Cryptography Fundamentals
Cryptography protects information through mathematical transformations that make data unreadable without the correct key. It covers symmetric and asymmetric encryption, hashing, digital signatures, key exchange, and the protocols that combine these primitives into secure communication systems.
itIdentity, access, and cryptography | OpenSkills.info
Course pathWalk it in order
Look it upDip in anytime
Go furtherLeaves this page
Don't Panic
Don't Panic - Cryptography Fundamentals
Cryptography protects information by transforming it with algorithms and keys. It can keep data confidential, reveal unauthorized changes, authenticate a source, and support digital signatures. It does not decide who should have access. It enforces selected security properties after a system defines identities, permissions, data flows, and trust boundaries.
Think in four layers. Decide the security property. Choose a reviewed construction that provides it. Manage keys and parameters correctly. Combine the pieces in a protocol and implementation without breaking assumptions. A strong algorithm cannot rescue a reused nonce, an exposed key, or authentication of the wrong party.
Symmetric cryptography shares secret keying material and suits high-volume protection. Asymmetric cryptography uses public and private keys for signatures and key establishment. Real protocols such as TLS often use asymmetric handshakes to establish keys, then protect traffic with symmetric authenticated encryption. Hashes detect change but do not by themselves prove who created a message. MACs authenticate among shared-key holders. Signatures authenticate a signer when the public key is trusted through a separate process.
Use cryptographically secure randomness for keys and other sensitive values. Follow each construction's nonce rules. Prefer maintained libraries and current standards. Keep key ownership, purpose, state, and replacement dates recorded. Cryptography protects data, not an entire system: authorized endpoints still see plaintext after decryption.
Read the Intro for properties, key models, and limits. Use the Cheatsheet when you need the mechanism selector and key-lifecycle checklist. Updates tracks NIST SP 800-57, where the key-management guidance this course uses is maintained.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://csrc.nist.gov/Projects/cryptographic-standards-and-guidelines
Supports
- NIST cryptographic work includes block ciphers, digital signatures, hash functions, message authentication codes, key management, and random bit generation
- Cryptographic publications undergo continuing review as standards and guidance evolve
- https://csrc.nist.gov/pubs/fips/197/final
Supports
- AES is a standardized symmetric block cipher used as a foundation for confidentiality services
- AES has a 128-bit block size and supports 128-bit, 192-bit, and 256-bit keys
- https://csrc.nist.gov/pubs/fips/180-4/upd1/final
Supports
- Standardized hash algorithms generate fixed-length message digests
- Message digests can be used to detect whether messages changed after digest generation
- Hash functions serve as components in other cryptographic processes
- https://csrc.nist.gov/pubs/fips/186-5/final
Supports
- Digital signatures detect unauthorized modifications and authenticate a claimed signatory
- Digital signature generation uses private keying material and verification uses the corresponding public key
- https://csrc.nist.gov/pubs/sp/800/38/d/final
Supports
- GCM is an authenticated-encryption mode for an approved symmetric block cipher
- GCM protects plaintext confidentiality and authenticates protected data and additional unencrypted data
- GCM security depends on following its initialization-vector uniqueness requirements
- https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final
Supports
- Cryptography can provide confidentiality, data integrity, source authentication, and support for signatures
- Symmetric keying material is shared while asymmetric key pairs contain public and private components
- Hash functions, message authentication codes, digital signatures, encryption, and key establishment provide different services
- Public keys require assurance about their owner and purpose before use
- Key management spans generation, distribution, storage, use, replacement, revocation, recovery, destruction, inventory, and compromise handling
- Key metadata, access controls, audit, ownership, purpose, and replacement responsibilities require protection and management
- https://csrc.nist.gov/pubs/sp/800/90/c/final
Supports
- Cryptographic systems rely on high-quality random bits
- Complete random-bit generator constructions combine deterministic random-bit generator mechanisms with entropy sources
- https://pages.nist.gov/800-63-4/sp800-63b.html
Supports
- Password hashing schemes take a password, a salt, and a cost factor as inputs
- A salt is stored with each resulting password hash and is distinct from an additional verifier-held secret key
- Per-password salts are chosen to minimize collisions among stored hashes
- https://www.rfc-editor.org/info/rfc8446/
Supports
- TLS 1.3 is designed to prevent eavesdropping, tampering, and message forgery between client and server applications
- The TLS handshake authenticates parties, negotiates parameters, and establishes shared keying material
- The TLS record protocol protects traffic using parameters established by the handshake
- TLS 1.3 uses authenticated-encryption algorithms for record protection
- TLS does not inherently hide transmitted data lengths