Cryptography Basics
Symmetric vs Asymmetric Encryption
| Type | Key Model | Speed | Use Case | Algorithms |
|---|---|---|---|---|
| Symmetric | Same key to encrypt/decrypt | Fast | Bulk data encryption | AES-256, ChaCha20 |
| Asymmetric | Public key encrypts, private key decrypts | Slow | Key exchange, digital signatures | RSA-2048+, ECDSA, Ed25519 |
| Hybrid | Asymmetric to exchange symmetric key | Fast+Secure | TLS, PGP, Signal protocol | RSA/ECDH + AES |
Hash Functions Reference
| Algorithm | Output Size | Status | Use For |
|---|---|---|---|
| MD5 | 128 bit | Broken | Checksums only (not security) |
| SHA-1 | 160 bit | Deprecated | Legacy systems only |
| SHA-256 | 256 bit | Secure | Data integrity, JWT, certificates |
| SHA-512 | 512 bit | Secure | High-security integrity checks |
| SHA-3/256 | 256 bit | Secure | Post-quantum resistant option |
| bcrypt | 60 chars | Secure (slow) | Password hashing |
| Argon2id | Variable | Best for passwords | Password hashing (OWASP recommended) |
| BLAKE3 | 256 bit | Secure | Fast general-purpose hashing |
AES Encryption in Go
import (
"crypto/aes"
"crypto/cipher"
"crypto/rand"
"io"
)
// AES-256-GCM (authenticated encryption)
func encrypt(plaintext, key []byte) ([]byte, error) {
block, err := aes.NewCipher(key) // key must be 32 bytes for AES-256
if err != nil { return nil, err }
gcm, err := cipher.NewGCM(block)
if err != nil { return nil, err }
nonce := make([]byte, gcm.NonceSize())
if _, err = io.ReadFull(rand.Reader, nonce); err != nil {
return nil, err
}
return gcm.Seal(nonce, nonce, plaintext, nil), nil
}
func decrypt(ciphertext, key []byte) ([]byte, error) {
block, _ := aes.NewCipher(key)
gcm, _ := cipher.NewGCM(block)
nonceSize := gcm.NonceSize()
nonce, ciphertext := ciphertext[:nonceSize], ciphertext[nonceSize:]
return gcm.Open(nil, nonce, ciphertext, nil)
}
TLS Handshake Overview
| Step | Description |
|---|---|
| 1. ClientHello | Client sends supported TLS versions, cipher suites, random bytes |
| 2. ServerHello | Server chooses TLS version, cipher suite, sends certificate |
| 3. Certificate verification | Client verifies server certificate against trusted CA |
| 4. Key exchange | ECDHE generates shared secret without transmitting it |
| 5. Finished | Both sides derive session keys; encrypted communication begins |