Cryptography Basics: Hashing, Encryption, Signatures, and TLS

Step 1: Tell the four ideas apart

Encoding, such as Base64, changes the format of data with no secret, and anyone can reverse it, so it provides no security. Hashing is a one-way function that turns data into a fixed-size fingerprint, used to check integrity and to store passwords. Encryption is two-way: with the right key you can turn ciphertext back into the original data, which provides confidentiality. A digital signature proves that a message came from the holder of a private key and was not altered.

Step 2: Choose safe algorithms

For hashing, avoid MD5 and SHA-1, which have known collision weaknesses, and use SHA-256 or SHA-3 for integrity checks. For passwords, do not use fast hashes at all; use a dedicated password hashing algorithm, covered in the next lesson. For symmetric encryption, use AES with a 128-bit or, ideally, 256-bit key in an authenticated mode such as GCM. For asymmetric cryptography, RSA keys should be at least 2048 bits and use OAEP padding for encryption, while elliptic curve schemes such as ECDSA and Ed25519 provide signatures and X25519 provides key agreement. Current guidance also recommends planning for post-quantum algorithms, with hybrid schemes using ML-KEM for key establishment.

Step 3: Never invent your own cryptography

Designing your own algorithm or protocol is the classic mistake, and OWASP's advice on custom algorithms is simply not to do it. Use well-reviewed libraries and high-level APIs, generate keys with a cryptographically secure random number generator, never hard-code keys, and never commit them to version control. Store keys separately from the data they protect, ideally in a secrets manager or hardware security module.

Step 4: Understand TLS and certificates

TLS provides encryption, integrity, and authentication for connections such as HTTPS. TLS 1.3 is the current version, and TLS 1.2 is still widely used; versions 1.0 and 1.1 should no longer be used. A server proves its identity with a certificate, a signed statement from a certificate authority that binds a public key to a domain name. Free automated authorities such as Let's Encrypt issue certificates through the ACME protocol, and certificate lifetimes are getting shorter, with Let's Encrypt announcing a move to 64-day default certificates in February 2027 and 45 days by 2028, so renewal must be automated.

Step 5: Try it with OpenSSL

These commands hash a file, generate random bytes, and inspect a real server's certificate. On Windows, run them in WSL or Git Bash. The s_client command opens a TLS connection, and the x509 command prints selected certificate fields.

echo "hello" > note.txt
openssl dgst -sha256 note.txt

openssl rand -hex 32

openssl s_client -connect example.com:443 -servername example.com </dev/null \
  | openssl x509 -noout -dates -subject -issuer