eMAPT study plan
eMAPT · Give each week a clear focus.
8 weeks · About 6 hours per week
PKI / TLS / applied cryptography
Map the PKI trust chain from root CA to leaf to end entity, and explain each certificate field and extension (Basic Constraints, Key Usage, EKU, SAN, AIA, CRLDP) in your own words.
Decode at least five real X.509 certificates with openssl x509 -text and identify signature algorithm, validity, issuer/subject linkage, and path length constraints.
Differentiate symmetric vs asymmetric primitives (AES-GCM, ChaCha20-Poly1305, RSA-OAEP, ECDSA, Ed25519) by use case, key size, and failure mode.
Build a one-page reference sheet of certificate extensions and their security implications.
Your checkpoint
A decoded-certificate workbook covering five certificates with field-by-field annotations and a one-page extension cheat sheet.
PKI / TLS / applied cryptography
Stand up a local two-tier CA (root + intermediate) with openssl and issue leaf certificates for a test host.
Configure a TLS server (nginx or openssl s_server) with your chain and verify clients validate it, including a deliberate missing-intermediate failure.
Explain chain building, trust anchors, and cross-signing, and describe why incomplete chains break mobile clients.
Produce a short written comparison of DV, OV, and EV validation levels and what each actually proves.
Your checkpoint
A working local PKI with root, intermediate, and two leaf certs, plus a log of three successful and three failed chain validations with root-cause notes.
PKI / TLS / applied cryptography
Enumerate TLS 1.2 vs 1.3 handshake steps and identify where authentication, key exchange, and forward secrecy are established.
Capture a handshake with openssl s_client -msg and annotate each flight, including ClientHello extensions (SNI, ALPN, supported_groups, key_share).
Explain cipher suite naming and select acceptable suites for TLS 1.2 and 1.3 with justification.
Describe session resumption (session IDs, tickets, PSK in 1.3) and the security tradeoffs.
Your checkpoint
An annotated packet-level transcript of one TLS 1.3 and one TLS 1.2 handshake with per-message commentary.
PKI / TLS / applied cryptography
Identify and explain common TLS/PKI failure modes: expired certs, hostname mismatch, weak signature algorithms, revoked certs, and misconfigured chains.
Test revocation checking (CRL and OCSP) against your local CA and document behavior when the responder is unreachable.
Explain pinning, HSTS, and certificate transparency, and where each fits in a defense-in-depth model.
Analyze a mobile app's certificate validation logic conceptually and list the checks a correct implementation must perform.
Your checkpoint
A failure-mode matrix of at least eight TLS/PKI misconfigurations with symptom, detection method, and remediation.
PKI / TLS / applied cryptography
Explain key storage on mobile platforms (Keychain, Keystore, hardware-backed keystores, secure enclave) and the protection each provides.
Compare at-rest protection approaches: passphrase-derived keys (PBKDF2, scrypt, Argon2), platform keystores, and file-level encryption.
Describe secure random number generation and identify why weak RNG or reused nonces break AES-GCM and ECDSA.
Outline a threat model for a mobile app's cryptographic design covering data at rest, in transit, and key compromise.
Your checkpoint
A mobile crypto threat model document mapping each asset to its protection mechanism and residual risk.
PKI / TLS / applied cryptography
Explain digital signature schemes end to end (hashing, padding, verification) and distinguish RSA-PKCS1v1.5, RSA-PSS, ECDSA, and EdDSA.
Describe common implementation pitfalls: nonce reuse in ECDSA, Bleichenbacher-style padding oracles, and signature verification bypass.
Analyze JWT structure and signing (HS256 vs RS256 vs ES256), including alg confusion and key confusion risks.
Practice reasoning about hybrid encryption and key wrapping as used in messaging protocols.
Your checkpoint
A written analysis of three signature/JWT attack scenarios with the cryptographic root cause and the correct defensive control for each.
PKI / TLS / applied cryptography
Perform a timed mixed review of PKI, TLS handshake, and signature topics, targeting weak areas identified in prior weeks.
Re-derive from memory the certificate validation algorithm and the TLS 1.3 key schedule at a conceptual level.
Work through at least twenty practice-style scenario questions and write justifications for each answer choice.
Close remaining knowledge gaps by re-testing your local CA and TLS lab with edge cases.
Your checkpoint
A scored practice set (20+ scenario questions) with written justifications and a prioritized list of remaining weak topics.
PKI / TLS / applied cryptography
Consolidate all notes into a single condensed review sheet covering the full domain.
Re-run the end-to-end lab (CA, TLS server, revocation, failure cases) without referring to notes.
Take a final timed self-assessment and review every missed item to root cause.
Finalize exam-day logistics and a last-pass checklist of high-frequency concepts.
Your checkpoint
A final condensed review sheet plus a completed timed self-assessment with a documented remediation log.
Milestones
Week 2: Can build a root-to-leaf chain from scratch, explain every certificate field, and correctly diagnose a missing-intermediate failure without notes.
Week 4: Can annotate a full TLS 1.2 and TLS 1.3 handshake message by message and explain forward secrecy, resumption, and revocation checking.
Week 6: Can explain signature scheme differences, name three implementation pitfalls, and analyze JWT algorithm-confusion risk from first principles.
Week 8: Scores at or above your target on the timed self-assessment and can re-run the full PKI/TLS lab end to end without notes.