Introduction to Cryptography

Cryptography is the science of protecting information. It's the backbone of secure communication, authentication, and data integrity. You encounter it constantly in security work — from HTTPS to password storage to exploit development.

Why Cryptography Matters in Security

• HTTPS — TLS protects web traffic from interception
• Passwords — stored as hashes, not plaintext
• Digital signatures — verify software hasn't been tampered with
• VPNs — encrypt network tunnels
• Ransomware — attackers use encryption as a weapon

Hashing

A hash function takes input of any size and produces a fixed-size output (the hash/digest). Good hash functions are:

• Deterministic — same input always gives same output
• One-way — you can't reverse a hash to get the input
• Avalanche effect — tiny input change → completely different hash
• Collision resistant — hard to find two inputs with same hash

SHA-256("hello")   = 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
SHA-256("Hello")   = 185f8db32921bd46d35de87787e3f207f73e4b5f4b16e73ab8cee36d4a30cb
SHA-256("hello!")  = ce06092fb948d9af91f70574af9bc34e2b2c04e3b85fea4bb41d11f0f11cedc

Security uses:
- Storing passwords (store hash, compare hash on login)
- File integrity verification (download file, check hash matches)
- Checksums in forensics (prove a file hasn't been modified)

Common Hash Algorithms

Password Hashing vs Encryption

• Hashing is one-way. Passwords should be hashed, not encrypted.
• Cracking hashed passwords means trying inputs until you find a match (brute force, dictionary, rainbow tables).
• Salting adds random data before hashing to defeat rainbow tables.

Without salt:
  hash("password123") → 482c811da5d5b4bc6d497ffa98491e38

With salt:
  hash("xK9m" + "password123") → a9f3c2...  (unique per user)
  hash("pL4n" + "password123") → 77e1b9...  (different salt = different hash)

Symmetric Encryption

One key is used to both encrypt and decrypt.

Plaintext ──[Encrypt with Key]──► Ciphertext
Ciphertext ──[Decrypt with Key]──► Plaintext

Fast — used for bulk data encryption.

Problem: How do you securely share the key with the other party?

AES (Advanced Encryption Standard)

The gold standard for symmetric encryption.
- Block cipher: encrypts data in 128-bit blocks
- Key sizes: 128, 192, or 256 bits
- Used in: TLS, disk encryption, file encryption, VPNs

Asymmetric Encryption (Public Key Cryptography)

Two keys: a public key (share with everyone) and a private key (keep secret).

┌──────────────────────────────────────────────┐
│  Encrypted with PUBLIC key?                  │
│  → Only the PRIVATE key can decrypt it       │
│    (used for: secure messages TO someone)    │
├──────────────────────────────────────────────┤
│  Signed with PRIVATE key?                    │
│  → Anyone with the PUBLIC key can verify it  │
│    (used for: digital signatures)            │
└──────────────────────────────────────────────┘

Solves the key exchange problem: You can freely share your public key. Anyone can encrypt a message that only your private key can open.

RSA

The most common asymmetric algorithm.
- Key sizes: 2048 or 4096 bits (much larger than AES — asymmetric is slow)
- Used for: key exchange in TLS, digital signatures, SSH keys

How HTTPS Works (TLS Handshake)

HTTPS combines asymmetric encryption (for key exchange) and symmetric encryption (for bulk data):

Browser                         Server
   │                               │
   │──── ClientHello ─────────────►│  "I support TLS 1.3, here are my cipher suites"
   │                               │
   │◄─── ServerHello + Certificate─│  "Use AES-256, here's my public key cert"
   │                               │
   │  [Browser verifies cert       │
   │   against trusted CAs]        │
   │                               │
   │──── Key Exchange ────────────►│  Establish shared session key (asymmetric)
   │                               │
   │◄═══ Encrypted Data ══════════►│  All further data encrypted with session key (AES)

Digital Signatures

Signatures prove who sent a message and that it wasn't tampered with.

Alice signs with her PRIVATE key:
  document + hash(document) encrypted with private key

Bob verifies with Alice's PUBLIC key:
  decrypts the signature → gets the hash → recalculates hash of document
  if they match → document is authentic and untampered

Uses: Code signing (proving software is from a legitimate publisher), SSL certificates, Git commits, email (S/MIME, PGP).

PKI — Public Key Infrastructure

How do you trust a public key? Certificate Authorities (CAs) are trusted third parties that sign certificates, vouching that a public key belongs to who they claim.

Root CA (Mozilla/OS trusts these)
  └── Intermediate CA
        └── website certificate (signed by intermediate CA)

When you visit a website, your browser checks the certificate chain up to a trusted root CA. If anything is wrong (expired, wrong domain, untrusted CA), you get a security warning.

Attacks on PKI:
- Rogue CA compromise (real attack: DigiNotar 2011)
- Certificate mis-issuance
- SSL stripping (downgrade HTTPS → HTTP)

Key Takeaways

• Hashing is one-way — used for passwords and integrity checks
• Symmetric encryption (AES) is fast — one key for both operations
• Asymmetric encryption (RSA) solves key exchange — public key encrypts, private key decrypts
• TLS combines both: asymmetric for handshake, symmetric for data
• PKI establishes trust through certificate chains
• MD5 and SHA-1 are broken — use SHA-256 or better