Track Y

Cryptography, under the hood

The primitives behind every secure system: hash functions, password hashing, symmetric and public-key encryption, MACs and digital signatures, key exchange and forward secrecy, and secure randomness.

1. What cryptography guarantees: the map of primitives

   Cryptography is not a synonym for encryption — it is a small toolbox of primitives, each providing one precise guarantee (secrecy, or tamper-detection, or proof of origin), and almost every security mistake comes from reaching for the wrong tool or combining the right ones wrongly. This lesson lays out the guarantees, the primitive families that deliver them, and the two rules that keep you out of trouble.

   11 min
2. Hash functions: one-way fingerprints

   A cryptographic hash turns any input into a fixed-size fingerprint, and a short list of precise properties — one-wayness, collision resistance, the avalanche effect — is what makes that fingerprint useful for integrity, content-addressing, and, with real care, passwords.

   12 min
3. Password hashing: salts and slow KDFs

   Storing passwords safely means hashing them, but not the way the last lesson might suggest — a fast general-purpose hash is exactly the wrong tool, and safety instead comes from a unique salt per password and a deliberately slow, memory-hard function that makes guessing expensive.

   12 min
4. Symmetric encryption: one shared key

   Symmetric encryption uses a single shared key to both encrypt and decrypt — it does the bulk of the world's real encryption because it's fast, but using it safely is entirely about the mode and the nonce, and it can't solve the one problem it depends on, getting that shared key to the other side.

   13 min
5. Public-key cryptography: the two-key trick

   Public-key cryptography replaces one shared secret with a mathematically linked key pair — a public half anyone can have and a private half only you hold — so two strangers can end up communicating securely without ever exchanging a secret in advance, at the cost of being far too slow for bulk data.

   13 min
6. MACs and digital signatures

   A MAC and a digital signature both prove a message is intact and came from someone who holds a specific key, but only a signature — built on a key pair rather than a shared secret — can prove which specific party sent it, and confusing the two is a common design mistake.

   13 min
7. Key exchange and forward secrecy

   Diffie-Hellman lets two strangers derive an identical shared secret over a channel an eavesdropper is watching, without ever transmitting it, but raw key exchange authenticates nobody — and using fresh, ephemeral keys per session adds forward secrecy, so a future key compromise can't unlock past traffic.

   12 min
8. Randomness, and how TLS combines everything

   Every key, nonce, and salt in this module is only as strong as the randomness that generated it, so a browser must use a CSPRNG rather than an ordinary predictable generator — and once that randomness is secure, the modern TLS handshake is simply every primitive from this module, assembled into one protocol.

   13 min