Cryptography & TLS
Hashing vs encryption vs encoding, symmetric and asymmetric keys, signatures, TLS as a security boundary, and certificate trust chains.
Every lesson below identifies the asset, attacker capability and boundary before naming the vulnerability. Controls are split into prevention, detection and recovery; residual risk is explicit.
Plaintext, ciphertext, keys, hashes, MACs, signatures, nonces and randomness — the vocabulary you need to use cryptography correctly, plus the one rule that matters most: use established libraries and protocols, never your own.
Encoding is reversible without a secret, hashing is one-way, encryption is reversible with a key — three different tools that are routinely confused, and the confusion produces real vulnerabilities.
One shared key encrypts and decrypts — fast enough for bulk data, and the whole difficulty is getting that key to both parties and keeping it from everyone else.
A public key anyone may hold and a private key only one party holds — enabling key exchange without a shared secret, signatures anyone can verify, and identity that does not require pre-sharing anything.
Sign with a private key, verify with the public key: proof that a message is unmodified and came from the key holder — the mechanism behind JWTs, webhooks, signed artefacts and passkeys.
Networking explains how the handshake works; here the question is what TLS actually guarantees — server authentication, confidentiality and integrity for one hop — and the many things "we use HTTPS" does not cover.
A client accepts a server certificate only when the hostname, validity and signatures form a chain through an intermediate to a locally trusted root.