Six false moves

Six practices appear in cryptographic remediation plans more often than anything that works, and our Part E catalogues them under one heading: practices that appear to diversify and do not. Institutions reach for them first because they’re cheaper, and because they satisfy the instruments that read vendor registers. Every one of them passes a substitutability test. None of them passes resolution.

Multi-vendor sourcing from one code lineage. The most common false move. Five suppliers whose implementations descend from one upstream are one dependency at layer 2, and one defect reaches all five on the same day. The procurement file grows, and the failure domain doesn’t shrink.

Multiple platforms from one manufacturer. Different brands, one firmware family. The custody layer resolves to family rather than product name for exactly this reason. Resolution to product names is also the first entry in our reviewer error catalogue, because it understates concentration at the layer where remediation costs the most.

Redundant authorities chained to one root. Apparent PKI redundancy that resolves, path by path, to a single trust anchor. The redundancy is real at the authority level and absent at the level a root compromise operates on.

Hybrid where both components share a lineage. Independence is the whole premise of a hybrid construction. Hybrid is defence in depth, not diversification. With a sound combiner, breaking one component doesn’t break the exchange, which changes what a failure costs without changing how many independent things must fail. Where the classical and post-quantum components descend from one implementation, even that consequence benefit weakens, and layer 2 records the shared ancestor.

Certification as a substitute for provenance. A validation confirms correct computation. It says nothing about code independence, and two validated modules may share an ancestor. The chips behind the 2017 ROCA event held FIPS 140-2 and Common Criteria EAL5+ certifications while sharing the key-generation defect that forced a national re-key – the public record’s own demonstration of this row.

Adding a supplier without checking ancestry. Raises the vendor count, the onboarding cost and the audit surface. It changes nothing at any layer unless the new supplier’s lineage, firmware family and generation design actually differ, which is the question the addition was supposed to answer and usually doesn’t ask.

The diagnostic

We compress all six into one test. If a proposed remediation changes the vendor register but no cell in the heat map, it is a false move. The test is cheap, it runs before money is spent, and it converts an argument about intentions into a check on two documents the institution already produces. The same test reads a full remediation roadmap as easily as a single proposal.

One cultivar

Agriculture ran this experiment at industry scale. Through the 1950s the export banana trade was diversified by every commercial measure, with many growers, many shippers and competing companies across two continents – and the whole of it grew one cultivar, Gros Michel. Panama disease didn’t negotiate with the corporate structure. It worked through the clone, plantation by plantation, until the industry replanted on Cavendish by the 1960s. Cavendish is one cultivar again, and the disease’s TR4 strain is now spreading through that one. Every commercial layer of that trade was genuinely diverse. The layer the pathogen operated on had a count of one, and no amount of restructuring above it changed the count.

What a true move looks like

The same Part E that lists the false moves prices the real ones, layer by layer, and two of them cost almost nothing, which is why they come first. Counterparty coordination at the protocol layer is frequently free. Paths negotiate down to weak options because nobody checked, not because the capability is missing, so check before investing. Supplier lineage disclosure, required at procurement and due diligence, is what converts undisclosed entries into computable ones, and it moves the reach bounds that no amount of vendor-adding will touch. Both show up where the diagnostic looks, as changed cells in the heat map rather than new rows in the register.

The expensive moves, genuinely independent lineages on the highest-value paths and manufacturer diversity verified at firmware family, are real, and we say plainly that at some layers honest risk acceptance beats pretending. What separates all of them from the six above is the same one-line test. A cell moved.