Local worksheet

Hop map

List each TLS hop from the browser to your internal services, then record key agreement and authentication separately. They change on different schedules and are verified in different ways.

Why this matters. Providers can enable hybrid key agreement at the edge while every hop behind it stays classical. A map of hops shows which changes are yours to make and verify.

Key terms 4

TLS: Transport Layer Security: the protocol that authenticates servers and encrypts traffic for HTTPS and many other services.
Hybrid key exchange: Key agreement that combines a classical method with a post-quantum one, so the session stays protected while either remains secure.
KEM: Key encapsulation mechanism: a method for two parties to establish a shared secret during key agreement.
Crypto-agility: The ability to replace algorithms, keys and certificates through a tested process without redesigning the system.

Hybrid key agreement on the first hop says nothing about the hops behind it. Mark what you know; leave the rest as unknown. This map records your understanding, not an assessment.

Read the article this instrument accompanies: You are not migrating to post-quantum. Your CDN is.

4 hops hybrid observed on 0 key agreement unknown on 4 authentication unknown on 4 4 without an owner

Hop 1 Browser → Edge / CDN

Hop 1 from

Hop 1 to

Key agreement on hop 1

Authentication on hop 1

Owner for hop 1

Notes for hop 1

A public hop can be observed directly. Observe a hostname you control

Hop 2 Edge / CDN → Origin load balancer

Hop 2 from

Hop 2 to

Key agreement on hop 2

Authentication on hop 2

Owner for hop 2

Notes for hop 2

Hop 3 Load balancer → Application

Hop 3 from

Hop 3 to

Key agreement on hop 3

Authentication on hop 3

Owner for hop 3

Notes for hop 3

Hop 4 Application → Internal API or database

Hop 4 from

Hop 4 to

Key agreement on hop 4

Authentication on hop 4

Owner for hop 4

Notes for hop 4

Take it into a conversation

The map is saved only in this browser tab. Export it, or open an encrypted enquiry from this tab: the map is attached to the encrypted message, and you can remove it there.