Why This Matters#

Cryptography is the mathematical foundation of all digital security. Every time you visit a website, send a message, or authenticate to a service, cryptographic algorithms are protecting you. Understanding how they work — and how they fail — is essential.

Core Concepts#

Symmetric Encryption#

Same key for encryption and decryption. Fast, efficient for bulk data.

flowchart LR
    P["Plaintext"] -->|"Key K"| E["Encrypt"]
    E --> C["Ciphertext"]
    C -->|"Key K"| D["Decrypt"]
    D --> P2["Plaintext"]

Algorithms#

Block Cipher Modes#

How to encrypt data larger than one block:

Always use authenticated encryption (GCM, ChaCha20-Poly1305) — encryption without authentication allows undetected tampering.

The Key Distribution Problem#

If Alice and Bob need the same key, how do they share it securely? This is why asymmetric cryptography exists.

Asymmetric Encryption#

Two mathematically linked keys: public (shared freely) and private (kept secret).

flowchart LR
    P["Plaintext"] -->|"Bob's Public Key"| E["Encrypt"]
    E --> C["Ciphertext"]
    C -->|"Bob's Private Key"| D["Decrypt"]
    D --> P2["Plaintext"]

Algorithms#

Why Not Use Asymmetric for Everything?#

Solution: Hybrid encryption — use asymmetric to exchange a symmetric key, then encrypt data with the symmetric key. This is exactly what TLS does.

Hashing#

One-way function: input → fixed-size output. Cannot be reversed.

Properties of a Good Hash#

Algorithms#

Password Hashing (Different Category)#

General-purpose hashes (SHA-256) are too fast for passwords — attackers can try billions per second. Password hashes are intentionally slow:

Never: store plaintext passwords, use MD5/SHA for passwords, use unsalted hashes.

Digital Signatures#

Prove that a message was created by a specific entity and hasn’t been modified:

sequenceDiagram
    participant Alice
    participant Bob
    
    Note over Alice: Sign with private key
    Alice->>Alice: hash(message) → digest
    Alice->>Alice: encrypt(digest, private_key) → signature
    Alice->>Bob: message + signature
    
    Note over Bob: Verify with public key
    Bob->>Bob: hash(message) → digest
    Bob->>Bob: decrypt(signature, public_key) → original_digest
    Bob->>Bob: Compare digests (match = valid)

Use Cases#

Public Key Infrastructure (PKI)#

The trust system that makes HTTPS work.

Certificate Chain#

flowchart TD
    Root["Root CA<br/>(self-signed, offline, in OS trust store)"]
    Inter["Intermediate CA<br/>(signs end-entity certs)"]
    Leaf["Server Certificate<br/>(your-domain.com)"]
    
    Root -->|signs| Inter
    Inter -->|signs| Leaf

X.509 Certificate Contents#

Certificate Lifecycle#

stateDiagram-v2
    [*] --> Requested: CSR generated
    Requested --> Issued: CA validates & signs
    Issued --> Active: Installed on server
    Active --> Renewed: Before expiry
    Active --> Revoked: Compromised/invalid
    Renewed --> Active
    Revoked --> [*]

Revocation#

TLS (Transport Layer Security)#

The protocol that secures HTTPS, email, and most internet communication.

TLS 1.3 Handshake (Simplified)#

sequenceDiagram
    participant C as Client
    participant S as Server
    
    C->>S: ClientHello (supported ciphers, key share)
    S->>C: ServerHello (chosen cipher, key share, certificate, signature)
    Note over C,S: Both compute shared secret from key shares
    C->>S: Finished (encrypted)
    S->>C: Finished (encrypted)
    Note over C,S: Application data (encrypted with shared key)

TLS 1.3 vs 1.2#

Forward Secrecy#

Even if the server’s private key is compromised later, past sessions cannot be decrypted — because each session uses ephemeral keys that are discarded.

Post-Quantum Cryptography#

Quantum computers threaten current asymmetric algorithms (RSA, ECDSA) via Shor’s algorithm. Symmetric and hashing are less affected (just need larger keys).

Action now: Inventory where you use asymmetric crypto, plan migration timeline, use hybrid approaches (classical + post-quantum) during transition.

Key Takeaways#

1. Symmetric for speed, asymmetric for trust — real systems use both (hybrid)
2. Always use authenticated encryption (AES-GCM, ChaCha20-Poly1305)
3. Never roll your own crypto — use well-tested libraries (libsodium, OpenSSL)
4. Password hashing ≠ general hashing — use Argon2id or bcrypt, never SHA-256
5. TLS 1.3 is the standard — disable TLS 1.0/1.1, prefer 1.3 over 1.2
6. Forward secrecy is mandatory — ephemeral key exchange protects past sessions
7. Post-quantum is coming — start planning migration now