Stop 12 · Cryptography & Advanced TopicsTopics · 1/8

Cryptography Fundamentals Deep Dive

In short

You already know encryption scrambles data. Now learn which tool fits which job, because picking the wrong one, or using the right one badly, quietly breaks everything.

Going beyond Phase 4's introduction — understanding common algorithms (AES, RSA), key lengths, and why cryptographic implementation details matter as much as the underlying math.

The blob holds an open padlock and a key in front of a steel trunk.

Think of it like this

The trunk key and the open padlock

Your hostel trunk has one key; anyone with a copy can open it. That is symmetric: one shared secret. Now imagine handing out open padlocks. Anyone can snap one shut on a box for you, but only your key opens it. That is asymmetric.

Watch it happen

The crypto toolbox

Cryptography

Symmetric

AES-GCM

Asymmetric

RSA, ECC

Hashing

SHA-256

Password hash

Argon2id

1/4Symmetric: one key locks and unlocks. Fast, so it encrypts the bulk data. AES-GCM also detects tampering.

The big ideas

What you need to know

Hybrid in real life

Real systems mix them: asymmetric crypto agrees on a key, then fast symmetric crypto encrypts the actual data. TLS works this way.

Key size matters

AES-128 or AES-256 are fine today. RSA needs at least 2048 bits. Short or old keys fall to modern hardware.

Authenticated encryption

Modes like AES-GCM give secrecy and tamper detection together. Plain encryption without integrity can be silently altered.

Never roll your own

Use well tested libraries. Home made ciphers and clever tweaks are how most crypto failures happen.

See it in code

Walk through the code

python

1import os2from cryptography.hazmat.primitives.ciphers.aead import AESGCM3 4key = AESGCM.generate_key(bit_length=256)5aes = AESGCM(key)6nonce = os.urandom(12)  # unique per message, never reuse7 8ct = aes.encrypt(nonce, b"roll 42: 88 marks", None)9print(aes.decrypt(nonce, ct, None))

1/3Use a tested library and let it make a random 256 bit key for you.

Authenticated encryption with the well known cryptography library. If even one byte of ct is changed, decrypt raises an error instead of returning garbage.

Save yourself the pain

Common mistakes

Oops

Storing passwords with fast hashes like plain SHA-256 or MD5.

Do this instead

Use a slow, salted password hash such as Argon2id or bcrypt, designed to make guessing expensive.

Oops

Hard coding the encryption key next to the encrypted data.

Do this instead

Keep keys in a secrets manager or KMS. Encryption is only as strong as how you guard the key.

Your mission

Encrypt and tamper in your lab

~25 min

Quick check

Why do real systems like TLS use both asymmetric and symmetric encryption?

Go deeper

1Learn the general strength differences between common key lengths (e.g. AES-128 vs AES-256).
2Understand why 'rolling your own crypto' is a well-known anti-pattern to avoid.
3Research a real-world cryptographic implementation flaw (not algorithm weakness) that caused a breach.