypting a key with a public key, and what does Encaps return?

What does it mean that a hybrid key exchange is secure if either half holds, and what does it not promise?

Questions with model answers

A service uses ECDHE in TLS and signs its release artefacts with ECDSA. Security wants both moved to post-quantum algorithms. Which do you move first, and what do you need to know before you set dates?

Your API accepts ML-KEM-768 encapsulation keys from clients and encapsulates its responses to them. What do you check before encapsulating, where does each check come from, and how do you test that the checks work?

A teammate designs a file format that encrypts to a recipient with X25519 and ML-KEM-768 and derives the key as SHA-256 over the X25519 secret followed by the ML-KEM secret. Review the design: what is wrong, what do you change, and how do you test the change?

You are designing an encrypted file format that must still open in ten years, when its algorithms will have changed. What goes in the header, what does a reader do with it, and what do you do on the day an algorithm is retired?

You have two weeks to produce the first cryptographic inventory of a platform of 40 services and a plan to move it to post-quantum algorithms. What do you collect, how do you rank it, and what does the plan say when nobody knows when a quantum computer will arrive?