Simple explanation
Cryptography is how we mathematically enforce confidentiality, integrity, authenticity, and non-repudiation. This lesson covers the building blocks: PKI, encryption types, hashing, obfuscation, and the hardware that protects keys.
Technical explanation
- PKI (Public Key Infrastructure) — the system of certificate authorities (CAs), certificates, and keys that lets strangers establish trust (e.g., your browser trusting a website's HTTPS certificate).
- Symmetric encryption — one shared key encrypts and decrypts (AES). Fast, but the key must be securely distributed.
- Asymmetric encryption — a public key encrypts, only the matching private key decrypts (RSA). Solves key distribution but is slower — often used to securely exchange a symmetric key, which then does the bulk encryption (this hybrid approach is exactly what TLS does).
- Key exchange — protocols (like Diffie-Hellman) that let two parties agree on a shared secret over an insecure channel without ever transmitting the secret itself.
- Hashing — a one-way function producing a fixed-length "fingerprint" of data (SHA-256). Used to verify integrity — even a 1-bit change in the input produces a wildly different hash.
- Salting — random data added to a password before hashing, so two identical passwords don't produce identical hashes, defeating precomputed rainbow-table attacks.
- Key stretching — deliberately slowing down a hashing algorithm (bcrypt, PBKDF2) so brute-forcing password hashes is computationally expensive, even though verifying a single correct guess is fast.
- Digital signatures — a hash of a message, encrypted with the sender's private key. Anyone with the public key can verify it — proving both integrity (message unaltered) and non-repudiation (only the sender could have signed it).
- Obfuscation techniques: steganography (hiding data inside other data, like a message inside an image file), tokenization (replacing sensitive data with a non-sensitive placeholder token, with the real data stored elsewhere), data masking (partially hiding data, like showing only the last 4 digits of a card number).
- Key management hardware: TPM (Trusted Platform Module — a chip on a motherboard for hardware-backed key storage), HSM (Hardware Security Module — a dedicated, often network-attached device for high-volume cryptographic operations), KMS (Key Management System — cloud-based key lifecycle management), secure enclave (an isolated, protected processing area within a chip).
- Blockchain / open public ledger — a distributed, append-only record where each block cryptographically references the previous one, making tampering with history evident.
- Certificates — digital documents binding a public key to an identity, issued and signed by a CA.
Synonyms / related terms
| Term | Means | |---|---| | Asymmetric encryption | Public key cryptography | | PBKDF2 / bcrypt | Common key-stretching algorithms | | Root of trust | Often refers to the TPM as the hardware anchor for a device's security |
Concept Check
"A company needs to verify a downloaded software update hasn't been tampered with in transit. What's the BEST tool?" Encryption alone doesn't verify integrity — it protects confidentiality. Hashing (comparing the published hash to a locally computed one) is the correct answer, because it specifically detects any alteration, however small.
Interview-style Q&A
Q: Why use asymmetric encryption to exchange a symmetric key instead of just using asymmetric encryption for everything? A: "Asymmetric encryption is computationally expensive relative to symmetric. TLS uses asymmetric encryption briefly during the handshake to securely agree on a symmetric session key, then switches to fast symmetric encryption for the actual bulk data transfer — best of both."
Memory trick
"Hash it, Salt it, Stretch it, Sign it" — the four things that happen to a password/message on its way to being securely stored or verified, in that order.