Cryptography

Why the algorithm is public and only the key is secret, and how to state what a scheme actually promises — the attacker-capability ladder from ciphertext-only to chosen-ciphertext, and the goals from IND-CPA to authenticated encryption.

Where kernel CSPRNGs get their entropy, why /dev/random vs /dev/urandom stopped mattering on Linux, and the boot-time, VM-clone and userspace-PRNG failures that have broken real keys at scale.

The two different jobs called "KDF" — stretching low-entropy passwords versus expanding high-entropy secrets — why HKDF splits extract from expand, and why context binding is what stops cross-protocol key reuse.

The substitution-cipher lineage — Caesar, Trithemius, Vigenère, gamma ciphers — the frequency-analysis attacks that killed it, and the one member that is provably unbreakable until you reuse the pad.

AES round by round — the S-box as field inversion, ShiftRows and MixColumns as diffusion, key expansion — plus why the raw block cipher is never what you deploy and why table-based implementations leak keys through the cache.

The other half of block-cipher design space — the Feistel construction that makes decryption free, DES as the canonical key-length cautionary tale, and Blowfish, whose expensive key schedule became bcrypt.

How a block cipher becomes a usable encryption scheme — ECB through CBC to CTR — why unauthenticated modes lose to padding oracles, and GCM in detail including the nonce-reuse failure that hands over the authentication key.

Keystream generators and their one unforgiving rule — plus why RC4 died, how ChaCha20's ARX design is constant-time by construction, and why it is the default wherever AES hardware is absent.

What collision, preimage and second-preimage resistance actually promise, the sponge construction behind SHA-3, and why authentication needs a keyed MAC compared in constant time — not a hash.

The construction behind MD5, SHA-1 and SHA-2 — chained compression functions with length padding — why H(secret ‖ message) is a broken MAC, and the collision timeline that retired two hash generations.

Key generation, encryption and the correctness proof, worked on small numbers — plus why textbook RSA is unusable, what padding actually does, and why new systems pick elliptic curves instead.

How two parties derive a shared secret over a wiretapped channel, why it needs authentication to mean anything, and the parameter mistakes — small groups, static exponents, non-prime-order subgroups — that broke it in production.

The group law on a curve, why the discrete log there resists index calculus, and why the ecosystem moved from Weierstrass/NIST curves to Curve25519 — completeness, constant time, and no unexplained constants.

DSA, ECDSA and Ed25519 — what a signature actually proves, why the per-signature nonce is the most dangerous value in applied cryptography, and the deterministic designs that removed the footgun.

One round trip to a secure channel — how TLS 1.3 got there by deleting options, what each handshake message actually does, and why 0-RTT is the one part that trades security for latency.

How a name gets bound to a public key, why the CA trust model is only as strong as its weakest member, and what Certificate Transparency, pinning and short lifetimes each actually fix.

The part every algorithm assumes and no algorithm provides — key hierarchies, envelope encryption, rotation, storage in HSMs and KMS, compromise response, and why key lifetime is a design parameter.

Turning a weak shared password into a strong session key without ever transmitting it — how EKE started it, why offline dictionary resistance is the defining property, and what OPAQUE and SRP get right and wrong.

Why a format that lets the token declare its own verification algorithm produced alg:none and the HMAC/RSA confusion bug — plus the revocation problem that no amount of correct crypto fixes.

Why the defence is deliberate slowness and memory cost, what salt and pepper each actually stop, and the current parameter recommendations for Argon2id, bcrypt, scrypt and PBKDF2.

What Shor and Grover actually break, the NIST standards that replaced RSA and ECC, and why deployment is happening now through hybrid key exchange despite no quantum computer being close.

Proving a statement is true while revealing nothing else — the three defining properties, the Schnorr protocol as the worked case, and what SNARKs and STARKs actually buy.

Splitting a secret into n shares so any m reconstruct it and m-1 reveal literally nothing — Shamir's polynomial scheme worked end to end, and where threshold cryptography is actually deployed.

The catalogue of how correct algorithms get deployed insecurely — oracles, timing leaks, nonce reuse, unverified decryption, misuse-prone APIs — and the design rules that structurally prevent each class.