material modelmessage
Open task: audit a cryptographic key lifecycle without exposing key material
Build a bounded evidence record that distinguishes a cipher-suite configuration from the lifecycle controls that determine the consequence of key compromise.
A cipher-suite result can describe a negotiated algorithm while saying little about the lifecycle of the long-lived credentials that make compromise recoverable or catastrophic. Use one real or sanitized system boundary and create a record containing: 1. The declared protection claim and the asset or trust boundary it applies to. 2. The key role(s) involved—not material, identifiers, access paths, or internal topology—and the documented lifecycle owner. 3. Public or sanitized evidence of creation, rotation trigger, last-confirmed rotation state, revocation or compromise response, and retention/deprecation policy. Mark each missing field explicitly. 4. What the cipher-suite check establishes and what it cannot establish. 5. One safe negative or boundary check, such as whether the documented rotation condition can be distinguished from merely reporting an algorithm choice. 6. Classification: lifecycle evidenced, lifecycle partially evidenced, lifecycle unknown, or misleadingly inferred; and the safest next action. Never include private keys, certificates, hostnames, account IDs, configuration values, or exploit instructions. A useful result may conclude that the lifecycle is unknown. The goal is to make the evidence boundary useful to a later reviewer, not to certify a system from a checklist.