Applied Cryptography

• The math is rarely the vulnerability; the mistakes are in reusing nonces, weak randomness, and hand-rolled schemes.
• Modern stacks expect you to reason about cipher suites, forward secrecy, and short-lived keys.
• Regulated data protection (and breach aftermath) turns 'which mode did you use' into an audit finding.

One key that opens every room is efficient but catastrophic if copied; per-session keys limit the blast radius.

• AEAD modes (AES-GCM, ChaCha20-Poly1305) encrypt and authenticate in one pass — never reuse a nonce for the same key.
• Key exchange uses ephemeral keys so a stolen long-term key cannot decrypt old traffic (forward secrecy).
• PBKDF2/Argon2 stretch human passwords into keys; the cost is tuned to make guessing expensive.
• Keys are rotated on schedules and cryptographic limits: a GCM key's safe data cap is far below its advertised 2^128.

• A web service uses TLS 1.3 with forward-secret groups and rotates per-session keys automatically.
• A payments team stores card-holder data under envelope encryption: a data key wrapped by a KMS master key.
• A password store uses Argon2id at tuned cost, plus a per-user random salt.

• Default to a standard AEAD library; never compose modes manually.
• Bind version to keys so you can roll algorithms without guessing which data used the old scheme.
• Enforce uniqueness of nonces/IVs and cap bytes-per-key per the cipher's limits.
• Separate keys by purpose: signing, encryption, authentication, KDF — no reuse across roles.

• ECB or CBC misuse: AES-CBC with a fixed IV leaks structure and enables padding oracle attacks.
• Encrypt without authenticating: someone flips bits and the ciphertext is silently corrupt.
• Reusing a nonce under GCM destroys the confidentiality and authenticity guarantees.
• Storing keys next to the ciphertext, or in config files committed to the repo.

• When decryption fails with tag mismatch, suspect a corrupted blob, a wrong key, or a nonce reuse — in that order.
• Compare cipher `head -c` bytes across decrypts to catch off-by-one version markers.
• Use `openssl speed` and library docs to choose KDF cost; tune on representative hardware.

• Randomness quality matters: use the OS CSPRNG, never time/pid/random() seeds for keys.
• Rotation and revocation: a compromise of today's keys must not read yesterday's data.
• Audit cipher suites and key lengths; 'it encrypts' is not a meaningful control statement.