Module 1 of 5
Foundations
The habits every later module depends on: name the security property first, trust only real randomness, know what a hash does and does not promise, and leave primitive design to specialists.
Most cryptographic failures are not clever breaks of strong ciphers. They are systems that encrypted when they needed to authenticate, drew keys from a generator built for simulations, used a hash where a keyed MAC belonged, or invented a scheme that a first-year student could unpick. This module is about avoiding those mistakes before any specific algorithm enters the picture.
The four lessons start from the security properties and the threat assumptions behind them, then cover the two primitives everything else rests on, randomness and hash functions, and end with why the right move is almost always a well-reviewed library and what that library still leaves to you. By the end you should be able to look at a design and say which property it needs, what the attacker is assumed to see and control, and which part of it is homemade.
Lessons
- 1.aStart from the propertyWhich security property does this system actually need, and against which attacker?18 min
- 1.bRandomness and entropyWhere should secret values come from, and how many random bits does a token need?22 min
- 1.cHash functionsWhat exactly does a cryptographic hash guarantee, and where do people rely on guarantees it does not make?17 min
- 1.dWhy not to roll your ownWhy do homemade schemes fail, and what is still your job once you use a vetted library?19 min