33. Cryptography Basics
Chala mitrano, HTTPS (Chapter 11), password hashes (Chapter 22), SSH keys, KMS (Chapter 30) – ya sagalyamage ek ch shastra aahe: cryptography. Ghabru naka, ithe gani ta nahi, fakt concept ani commands. Hashing, encryption, symmetric ani asymmetric, digital signature, certificates – he samajla ki interview madhle kiti tari prashna sope hotat. Pratyek goshta aapan openssl ne swatah karun baghu. Samjla ka? Chala!
What you will learn in this chapter
- The goals of cryptography: confidentiality, integrity, authentication, non-repudiation
- Encoding vs hashing vs encryption – the most confused trio
- Hashing (SHA-256), salts and safe password storage
- Symmetric encryption (AES) and asymmetric encryption (RSA, ECC)
- Digital signatures, certificates, PKI and how TLS uses all of them
- Common crypto mistakes and how attackers exploit them
Concepts in this chapter
- 33.1Goals and the Big Three: Encoding, Hashing, Encryption
- 33.2Hashing, Salts and Password Storage
- 33.3Symmetric Encryption
- 33.4Asymmetric Encryption
- 33.5Digital Signatures, Certificates, PKI and TLS
- 33.6Common Crypto Mistakes and Attacks
- 33.7Red vs Blue, Project and Real Incidents
The chapter recap is at the end of the last concept page.
Chapter 33: Cryptography basics — practice tasks
Open chapter lessons · Full guided lab: check certificate chain verify sha256 download (not repeated here)
33.1 Verify a file checksum
EasyITWhy: Downloads can be swapped.
What: Verify a known SHA256.
How:
- Download a file you trust with a published checksum.
- sha256sum file and compare to the published hash.
Expected output: Exact match.
Hint
Get the hash over HTTPS from the vendor.
Answer / how to check
- Mismatch → do not use the file.
33.2 Inspect a website certificate
MediumBankingWhy: Wrong names or short keys are red flags.
What: Check https://example.com certificate.
How:
- echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -subject -issuer -dates
Expected output: Subject includes example.com; not expired.
Hint
Also try curl -vI https://example.com.
Answer / how to check
- notAfter date is in the future.
33.3 Symmetric vs asymmetric (paper)
EasyHealthcareWhy: Pick the right tool for the job.
What: Match each use case.
Data file: crypto.csv
| Use case | Type (fill) |
|---|---|
| Full-disk encryption (LUKS) | Symmetric |
| Code signing | Asymmetric |
| HTTPS session keys after handshake | Symmetric |
About this file: Made-up matching. Each row is one use case. Columns: Use case; Type to fill.
How:
- Read the data file.
- Pick Symmetric or Asymmetric.
Expected output: Disk encryption Symmetric; code signing Asymmetric; HTTPS session keys Symmetric.
Hint
TLS uses both.
Answer / how to check
- All three matched.
Extended teaching notes
Why this lesson matters
Part 11 turns tool skills into professional defensive practice: web risks, cloud, SOC work, hardening, cryptography, Indian law and careers. Every example below stays inside systems you own or public teaching material.
Indian company (sample data)
Suppose we are a junior security engineer at an Infosys or TCS client project. You take this lesson's checklist, map it to three production services (for example a Spring Boot API, a Node.js portal and a Python job), and open tickets with evidence and owners.
Global practice
Follow public guidance from OWASP, CERT-In, CISA and cloud provider Well-Architected / security pillars. Cite them in reports.
Everyday analogy
A cricket team that only practises hitting but never fielding loses matches. Offence skills in a lab exist to improve fielding in real systems.
Apply across stacks
Wherever code appears, ask the same questions.
Java / Spring Boot
Parameterise queries, encode output, limit Actuator, patch dependencies.
.NET
EF Core parameters, HTTPS, Data Protection API, patch NuGet.
Node.js
helmet, parameterized SQL, npm audit, lockfiles.
Python
ORM, autoescape, pip-audit, Bandit.
Go / PHP / Ruby
Safe templates, prepared statements, govulncheck / composer audit / Brakeman.
nginx / Apache / Tomcat
Hide versions, TLS, least-open ports.
MySQL / PostgreSQL / MongoDB / Redis
No public ports, auth on, least-privilege users.
AWS / Azure / GCP
Roles not keys, private data stores, cloud logs on.
Defender worksheet
- Write a 5-line summary.
- Name one related public breach or advisory.
- Practise one safe command on a lab you own.
- Write the fix for a teammate.
Recap
- Permission first.
- Fix over spectacle.
- Evidence in notes.
Defender's worksheet (do this today)
- Write the lesson title and date.
- List three owned systems where it applies.
- Run one safe lab check and paste evidence.
- Write a two-sentence fix for a teammate.
- Note one CERT-In or CISA advisory that relates (title + date).
Indian workplace (sample)
At a Wipro or LTIMindtree client SOC, turn this lesson into one playbook step with an owner and a due date.
Global practice
Compare your notes with OWASP, CIS Benchmarks or a cloud Well-Architected security question. Write the overlap in five lines.
Family test
Explain the risk and the fix without jargon. If a parent or sibling can repeat the warning, you are ready to teach juniors.
Common mistakes
- Skipping permission.
- Tool collecting without fixing.
- Publishing lab screenshots that contain secrets.
- Treating encoding as encryption.
Recap
- Evidence, fix, owner, date.
- Own lab only.
Key terms for this page
- Control: a safeguard (patch, config, process).
- Finding: a weakness with evidence.
- Remediation: the fix and how you verified it.
- Scope: systems you are allowed to touch.
- Least privilege: only the access required for the task.
- Defence in depth: several controls in layers.
Mini case study
Suppose we are a junior engineer at Zoho or Freshworks (sample data). A weekly review asks each person to present one control from their area. You pick a control from this lesson, show a before/after screenshot from a lab, and list the production ticket you would open. That habit builds both skill and credibility.