Cryptography Essentials
The machinery that makes confidentiality and integrity work
Hashing protects integrity, symmetric encryption protects confidentiality at scale, asymmetric crypto enables TLS and signatures — and PKI certifies identity. Analysts read the crypto layer in every trail.
What you will learn
- Choose hashing vs encryption for a job and explain the difference
- Describe a TLS-style handshake with asymmetric + symmetric crypto
- Read common artifacts: hashes, certificates, signed files
What is this?
Cryptography provides the primitives security breathes on: hashing (one-way integrity fingerprints), message authentication (MACs), symmetric encryption (AES — same key both sides, fast, for data at scale), asymmetric encryption (RSA/ECDH — different keys, enables key agreement and signatures), and digital signatures. Combined with a public-key infrastructure (PKI/certificates), it underwrites TLS, code signing, password storage and much more.
Why do you need it?
- Every 'encrypted' claim in logs, headers and configs refers to one of these primitives.
- Choosing the wrong primitive (hashing to hide data, fast hash for passwords) is a classic flaw.
- TLS is the most-observed crypto in production; you must be able to read its handshake.
- PKI trust decisions (which cert, which CA) are daily operational risk.
Mental model
A padlock, a shredder, and a wax seal
Encryption, hashing, signing
A padlock hides the letter (encryption — reversible with the key). A shredder destroys information irreversibly (hashing — one-way fingerprint). A wax seal proves the letter holder and content are authentic (signature — verifiable by anyone who trusts you).
How it works
- Hashing: a deterministic one-way digest; SHA-256 output. Any change to input changes the digest; you can't reverse a digest to the input.
- Symmetric encryption: AES with the same key encrypts and decrypts; fast enough for bulk data.
- Asymmetric crypto: a keypair — public encrypts/verifies, private decrypts/signs. Slow, so used to exchange session keys and sign.
- Key exchange (TLS): the handshake uses asymmetric primitives to agree a random session key, then switches to fast symmetric AES for the bulk stream.
- Digital signatures: sign the hash of a message with the private key; anyone with the public key verifies both origin and content.
- PKI: certificates bind public keys to identities and chains to a trusted root; TLS trust = cert chain + hostname + validity.
A simplified TLS handshake.
In production
- An app stores passwords as argon2id hashes with per-user salts and verifies logins by re-hashing.
- Artifact release signing: verifiers hash the download and check an Ed25519 signature from the maintainer's key.
- TLS everywhere via certificates from a public CA, validated by clients against the root chain.
Best practices
- Use vetted libraries, not homegrown crypto — ever (see 'don't roll your own').
- Choose modern defaults: SHA-256+, AES-256-GCM, TLS 1.2/1.3; avoid MD5, SHA-1 and 3DES.
- Store only hashes of secrets; encrypt only with real key management.
- Hash messages for integrity AND sign the hash for authenticity — hash alone can't prove who produced it.
- Rotate keys and retire algorithms on a schedule.
Common mistakes
- Using a fast hash (MD5/SHA-1/SHA-256 alone) for passwords — brute-forceable; needs memory-hard hashing + salt.
- Reusing keys/IVs, hard-coding keys in code, or shipping keys in the repo.
- Treating hashing as encryption: hashed data isn't 'encrypted', it's unrecoverable.
- Ignoring the MITM-trust question: encryption without verified identity is just obfuscation against the bystander.
Debugging tips
- Compare SHA-256 of downloaded vs expected file to prove integrity (and, with a signature, authenticity).
- openssl s_client -connect host:443 inspects the live certificate chain — validity, issuer, SANs.
- A 'certificate expired' loop is usually the leaf or root clock — check both local time and the chain's validity window.
Security considerations
- Key management is the weak end of cryptography: a stolen key defeats the strongest algorithm. Manage keys with KMS/Hardware wallets.
- Post-quantum: modern asymmetric schemes (RSA/ECC) are at risk from future quantum computers — track algorithm migrations.
Interview checkpoint
Hands-on lab
- Generate hashes and prove tamper detection on your own file
- Encrypt and decrypt a file with a symmetric key
- Create a keypair, sign a file, and verify the signature (integrity + origin)
Hash, Encrypt and Sign Locally
35 min · intermediate
Quick quiz
Which primitive is the right tool for storing a password for later verification?
Encrypting data protects its integrity as well as its confidentiality.