Subject 04 / Course
Cryptography
Keys, signatures, and encryption, connected to the assumptions that make them useful.
0 of 20 read
Cryptography rarely fails because a cipher is broken. It fails because a nonce was reused, a signature was checked against the wrong key, a key lived on a laptop for six years, or the system needed integrity and got only confidentiality. Start from the property the system needs, then choose the primitive, then protect the keys, and most of the famous failures never happen.
The course builds that habit: security properties and their assumptions first, then symmetric and public-key primitives, then the key lifecycle (where most real risk lives), then the failure modes and the migration to post-quantum algorithms. It assumes you can read Python. It does not assume a math background beyond arithmetic.
The path#
flowchart LR P["<b>Property</b><br/><small>what must hold?</small>"] --> S["<b>Symmetric</b><br/><small>AEAD, MAC, KDF</small>"] S --> A["<b>Public key</b><br/><small>exchange, signatures, PKI</small>"] A --> K["<b>Keys</b><br/><small>lifecycle, HSMs, rotation</small>"] K --> AP["<b>Applied</b><br/><small>failures, PQC, agility</small>"] class P neutral class S,A compute class K good class AP warn classDef neutral fill:#faf9f5,stroke:#5f5e55,color:#141413,stroke-width:1.5px classDef compute fill:#ece4fb,stroke:#6431c0,color:#141413,stroke-width:1.5px classDef memory fill:#ece4fb,stroke:#6431c0,color:#141413,stroke-width:1.5px classDef queue fill:#ece4fb,stroke:#6431c0,color:#141413,stroke-width:1.5px classDef io fill:#ece4fb,stroke:#6431c0,color:#141413,stroke-width:1.5px classDef default fill:#ece4fb,stroke:#6431c0,color:#141413,stroke-width:1.5px classDef warn fill:#f9e2e9,stroke:#b3154f,color:#141413,stroke-width:2px,stroke-dasharray:5 3 classDef good fill:#e2efd8,stroke:#2b6a24,color:#141413,stroke-width:2px
How each lesson works#
- The idea in one minute. The claim, before the detail.
- A picture of the construction or the failure.
- How it really works, with the standards (NIST, IETF RFCs) named.
- Code: small Python programs using only the standard library (
hashlib,hmac,secrets). Where the standard library has no primitive, the lesson builds a toy version to show the mechanism and says so plainly. - Where it breaks. The assumption that, once violated, defeats it.
- Remember this, Try it, and Check yourself.
What you need#
- Python 3.10 or newer and a terminal. Every program runs offline.
The modules
Foundations
The habits every later module depends on: name the security property first, trust only real randomness, know what a hash does and does not promise, and leave primitive design to specialists.
Symmetric cryptography
The shared-key primitives that do most of the work in real systems: block ciphers and their modes, authenticated encryption, MACs, and key derivation.
Public-key cryptography
Key exchange, signatures, certificates, and the TLS handshake that combines them: how two parties who share nothing end up with keys they can trust.
Key management
Algorithms are rarely what fails; keys are. This module covers the key lifecycle, envelope encryption and KMS, HSMs and key ceremonies, and rotation and revocation.
Applied cryptography
Where cryptography meets real systems: the failure classes that cause breaches, side channels and constant-time code, the migration to post-quantum algorithms, and the agility and inventory that make the next migration survivable.