Cryptography Fundamentals
Cryptography protects information through mathematical transformations that make data unreadable without the correct key. It covers symmetric and asymmetric encryption, hashing, digital signatures, key exchange, and the protocols that combine these primitives into secure communication systems.
itIdentity, access, and cryptography | OpenSkills.info
Intro
Cryptography Fundamentals
Cryptography protects information by transforming it with algorithms and keys. It can keep data confidential, reveal unauthorized changes, authenticate a source, and support digital signatures.
Cryptography does not decide who should have access. It enforces selected security properties after a system defines identities, permissions, data flows, and trust boundaries.
The central mental model
Think in four layers:
- Security property: Decide whether you need confidentiality, integrity, authentication, or a combination.
- Cryptographic construction: Choose a reviewed construction that provides those properties.
- Key and parameter management: Generate, distribute, store, rotate, revoke, and destroy sensitive material correctly.
- Protocol and implementation: Combine the pieces without breaking their assumptions.
A strong algorithm cannot rescue a reused nonce, an exposed key, or a protocol that authenticates the wrong party.
Core purposes
Continue the course
This section is part of the paid course.
See pricing to subscribe, or log in if you already have access.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://csrc.nist.gov/Projects/cryptographic-standards-and-guidelines
Supports
- NIST cryptographic work includes block ciphers, digital signatures, hash functions, message authentication codes, key management, and random bit generation
- Cryptographic publications undergo continuing review as standards and guidance evolve
- https://csrc.nist.gov/pubs/fips/197/final
Supports
- AES is a standardized symmetric block cipher used as a foundation for confidentiality services
- AES has a 128-bit block size and supports 128-bit, 192-bit, and 256-bit keys
- https://csrc.nist.gov/pubs/fips/180-4/upd1/final
Supports
- Standardized hash algorithms generate fixed-length message digests
- Message digests can be used to detect whether messages changed after digest generation
- Hash functions serve as components in other cryptographic processes
- https://csrc.nist.gov/pubs/fips/186-5/final
Supports
- Digital signatures detect unauthorized modifications and authenticate a claimed signatory
- Digital signature generation uses private keying material and verification uses the corresponding public key
- https://csrc.nist.gov/pubs/sp/800/38/d/final
Supports
- GCM is an authenticated-encryption mode for an approved symmetric block cipher
- GCM protects plaintext confidentiality and authenticates protected data and additional unencrypted data
- GCM security depends on following its initialization-vector uniqueness requirements
- https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final
Supports
- Cryptography can provide confidentiality, data integrity, source authentication, and support for signatures
- Symmetric keying material is shared while asymmetric key pairs contain public and private components
- Hash functions, message authentication codes, digital signatures, encryption, and key establishment provide different services
- Public keys require assurance about their owner and purpose before use
- Key management spans generation, distribution, storage, use, replacement, revocation, recovery, destruction, inventory, and compromise handling
- Key metadata, access controls, audit, ownership, purpose, and replacement responsibilities require protection and management
- https://csrc.nist.gov/pubs/sp/800/90/c/final
Supports
- Cryptographic systems rely on high-quality random bits
- Complete random-bit generator constructions combine deterministic random-bit generator mechanisms with entropy sources
- https://pages.nist.gov/800-63-4/sp800-63b.html
Supports
- Password hashing schemes take a password, a salt, and a cost factor as inputs
- A salt is stored with each resulting password hash and is distinct from an additional verifier-held secret key
- Per-password salts are chosen to minimize collisions among stored hashes
- https://www.rfc-editor.org/info/rfc8446/
Supports
- TLS 1.3 is designed to prevent eavesdropping, tampering, and message forgery between client and server applications
- The TLS handshake authenticates parties, negotiates parameters, and establishes shared keying material
- The TLS record protocol protects traffic using parameters established by the handshake
- TLS 1.3 uses authenticated-encryption algorithms for record protection
- TLS does not inherently hide transmitted data lengths