Cryptography Basics & Encryption Principles
Cryptography is the mathematical foundation of cybersecurity. Every secure connection, digital signature, password hash, and blockchain transaction depends on cryptographic primitives. This module covers the essential algorithms, how they work, when to use each, and how they\u2019ve been broken in real incidents.
The Four Pillars of Cryptography
Modern cryptography rests on four fundamental primitives. Each solves a specific security problem. Understanding when and why to use each is essential.
Symmetric Encryption
Same secret key encrypts and decrypts. Fast but key distribution challenge.
Key Algorithms:
Important
✓ Advantages
Very fast, suitable for bulk data encryption, computationally efficient
✗ Disadvantages
Key distribution problem—how do you securely share secret key with remote party?
Asymmetric Encryption
Public key encrypts, private key decrypts. Solves key distribution but slower.
Key Algorithms:
Important
✓ Advantages
No key distribution problem—publish public key freely. Enables digital signatures and certificates.
✗ Disadvantages
Much slower (1000x), limited data size (can only encrypt small amounts, usually just symmetric key)
Cryptographic Hashing
One-way function: input → fixed-size hash. Cannot reverse to original input. Used for integrity verification.
Key Algorithms:
Core Properties:
- Deterministic (same input always gives same hash)
- Avalanche effect (tiny input change → completely different hash)
- Preimage resistant (cannot reverse)
- Collision resistant (hard to find two inputs with same hash)
Important
✓ Advantages
Fast, irreversible, excellent for passwords (with salt), file integrity, digital signatures
✗ Disadvantages
Not encryption—cannot retrieve original data. Vulnerable to rainbow tables if unsalted.
Digital Signatures
Prove authenticity and integrity of message. Combines hashing + asymmetric encryption.
Key Algorithms:
Important
✓ Advantages
Non-repudiation (signer cannot deny), message integrity, authentication
✗ Disadvantages
Private key security is critical—compromise = total compromise of signing identity
Cryptographic Hashing in Depth
Hash functions map arbitrarily large data to a fixed-length fingerprint. A single character change produces completely different hash (avalanche effect).
SHA-256 Hash Examples: Demonstrating Avalanche Effect
Input: \"hello\"
1SHA-256:\n2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
Input: \"Hello\" (capital H)
1SHA-256:\n185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969
Info
Password Storage
Never store plaintext passwords. Salt + hash with bcrypt/Argon2. Salt prevents rainbow table attacks. Slow hash thwarts brute force.
File Integrity
Download files with provided SHA-256 checksum. Recompute hash and compare. Detects corruption, tampering, or man-in-the-middle attacks.
Digital Signatures
Hash message, encrypt hash with private key. Verifier decrypts signature, hashes message, compares. Proves authenticity without revealing message.
Hybrid Cryptography: TLS/SSL Deep Dive
Real-world systems use hybrid cryptography: asymmetric encryption to exchange symmetric key, then symmetric for bulk data. TLS (Transport Layer Security) is the most widespread implementation.
TLS 1.3 Handshake: Step-by-Step
1. Client Hello
Client sends supported TLS versions, cipher suites, and random nonce.
Tip
2. Server Hello + Certificate
Server responds with chosen cipher suite, its X.509 certificate (public key), and server random.
Tip
3. Key Exchange
RSA: Client encrypts pre-master secret with server's public key. ECDHE: Both compute shared secret via elliptic curve math.
Tip
4. Session Keys
Both sides derive symmetric keys from pre-master secret + both nonces using PRF.
Tip
5. Encrypted Communication
All subsequent messages encrypted with symmetric keys (AES-GCM, ChaCha20-Poly1305).
Tip
Why Both Symmetric & Asymmetric?
- Asymmetric alone: 1000x slower, encrypting large files impractical
- Symmetric alone: Key exchange problem\u2014how share secret key securely over internet?
- Hybrid: Fast symmetric encryption + secure asymmetric key exchange = best of both
- Perfect Forward Secrecy (PFS): Ephemeral Diffie-Hellman keys ensure past sessions stay secret even if server private key compromised
TLS 1.3 vs 1.2 Improvements
- 1-RTT handshake (faster connection setup)
- Removed weak ciphers (RC4, 3DES, MD5, SHA-1)
- Enforced Perfect Forward Secrecy (PFS)
- Encrypted Server Name Indication (ESNI) for SNI privacy
- Zero-RTT resumption for returning visitors
- Simplified protocol (fewer options, easier to audit)
Public Key Infrastructure (PKI): The Web's Trust Framework
PKI is the system that issues, manages, validates, and revokes digital certificates. HTTPS websites trust browsers because browsers trust Certificate Authorities (CAs) that have audited and signed the website's certificate.
Certificate Chain of Trust
Root CA
Top of trust hierarchy. Self-signed. Pre-installed in OS/browser trust store. Offline for security.
Intermediate CA
Issued by Root. Used to sign end-entity certificates. Multiple layers common. Revocable.
End Entity Certificate
Actual certificate for website (example.com). Signed by Intermediate. Contains public key, validity, SANs.
Warning
X.509 Certificate Contents
1Subject: CN=example.com, O=Company, C=US2Issuer: CN=Let's Encrypt Authority X3, O=Let's Encrypt3Validity: Jan 1 00:00:00 2024 - Mar 31 23:59:59 20244Public Key Algorithm: RSA-20485Signature Algorithm: SHA256-RSA6Extensions:7- Subject Alt Names: example.com, www.example.com8- Key Usage: Digital Signature, Key Encipherment9- Extended Key Usage: TLS Web Server Authentication
Info
Cryptography in Practice: Real-World Scenarios
See how cryptographic primitives combine to secure everyday systems.
HTTPS Web Traffic
Symmetric
AES-256-GCM for bulk data encryption after handshake
Asymmetric
RSA/ECDHE for key exchange and certificate verification
Hashing
SHA-256 for HMAC and certificate fingerprinting
Result
Confidentiality + Integrity + Authentication achieved through hybrid approach.
SSH Login
Symmetric
AES/ChaCha20 for session encryption after key exchange
Asymmetric
RSA/Ed25519 host and user keys for server/client authentication
Hashing
SHA-256 for challenge-response and key verification
Result
Secure shell with encrypted tunnel and mutual authentication.
PGP Email
Symmetric
AES for message body encryption with session key
Asymmetric
RSA/ECC receiver's public key encrypts session key
Hashing
SHA-256 for signature verification and key IDs
Result
End-to-end encrypted email where only recipient can read contents.
Bitcoin Transactions
Symmetric
Not directly used in transactions (blockchain is public)
Asymmetric
ECDSA (secp256k1 curve) for transaction signing and ownership proof
Hashing
SHA-256 + RIPEMD-160 double hashing for Bitcoin addresses (P2PKH)
Result
Cryptographically secure proof of ownership without revealing private key.
Cryptographic Attack Vectors
Cryptography is hard. Misuse or implementation flaws completely break security. These attacks target implementations, not the mathematical algorithms.
Brute Force
Method: Try every possible key until correct one found. With n-bit key, 2^n possibilities.
Feasibility / Real-World:
AES-128: 2^128 ≈ 3.4×10^38 attempts. At 1 trillion attempts/sec, would take 10^18 years—longer than universe age. RSA-2048: 2^112 operations with GNFS (subexponential) but still infeasible with current tech.
Mitigation:
Use sufficiently long keys (AES-256 for long-term data, RSA-3072+ for signatures). Quantum computers threaten RSA/ECC.
Birthday Attack
Method: Find any two inputs that hash to same value (collision). Birthday paradox: need ~2^(n/2) attempts for n-bit hash.
Feasibility / Real-World:
SHA-1 (160-bit): ≈2^80 attempts. In 2017, Google actually produced SHA-1 collision with 2^63.4 attacks. MD5 (128-bit): collisions trivial (~2^20 operations).
Mitigation:
Use SHA-256+ for new systems. Don’t rely on MD5/SHA-1 for digital signatures, code signing, or certificates.
Side-Channel Attacks
Method: Extract keys from physical implementation, not algorithm math. Timing, power consumption, electromagnetic radiation, cache behavior.
Feasibility / Real-World:
Mitigation:
Constant-time implementations, hardware security modules (HSMs), memory access randomization, CPU microcode patches.
Man-in-the-Middle (MITM)
Method: Intercept communication, decrypt, re-encrypt to both parties. Requires breaking encryption or impersonating one party.
Feasibility / Real-World:
Without certificate compromise or malicious CA, TLS MITM is very hard. With compromised CA or user accepting invalid cert, trivial.
Mitigation:
Certificate pinning, strict certificate validation (not accepting self-signed), HSTS, DNSSEC.
Weak RNG (Random Number Generator)
Method: Predictable random numbers compromise keys. Cryptographic systems need true randomness.
Feasibility / Real-World:
Mitigation:
Use OS-provided CSPRNG (/dev/urandom, CryptGenRandom). Never implement crypto PRNG yourself.
Key Takeaways
- Symmetric encryption (AES) is fast for bulk data but needs secure key exchange.
- Asymmetric encryption (RSA/ECC) solves key exchange but is slow; used for certificates and signatures.
- Hashing (SHA-256) is one-way verification; never reverse. Use with salt for passwords.
- Hybrid combines both: asymmetric exchanges symmetric session key, symmetric encrypts data.
- PKI (X.509 certificates, CAs) enables trust on the internet through chain of trust.
- Implementation flaws (weak RNG, side-channels) break crypto more often than algorithm breaks.
- AES-256 and SHA-256 are currently secure. MD5, SHA-1, DES, 3DES are deprecated.
Further Reading & Resources
Practical guide to building real-world crypto systems by recognized experts. Essential reading.
Comprehensive textbook covering algorithms, protocols, and real-world applications.
Official standards for AES, SHA, RSA PKCS, and other cryptographic algorithms.
The official specification for Transport Layer Security version 1.3.