Exercise 2: Which Steps of the Worked System a Quantum Computer Would Break — Possible Solution
====================================================================

Per Chapter 9's quantum asymmetry, Shor's algorithm efficiently solves
the factoring problem (RSA) and the discrete logarithm problem
(Diffie-Hellman/ECC), breaking those algorithms outright -- while
Grover's algorithm only degrades AES's effective key strength by
roughly half, a manageable, non-catastrophic weakening.

Applying that directly to this chapter's five-step worked system:

STEPS THAT WOULD NEED IMMEDIATE REPLACEMENT:

- Step 1 (Key Exchange, Ch.9): ECDHE relies on the elliptic-curve
  discrete logarithm problem -- exactly the category of problem
  Shor's algorithm solves efficiently. A large-scale quantum computer
  would let an attacker derive the same shared secret Alice and Bob
  computed, breaking the key exchange completely. This step would need
  to be replaced with a post-quantum key exchange like ML-KEM.

- Step 4 (Identity Verification, Ch.10): Alice's signature -- whether
  RSA or ECDSA -- also relies on the same class of hard problem
  (factoring or discrete logarithm) that Shor's algorithm breaks. An
  attacker could forge signatures that would pass verification against
  Alice's public key. This step would need to be replaced with a
  post-quantum signature scheme like ML-DSA.

STEPS THAT WOULD BE COMPARATIVELY UNAFFECTED:

- Step 2 (Key Derivation, Ch.11) and Step 3 (Authenticated Encryption,
  Ch.5/6/8): HKDF is built on HMAC (Ch.8), and AES-256-GCM is a
  symmetric primitive (Ch.5/6). Neither relies on factoring or
  discrete logarithms -- they rely on brute-force search being
  infeasible, which is exactly the category Grover's algorithm only
  degrades, not breaks outright. AES-256 specifically was already
  noted (Ch.5, Ch.9) to retain roughly AES-128-equivalent security
  even against Grover's algorithm, so it would remain safe with no
  design change needed, only continued use of the already-larger key
  size.

- Step 5 (Key Management, Ch.11): entropy, storage, and rotation
  practices are independent of which specific mathematical algorithms
  are in use -- good key management remains good key management
  regardless of which primitives it's protecting.

WHY THIS WORKS AS AN ANSWER
------------------------------
This maps Chapter 9's Shor-vs-Grover asymmetry directly onto each
concrete step of this chapter's own worked system, rather than
restating the asymmetry in the abstract -- showing specifically that
it's the PUBLIC-KEY steps (key exchange and signing) that face
existential replacement, while the SYMMETRIC steps (encryption, MAC,
key derivation) and the operational step (key management) carry
through comparatively unchanged, exactly matching the chapter's own
statement that post-quantum work is "replacing this course's Chapter 9
algorithms," not the whole system.