Cryptography fundamentals: 50 cards on ciphers, hashes and TLS

All 50 cards

1. 1
   Kerckhoffs’s principle
   A cryptosystem should stay secure even if everything about it except the key is public

   Security has to come from the secrecy of the key, not of the algorithm. Shannon put it as “the enemy knows the system”.
2. 2
   Symmetric vs asymmetric encryption
   Symmetric encryption uses one shared secret key to encrypt and decrypt; asymmetric encryption uses a key pair, a public key to encrypt and a private key to decrypt

   Symmetric ciphers are far faster, so real systems use public-key cryptography only to agree on a symmetric key, then encrypt the data with it (hybrid encryption).
3. 3
   One-time pad
   XOR the message with a truly random key as long as the message, used only once; done right, it is unbreakable even in principle (perfect secrecy)

   Reusing the pad breaks it: XORing two ciphertexts cancels the key and leaves the XOR of the two plaintexts.
4. 4
   Block cipher vs stream cipher
   A block cipher encrypts fixed-size blocks and needs a mode of operation for longer messages; a stream cipher XORs the message with a keystream generated from a key and a nonce

   AES is a block cipher; ChaCha20 is a stream cipher.
5. 5
   AES block size and key sizes
   128-bit blocks; 128-, 192- or 256-bit keys

   It runs 10, 12 or 14 rounds depending on the key size. NIST standardized AES (the Rijndael cipher) in 2001.
6. 6
   Why is ECB mode insecure?
   It encrypts each block independently, so identical plaintext blocks give identical ciphertext blocks and patterns in the data show through

   The classic demonstration is an image encrypted in ECB mode whose outline is still clearly visible.
7. 7
   CBC mode
   Each plaintext block is XORed with the previous ciphertext block before encryption; the first block uses a random, unpredictable IV

   CBC provides confidentiality only. Without a MAC it is open to padding oracle attacks.
8. 8
   Padding oracle attack
   If a system reveals whether the padding of decrypted CBC ciphertext is valid, through an error message or timing, an attacker can decrypt data byte by byte without the key

   Prevent it by verifying a MAC before decrypting, or by using an AEAD mode.
9. 9
   CTR mode
   Encrypts successive counter blocks (a nonce plus a block number) to make a keystream, then XORs it with the plaintext

   It needs no padding and runs in parallel, but a nonce must never repeat under the same key.
10. 10
    Does encryption alone stop tampering?
    No. Without authentication, ciphertext is malleable: flipping a bit of CTR or stream-cipher ciphertext flips the same bit of the plaintext

    That is why modern designs use authenticated encryption.
11. 11
    Authenticated encryption with associated data (AEAD)
    Encryption that guarantees both confidentiality and integrity, and can also authenticate unencrypted associated data such as headers

    Decryption fails if the ciphertext, tag or associated data were changed. TLS 1.3 allows only AEAD ciphers.
12. 12
    AES-GCM
    AES in counter mode plus a GHASH authentication tag: the most widely used AEAD mode

    Its standard nonce is 96 bits, and its tag is usually 128 bits.
13. 13
    What happens if an AES-GCM nonce repeats under the same key?
    The keystream repeats, revealing the XOR of the two plaintexts, and an attacker can recover the authentication key and forge messages

    With random 96-bit nonces, NIST limits one key to $2^{32}$ messages.
14. 14
    ChaCha20-Poly1305
    An AEAD that pairs the ChaCha20 stream cipher with the Poly1305 authenticator; fast and constant-time in software, even without AES hardware

    Used in TLS 1.3, SSH and WireGuard, and specified in RFC 8439.
15. 15
    Encrypt-then-MAC
    Encrypt first, then compute a MAC over the ciphertext and IV; the receiver checks the MAC before decrypting anything

    Of the ways to combine a cipher with a MAC, it is the one that is secure in general. AEAD modes handle this for you.
16. 16
    What hard problem is RSA based on?
    Factoring: recovering the primes $p$ and $q$ from their product $n = pq$

    Use keys of at least 2048 bits; 3072 bits gives about 128-bit security.
17. 17
    Textbook RSA encryption and decryption
    $c = m^e \bmod n$ and $m = c^d \bmod n$, where $ed \equiv 1 \pmod{\varphi(n)}$

    Raw RSA is deterministic and malleable, so real systems always add padding. The public exponent e is usually 65537.
18. 18
    RSA padding for encryption and for signatures
    OAEP for encryption, PSS for signatures

    The older PKCS #1 v1.5 encryption padding is open to Bleichenbacher’s padding oracle attack.
19. 19
    Elliptic-curve cryptography (ECC)
    Public-key cryptography based on the elliptic-curve discrete logarithm problem: given points $P$ and $kP$, finding $k$ is infeasible

    Keys are much smaller than RSA keys of the same strength: a 256-bit curve such as P-256 gives about 128-bit security, like 3072-bit RSA.
20. 20
    X25519 and Ed25519
    X25519 is Diffie–Hellman key agreement on Curve25519; Ed25519 is a signature scheme on an equivalent form of the same curve

    Both were designed to be fast and hard to implement wrongly. Ed25519 signatures are deterministic, so they need no random nonce.
21. 21
    Diffie–Hellman key exchange
    Each side picks a secret exponent and sends $g^a \bmod p$ or $g^b \bmod p$; both then compute $g^{ab} \bmod p$, which an eavesdropper can’t

    Its security rests on the discrete logarithm problem. ECDH is the same idea on an elliptic curve.
22. 22
    Why must a Diffie–Hellman exchange be authenticated?
    Otherwise a man-in-the-middle can run a separate exchange with each side and read everything; signatures and certificates prove who sent each public value
23. 23
    Why would a large quantum computer break RSA and elliptic curves?
    Shor’s algorithm factors integers and solves discrete logarithms efficiently

    NIST published post-quantum standards in 2024: ML-KEM for key exchange and ML-DSA for signatures. Symmetric ciphers are far less affected; AES-256 stays secure.
24. 24
    Cryptographic hash function
    Maps input of any length to a fixed-length digest; it is deterministic and fast, but infeasible to invert or to find two inputs with the same output

    SHA-256 produces a 256-bit (32-byte) digest.
25. 25
    Preimage, second-preimage and collision resistance
    Preimage: given a digest, you can’t find an input for it. Second preimage: given an input, you can’t find another with the same digest. Collision: you can’t find any two inputs with the same digest
26. 26
    Birthday bound for hash collisions
    Collisions in an $n$-bit hash turn up after about $2^{n/2}$ tries, so SHA-256 offers about 128-bit collision resistance
27. 27
    SHA-2 family
    SHA-224, SHA-256, SHA-384 and SHA-512, plus the truncated SHA-512/224 and SHA-512/256, built on the Merkle–Damgård construction

    SHA-256 remains a sound default; no practical attacks on the full SHA-2 functions are known.
28. 28
    SHA-3
    The hash standard based on Keccak, published in 2015 (FIPS 202); it uses a sponge construction and was chosen as an alternative to SHA-2, not because SHA-2 was broken

    It resists length-extension attacks, and its SHAKE128 and SHAKE256 variants produce output of any length.
29. 29
    Length-extension attack
    With SHA-256 or SHA-512, anyone who knows $H(\text{secret} \parallel m)$ can compute $H(\text{secret} \parallel m \parallel \text{pad} \parallel x)$ for any $x$ without knowing the secret

    They only need the secret’s length, which is easy to guess. Use HMAC instead of hashing a secret prefix.
30. 30
    Status of MD5 and SHA-1
    Broken: practical collisions exist for both, so never use them for signatures, certificates or anything that needs collision resistance

    The first public SHA-1 collision (SHAttered) was announced in 2017; MD5 collisions take seconds on a laptop.
31. 31
    Message authentication code (MAC)
    A tag computed from a message and a shared secret key; it proves the message came from a key holder and wasn’t altered

    Unlike a signature, it can’t prove to a third party who made it: anyone who can verify a MAC can also create one.
32. 32
    HMAC
    $\mathrm{HMAC}(K, m) = H\big((K' \oplus \text{opad}) \parallel H((K' \oplus \text{ipad}) \parallel m)\big)$

    The nested hashing makes it immune to length extension. Compare tags in constant time: an early-exit comparison leaks through timing how many bytes matched.
33. 33
    Digital signature
    Made with a private key and checked with the matching public key; it proves who signed and that the data hasn’t changed, and the signer can’t later deny it

    Common schemes: RSA-PSS, ECDSA and Ed25519.
34. 34
    What happens if an ECDSA nonce is reused or predictable?
    Anyone with the signatures can compute the private key

    This is how the PlayStation 3 signing key was recovered in 2010. Deterministic nonces (RFC 6979) or Ed25519 avoid the problem.
35. 35
    Why not store passwords as SHA-256 hashes?
    General-purpose hashes are built to be fast, so attackers with GPUs can test billions of guesses per second; passwords need a slow, salted password-hashing function
36. 36
    Which password-hashing algorithm should you choose?
    Argon2id; scrypt if Argon2id is unavailable; bcrypt for legacy systems; PBKDF2 when FIPS-140 compliance is required

    This is the order OWASP recommends.
37. 37
    Argon2
    The winner of the 2015 Password Hashing Competition: a memory-hard function whose cost is tuned by memory, iterations and parallelism

    Use the Argon2id variant. OWASP’s minimum is 19 MiB of memory, 2 iterations and a parallelism of 1.
38. 38
    bcrypt
    A password hash based on the Blowfish cipher, with a cost factor that doubles the work for each increment

    It only uses the first 72 bytes of a password. OWASP recommends a cost of at least 10.
39. 39
    scrypt
    A memory-hard key derivation function by Colin Percival (2009), tuned by N (CPU and memory cost), r (block size) and p (parallelism)

    Needing lots of memory makes GPU and ASIC cracking expensive. OWASP’s minimum is $N = 2^{17}$, $r = 8$, $p = 1$.
40. 40
    Salt
    A unique random value stored with each password hash, so identical passwords hash differently and precomputed tables such as rainbow tables are useless

    Salts aren’t secret. A pepper is an extra secret kept outside the database, for example in a key vault.
41. 41
    Nonce
    A “number used once”: a value that must never repeat under the same key, though it usually needn’t be secret

    Some schemes need more: a CBC IV must also be unpredictable.
42. 42
    Where should keys and other secret random values come from?
    The operating system’s cryptographically secure random number generator, never a general-purpose generator such as Math.random() or the Mersenne Twister

    For example getrandom() on Linux, crypto.getRandomValues() in browsers and the secrets module in Python.
43. 43
    HKDF
    An HMAC-based key derivation function: it extracts a uniform key from input key material such as a Diffie–Hellman output, then expands it into as many keys as needed

    TLS 1.3 derives all its keys with HKDF (RFC 5869).
44. 44
    TLS 1.3 full handshake, in outline
    The client sends ClientHello with its key shares; the server replies with ServerHello and its key share, then, already encrypted, its certificate, a CertificateVerify signature and Finished; the client answers with Finished. One round trip in all

    Both sides derive the session keys from an ephemeral (EC)DHE exchange.
45. 45
    TLS 1.3 0-RTT data
    When resuming a session, a client can send application data in its first message, but an attacker can replay it, so it should only carry requests that are safe to repeat
46. 46
    What did TLS 1.3 remove?
    Static RSA and static Diffie–Hellman key exchange, all non-AEAD ciphers (such as CBC modes and RC4), compression and renegotiation

    With static RSA gone, every full handshake uses ephemeral key exchange and so has forward secrecy.
47. 47
    Forward secrecy
    Stealing a server’s long-term private key later doesn’t expose past sessions, because each session key came from an ephemeral key exchange and was then discarded
48. 48
    X.509 certificate
    A signed document that binds a public key to an identity such as a domain name, issued by a certificate authority, with a validity period and extensions

    Browsers check the hostname against the Subject Alternative Name extension, not the Common Name.
49. 49
    Chain of trust
    The server sends its certificate and any intermediates; the client checks each signature up to a root CA certificate already in its trust store

    Root keys are kept offline; intermediate CAs do the day-to-day signing.
50. 50
    “Don’t roll your own crypto”: what to do instead
    Use well-reviewed libraries and high-level APIs, such as libsodium or your platform’s crypto library, with standard algorithms and protocols

    Most real-world breaks come from misuse, such as repeated nonces, missing authentication or unchecked certificates, rather than from broken algorithms.