Cryptography Concepts

ECB encrypts each block independently with no randomization, so identical plaintext blocks give identical ciphertext blocks — it leaks structure, repetition and equality, and blocks can be reordered or spliced. Any usable mode must be randomized: same plaintext, different ciphertext each time.

Signing runs the message and a private key through a signing algorithm to produce a value anyone can check with the matching public key. It gives integrity and origin authenticity. A shared-key MAC gives both too, but not non-repudiation: either key holder could have produced the tag.

Hashing is unkeyed and deterministic, so a hashed identifier is a stable pseudonym, not anonymous data: it still singles out people and joins across datasets, and small identifier spaces enumerate. Encryption is keyed and reversible; encoding is neither and protects nothing.

Passwords are low-entropy, so nobody inverts the hash — they guess candidates and hash them. A general-purpose hash is designed to be fast, so an attacker tests billions of guesses per second. A password function must be deliberately slow and hardware-hostile, with a per-user salt and a tunable cost.

One secret shared by both sides; security rests on the key alone, never on hiding the algorithm. AES by itself is a keyed permutation on one fixed block, so a usable scheme adds length handling and per-message randomisation. It gives confidentiality only, not integrity or authenticity.

Against an attacker who controls the network path, TLS gives confidentiality, integrity, ordering within the connection, and authenticity of the peer - the last one carries the rest. It protects the channel, not the endpoints, the metadata, or stored data.

RSA encrypts one integer smaller than the modulus, minus padding overhead - a couple of hundred bytes - and there is no chaining mode to extend it. So generate a random symmetric key, encrypt the bulk with it, and use the public key only to wrap that key.

A mode gives confidentiality only — it hides content, not length and not authenticity. Unauthenticated ciphertext is malleable: an attacker can flip plaintext bits blindly. Authenticated encryption adds a tag, so any modified ciphertext is rejected instead of decrypted.

The digest maps arbitrary input into the primitive's fixed domain, and unforgeability then rests on collision resistance: a collision means one signature is valid for two messages. Separately, a signature covers exact bytes, so any normalisation gap lets the verifier authenticate one thing and the application consume another.

Three properties: preimage resistance (given a digest, find any input producing it), second-preimage resistance (given one input, find a different one with the same digest), and collision resistance (find any two inputs that collide). Each use depends on a different one; "one-way" names only the first.

Salt is unique and public: it kills precomputed tables and stops one guess testing every account. Work factor makes each guess expensive — the only thing that still helps once the attacker holds everything. Pepper is a secret key stored outside the database; it defeats database-only theft, and it is rotatable only if applied as a reversible keyed layer.

Ordinary generators are designed for good distribution; cryptographic ones are designed for unpredictability. The question is never whether output looks random, but whether an attacker who has seen past output can predict the next one or recover the internal state. Statistical tests cannot answer that.

Size by entropy bits, not by string length: aim for 128 bits of generator output. Encoding only changes how many characters carry those bits — hex gives 4 per character, base64 gives 6. Mapping bytes with a plain remainder skews the alphabet; use rejection sampling.

Verify the chain to a trusted root with its constraints, the validity dates, revocation status, proof that the peer holds the private key, and - decisively - that the hostname you intended matches the certificate's subject alternative names. Chaining alone proves only that some CA issued it, to someone.

Ephemeral key agreement produces a shared secret neither side transmitted; a signature with the certificate's private key binds that agreement to a named identity; symmetric keys derived from it protect records. Discarding the ephemeral values afterwards gives forward secrecy.

CBC needs an IV that is unique and unpredictable. Counter-style modes need only uniqueness, but absolutely: reuse XORs two plaintexts together, and in a Galois-tag mode it also leaks the authentication subkey, letting the attacker forge any message under that key.

It proves only that these exact bytes were signed by whoever holds the private key matching the public key you chose. Not who that is, not when, not for whom, not that the key is still valid. The classic bypasses: taking the algorithm or the key identity from the message itself.

Their collision resistance is destroyed; their preimage resistance is essentially intact. So uses where the adversary chooses both inputs — signing, deduplication, approval lists — fail now, while uses that require matching a fixed unknown value do not. Brokenness is a statement about a property, never about an algorithm in the abstract.

Pairwise secrets scale as n(n-1)/2 and need an already-secure channel to bootstrap. Systems escape via pre-shared keys, authenticated key agreement, or a central key authority, then use a hierarchy: a protected root key wraps per-object data keys.

It converts secrecy of distribution into authenticity of distribution: you must prove a public key belongs to the intended party, and encrypting to the wrong one fails silently. Key lifetime is driven by blast radius - a static wrapping key leaked later exposes everything ever wrapped under it.

Compare work factor, not key length. Best-known attacks differ per family: exhaustive search for symmetric keys, sub-exponential sieving for RSA, square-root generic attacks for curves. Roughly, 128-bit security means AES-128, RSA-3072 or a 256-bit curve.

Randomness is a means, not the requirement. Keys and tokens need unpredictability. Nonces need uniqueness — a counter is often better. Salts need uniqueness, not secrecy. Some IVs need unpredictability too. Naming the required property tells you which generator, and how many bits.

Because the attacker holds the encryption key. Unpadded encryption is deterministic, so any low-entropy plaintext can be guessed and encrypted offline until the ciphertext matches. Randomized padding restores semantic security: the same message encrypts to unlinkable ciphertexts.

Any behaviour that differs based on decrypted bytes turns the service into a decryption oracle; a padding check leaks enough to recover plaintext byte by byte without the key. Fix: authenticate the ciphertext and reject before decrypting — encrypt-then-MAC, or an authenticated mode.

An early-exit comparison takes longer the more leading bytes match, so its runtime leaks how close a guess was. That turns an infeasible offline forgery search into a byte-at-a-time online search. It stops mattering only when both compared values are already public to the attacker.

SHA-256 is a Merkle–Damgård chain whose output is its full internal state, so an attacker who knows the digest and the secret's length can append data and compute a valid digest without the secret. More fundamentally, a bare hash gives integrity only against a digest obtained over a channel the attacker cannot rewrite.

They differ in what resource they force the attacker to spend. PBKDF2 costs only iterations of a fast hash, so specialised hardware wins; bcrypt costs a modest fixed memory footprint; scrypt and Argon2 let you demand large tunable memory, which is what neutralises massively parallel hardware. Parameters come from a measured latency budget at peak concurrency.

Compare derived values in constant time; do the same amount of work for an unknown user as for a known one, using a dummy record, and return an identical response; normalise and length-bound the submitted string consistently; rate-limit because each verification is expensive; and never log or echo the credential.

A secure generator expands a seed; it does not create unpredictability. If the seed is guessable or duplicated, so is every output. Duplication happens at first boot before the entropy pool fills, on process fork, on VM snapshot restore, and in cloned machine images.