Skip to content
Lesson 5 of 8

Cryptography Basics

9 min read

Why Cryptography Underpins Modern Security

Cryptography is the science of protecting information by transforming it so that only authorized parties can understand it. It is the invisible engine that makes the confidentiality and integrity of the CIA triad possible: every time you buy something online, send a message through an encrypted messaging app, or log in to a secure site, cryptography is working underneath, even though you never see it.

A fundamental principle is Kerckhoffs's principle: the security of a system should not depend on keeping the algorithm secret, but only on the key. In other words, a good cryptographic system stays secure even if the attacker knows exactly how it works, as long as they do not have the key. That is why strong algorithms are public and have withstood years of analysis by the global community. Always be wary of solutions that promise security through "secret proprietary algorithms": if no one could review them, no one can guarantee they have no flaws, and history is full of those secret algorithms that broke the moment they came to light.

In this lesson we will not become cryptographers —you will not design algorithms or do advanced math— but we will understand the essential building blocks and how they combine to protect data at rest (stored on a disk) and in transit (traveling across the network). That understanding lets you make good decisions and interpret the security signals you see every day.

Symmetric Encryption

In symmetric encryption, the same key is used to encrypt and to decrypt. Think of it as a safe with a single combination: whoever knows it can both store and retrieve the contents. It is fast and efficient, ideal for protecting large volumes of data. The dominant standard today is AES (Advanced Encryption Standard), typically with 128- or 256-bit keys (AES-256), considered secure and used in everything: from disk encryption (BitLocker, FileVault) to secure connections and backups.

The challenge of symmetric encryption is key distribution. Both parties must share the same secret, but how do they exchange it securely over a potentially monitored channel? If an attacker intercepts the key while it travels, all protection collapses: they can now read everything. It is the classic chicken-and-egg problem — to communicate securely you need a shared key, but to share that key securely you would already need a secure channel. This dilemma motivated the development of asymmetric cryptography.

When used correctly —with adequate key length and secure modes of operation— symmetric encryption is extraordinarily robust: not even the most powerful hardware can break AES-256 by brute force in any useful time. The weak link is almost never the algorithm, but key management: where keys are stored, who has access, how they are rotated. A key written in a text file on the desktop defeats the best algorithm in the world.

Asymmetric Encryption

Asymmetric encryption, or public-key cryptography, solves the distribution problem using a pair of mathematically related keys: a public one, which can be shared openly with anyone, and a private one, which is kept absolutely secret. What is encrypted with the public key can only be decrypted with the private key, and vice versa. The brilliance is that you can publish your public key anywhere without compromising anything.

A useful analogy: the public key is like a mail slot in your door. Anyone can drop a letter through the slot (encrypt with your public key), but only you, with the box's key (your private key), can open it and read the letters. This enables two powerful uses:

  • Confidentiality: anyone can encrypt a message with your public key knowing that only you, with your private key, will be able to read it.
  • Authenticity and integrity (digital signature): you can sign a document with your private key, and anyone can verify the signature with your public key. If the verification is valid, it proves the message came from you and was not altered.

Algorithms such as RSA and those based on elliptic curves (ECC) implement these mechanisms. In practice, asymmetric encryption is slower than symmetric, so it is rarely used to encrypt large volumes. Instead, it is used to securely exchange a symmetric key, combining the best of both worlds: the distribution security of asymmetric and the speed of symmetric. This hybrid scheme is exactly what the TLS protocol, which we will see at the end, uses.

You can watch a real key pair being generated with a legitimate, everyday tool such as SSH's (used to administer servers securely):

# Generates a key pair: a private one (secret) and a public one (shareable)
ssh-keygen -t ed25519 -C "your-email@example.com"
# Creates:  ~/.ssh/id_ed25519       (private: NEVER share)
#           ~/.ssh/id_ed25519.pub   (public: can be handed out safely)

Hashing: Integrity and Digital Fingerprints

A cryptographic hash function takes an input of any size —a word, a 10 GB file— and produces a fixed-length output, called a hash or digest. It has three key properties: it is deterministic (the same input always produces the same hash), it is practically irreversible (you cannot reconstruct the input from the hash), and it has the avalanche effect (a minimal change in the input radically alters the output).

It is important not to confuse hashing with encryption: you cannot "unhash", because it is not a reversible transformation. Hashing is not for hiding data and recovering it later, but for verifying integrity: checking that something did not change. See the avalanche effect with an example — changing a single letter completely transforms the result:

echo -n "hello world" | sha256sum
# b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9

echo -n "Hello world" | sha256sum   # only one capital letter changed
# d2a84f4b8b650937ec8f73cd8be2c74add5a911ba64df27458ed8229da804a26

An everyday use is verifying downloads: many sites publish the hash of the original file so you can check that what you downloaded was not altered or corrupted along the way. If the hash matches, the content is identical. Algorithms such as SHA-256 are the current standard; the older MD5 or SHA-1 are considered broken for security uses and should not be employed, because it was shown to be possible to craft collisions (two different inputs with the same hash).

A critical use of hashing is password storage. Systems must never store passwords in plain text, but their hash, computed with slow functions designed to resist attacks, such as bcrypt, scrypt, or Argon2, together with a unique random value called a salt that prevents attacks using precomputed tables. That is why, when a well-designed service suffers a breach, attackers get strong hashes and not your passwords directly — which gives you time to react. When a poorly designed one stored passwords in plain text, the breach is immediate and total.

HTTPS, TLS, and Certificates

When you see the padlock in your browser, you are using HTTPS, which is HTTP over TLS (Transport Layer Security). TLS is the perfect example of how all the previous blocks combine into a single protocol: it uses asymmetric cryptography to authenticate the server and securely exchange a key, then encrypts all traffic with that symmetric key for efficiency, and uses hashes to verify that the data was not tampered with in transit. Symmetric, asymmetric, and hashing working together.

How do you know the server is really who it claims to be, and not an impostor? Through digital certificates issued by trusted Certificate Authorities (CAs). The certificate binds a site's identity to its public key and is signed by a CA your browser (and your operating system) trust out of the box. It is a chain of trust: you trust the CA, the CA signed the site's certificate, therefore you trust the site's public key. If the certificate is invalid, expired, or does not match the domain, the browser warns you — and that warning must be taken seriously.

You can inspect any site's certificate with a legitimate tool:

# See the issuer, domain, and validity dates of a site's certificate
openssl s_client -connect example.com:443 -servername example.com < /dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates

Understanding this chain of trust helps you interpret security warnings instead of ignoring them, and appreciate why you should never enter credentials on a site without HTTPS. An important nuance, which we will return to in the browsing lesson: the padlock proves that the connection is private, not that the site is honest. A phishing site can also have a valid certificate.

In Practice: Cryptography in Your Daily Life

  • Verify the hashes of important installers you download, when the vendor publishes them.
  • Always look for HTTPS before entering credentials or payment data; if the browser marks "not secure," stop.
  • Do not ignore certificate warnings, especially on public networks: they can signal an interception.
  • Enable disk encryption (symmetric, AES) on laptops and phones to protect data at rest.
  • Use messaging apps with end-to-end encryption for sensitive conversations.
  • Guard your private keys the way you guard your house keys: if a private key leaks, all the protection that depended on it is lost.

Common Mistakes

  • Confusing hashing with encryption: a hash is not reversible; it verifies integrity, it does not hide and recover data.
  • Using MD5 or SHA-1 for security: they are broken; use SHA-256 or higher.
  • Believing the padlock certifies honesty: HTTPS secures the connection, not the legitimacy of the site.
  • Neglecting key management: the strongest algorithm is useless if the key is poorly stored or accessible to anyone.
  • Trusting "secret proprietary algorithms": serious security relies on public, audited algorithms (Kerckhoffs's principle).

Key Takeaways

  • Cryptography underpins confidentiality and integrity; strong algorithms are public and their security depends on the key, not on the secrecy of the algorithm.
  • Symmetric encryption (AES) is fast but faces the key-distribution problem; asymmetric (RSA, ECC) solves it with a public/private key pair.
  • Hashing (SHA-256) verifies integrity and protects passwords (with bcrypt/Argon2 and a salt); it is irreversible, it is not encryption.
  • TLS/HTTPS combines all three blocks: asymmetric to authenticate and exchange a key, symmetric to encrypt the traffic, hashing for integrity.
  • Certificates and CAs create a chain of trust; the padlock proves a private connection, not an honest site.

In the next lesson we will bring protection down to the device: endpoint security.