Cryptography

Cryptography is the practical craft of protecting information when you do not control the channel it travels over or the disk it rests on. Almost every system you touch depends on it: HTTPS in your browser, the disk encryption on your laptop, the signatures that let a package manager trust an update. This foundation teaches you to reason about those tools and use them correctly, which is a very different skill from designing them.

The map: primitives versus protocols

It helps to keep two layers separate in your head. Primitives are the small, well-studied building blocks. Protocols are the larger conversations that wire primitives together to accomplish a real task like “establish a secure channel to this server.”

Layer	Examples	What it gives you	Where it lives in this foundation
Symmetric primitives	AES-GCM, ChaCha20-Poly1305, SHA-256, HMAC	Fast bulk encryption and integrity when both sides share a key	Symmetric sections
Asymmetric primitives	RSA, ECDSA, Ed25519, X25519	Key agreement and signatures without a shared secret	Public-key sections
Protocols	TLS, SSH, Signal, age	Complete, safe workflows built from the above	Applied sections

The distinction matters because most real-world failures happen at the seams: a strong cipher used with a reused nonce, or a valid signature over the wrong bytes. Learning the primitives lets you see why a protocol is shaped the way it is.

Rule zero: do not roll your own

The single most important habit in applied cryptography is to not invent your own scheme. Well-reviewed primitives have survived years of expert attack; a clever construction you wrote last week has survived none. This foundation never asks you to build a cipher. It asks you to choose the right well-reviewed primitive and use it with correct parameters, which is where practitioners actually add value or cause disasters.

This applies even to combining primitives. “Encrypt then MAC,” padding schemes, and key derivation all have subtle correct forms and many broken ones. When a modern tool bundles them for you (AES-GCM, age, libsodium), prefer the bundle over assembling the parts yourself.

How the sections build

The path is deliberately layered so each idea rests on the previous one.

1. Getting Started installs OpenSSL 3.x and a small supporting toolkit, then walks you through encrypting, hashing, and signing your first file so the rest of the material has something concrete to point at.
2. Foundations covers the concepts everything else assumes: the security goals crypto can promise, what a key really is and how key size maps to strength, where secure randomness comes from, and how attacks are classified. See the pages on Security Goals, Keys & Key Sizes, Randomness & Entropy, and Attack Models.
3. Later sections build up through symmetric encryption, hashing and message authentication, public-key cryptography, and finally the protocols that combine them.

By the end you should be able to read a system’s crypto choices and judge whether they are sound, which is the skill most engineering work actually requires.

Practical Guidance

1. Treat “do not roll your own crypto” as a hard rule, not a suggestion, for every design decision you make.
2. When you meet a new tool, first ask which primitive it uses and in which mode, then ask what key and nonce discipline it expects.
3. Keep the primitive-versus-protocol distinction in mind: debug failures at the layer where they occur, not one layer up.
4. Read the Foundations pages before the applied sections; the applied material assumes you know what a security goal and a key size mean.
5. Prefer high-level tools (age, TLS libraries, libsodium) over hand-assembled primitives whenever one exists for your task.