Cryptography essentials
Three tools protect almost all data in modern systems — hash functions, symmetric encryption and public-key cryptography. Hash real messages in your browser, then see how keys are shared, used and verified.
In this lecture you will
- Explain what a cryptographic hash function does and where hashes are used
- Distinguish symmetric and asymmetric encryption, and why systems use both
- Explain digital signatures and what they guarantee
- Recognize common cryptography mistakes in application code
Every login, payment, software update and API call relies on cryptography. You will rarely implement it yourself — and shouldn’t — but understanding what the three core tools do lets you use them correctly and spot dangerous mistakes.
Hash functions: fingerprints for data
A cryptographic hash function turns any input — a password, a file, a whole disk image — into a short, fixed-size output, such as 256 bits for SHA-256. Good hash functions have three properties:
- Deterministic: the same input always produces the same hash.
- One-way: you can’t work backwards from a hash to the input.
- Collision-resistant: it is infeasible to find two different inputs with the same hash.
Try it with real SHA-256, computed in your browser. Change a single character in one message:
Hashes are everywhere: verifying downloads, detecting changed files, identifying container image layers, Git commits, digital signatures — and, with extra care, storing passwords (lecture 5).
Symmetric and asymmetric encryption
Encryption, unlike hashing, is reversible — with the right key. There are two families, and real systems use both. Step through them:
- Symmetric encryptionAsha and Bilal share one secret key. Asha encrypts, Bilal decrypts with the same key. Algorithms such as AES are extremely fast and protect data on disks and networks.
- The key-sharing problemIf Asha and Bilal have never met, how do they agree on a secret key over a network an eavesdropper can watch? Sending the key in the clear defeats the purpose.
- Public-key encryptionBilal publishes a public key and keeps its matching private key secret. Anything encrypted with the public key can only be decrypted with the private one.
- Hybrid: exchange a key, then go fastIn practice, public-key methods are used briefly — a key exchange such as ECDHE lets both sides derive the same session key without sending it. Fast symmetric encryption then protects the data.
- Digital signaturesReversed roles: Bilal signs with his private key, and anyone can verify with his public key. A valid signature proves who signed and that nothing changed afterwards.
The key exchange in the fourth step sounds impossible: two parties agree on a secret while someone records everything they send. Here is the idea behind it, Diffie–Hellman, with numbers small enough to check by hand:
Each side combines the other’s public number with its own secret and gets the same result. TLS 1.3 uses the same idea on elliptic curves (ECDHE), with fresh secrets for every connection, so recording traffic today doesn’t help decrypt it tomorrow.
- Symmetric (for example AES-GCM, ChaCha20)
- One shared key. Very fast — used for bulk data, disks, databases and network traffic.
- Asymmetric (for example RSA, elliptic curves)
- A public/private key pair. Slower — used for key exchange, signatures and certificates.
- Digital signature
- A value computed with a private key over a hash of the data. It proves origin and integrity — code signing, software updates, documents, tokens.
Common mistakes in application code
- Hard-coded keys in source code or container images. Keys belong in a secrets manager or key-management service, and must be rotated.
- Encoding is not encryption. Base64 makes data look scrambled but anyone can decode it.
- Outdated algorithms. MD5 and SHA-1 are broken for security purposes; DES and RC4 are obsolete.
- Encryption without integrity. Modern authenticated modes such as AES-GCM detect tampering as well as hiding data; older modes may not.
See the difference between the three with real cryptography, computed by your browser:
All three outputs come from your browser’s Web Crypto API, and the AES key never leaves this page. Base64 hides nothing; a plain hash of a guessable value can be reversed by guessing; authenticated encryption keeps data secret and detects any change.
Next, we see all three tools working together in the protocol you use hundreds of times a day: HTTPS.
Key takeaways
- A hash is a fixed-size fingerprint of data; any change produces a completely different hash, and it can’t be reversed.
- Symmetric encryption uses one shared key and is fast; public-key encryption uses a key pair and solves key distribution.
- Real protocols combine them — a key exchange agrees a session key, then symmetric encryption protects the data.
- Signatures prove who created data and that it hasn’t changed. Never invent your own cryptography — use vetted libraries.
Check your understanding
3 questions · answers explainedQ1You change one character in a 10 MB file. What happens to its SHA-256 hash?
Q2Why does HTTPS not encrypt all traffic with public-key cryptography?
Q3What does a valid digital signature on a software update prove?