EECC case studies
EECC · Put your knowledge to work in context.
The EC-Council Certified Encryption Specialist (EECC) is a foundational credential aimed at people who need a working, practical command of cryptography rather than a research mathematician's depth. Typical candidates are SOC analysts, IT administrators, developers, auditors, and compliance staff who must choose algorithms, read certificate chains, or explain why a given implementation is weak. The EECC case studies are 5 cases and about 4,700 words.
1Retiring Two-Key 3DES Across a Payment HSM Estate
A regional payment processor runs a card-acceptance switch in front of two Thales payShield 10K HSMs. About 1,850 merchant terminals use ANSI X9.24 DUKPT with two-key Triple DES for PIN block encryption, and the host derives per-transaction keys from an initial PIN encryption key under a base derivation key.
983 words, about 5 min2Three Audit Findings in Password Storage and API Signing
An audit of a B2B SaaS platform with 2.4 million accounts and 61,000 active API clients produced three findings. Passwords for accounts created before 2016 are stored as unsalted SHA-1, 40 hex characters, in the same table as newer bcrypt cost-12 hashes.
1,005 words, about 5 min3Intermediate CA Expiry Against a Firmware-Pinned Root
A fleet of 40,000 industrial gateways validates the cloud endpoint's certificate chain against a root CA public key compiled into firmware. The chain today is a self-signed Root A (2048-bit RSA, expires 2038), an intermediate B cross-signed by Root A and by Root C, the new corporate root, and leaf server certificates with 90-day lifetimes.
982 words, about 5 min4Build Server Compromise and the Code-Signing Keys
An independent software vendor ships a desktop agent to 14,000 enterprise customers, 3,500 of which also install a kernel-mode driver. Release artifacts are signed on a Windows build server with an organisation-validation code-signing certificate; the private key sits in a software key store on that server, protected by a password stored in the CI configuration.
970 words, about 5 min5GCM Nonce Reuse in a Power-Unstable Controller Fleet
A building-automation vendor ships 8,200 controllers that report over MQTT using AES-128-GCM. The 96-bit nonce is a 32-bit device identifier followed by a 64-bit counter persisted in flash.
760 words, about 4 min