Why Encryption Isn't as Secure as You Think
Published: Sat Feb 01 2025
Encryption alone doesn't guarantee security. Understanding threat models and the gap between "encrypted" and "secure" is the first step to building truly protected systems.
Encryption for Developers
A practical guide to cryptography for programmers who can code but haven't formally studied security.
This 23-chapter series covers symmetric encryption, asymmetric cryptography, hashing, digital signatures, real-world protocols, and security mindset.
What Problems Does Cryptography Actually Solve?
Published: Sat Feb 01 2025
Cryptography solves exactly four problems: confidentiality, integrity, authentication, and non-repudiation. Using the wrong algorithm for the wrong problem is a recipe for disaster.
Symmetric vs Asymmetric Encryption: Why We Need Both
Published: Sat Feb 01 2025
Symmetric encryption is fast but has a key distribution problem. Asymmetric encryption solves key distribution but is slow. Real systems use both together in hybrid schemes.
Hash Functions: Why They're Not Encryption
Published: Sat Feb 01 2025
Hashing is one-way by design. You can't "decrypt" a hash because nothing was encrypted. Understanding this difference is critical for password storage and data integrity.
Random Numbers: The Most Underestimated Component in Cryptography
Published: Sat Feb 01 2025
Most encryption failures aren't because algorithms were broken—they're because random numbers weren't random enough. Understanding the difference between true randomness and pseudo-randomness, and why rand() can kill your security.
Starting with DES: The Basic Idea of Block Ciphers
Published: Sat Feb 01 2025
Why do we need block encryption? What is the Feistel structure? Why did DES fail? Understanding this history helps you better understand modern encryption.
How AES Works (No Math Required)
Published: Sat Feb 01 2025
AES is the cornerstone of modern encryption, but its inner workings aren't mysterious. Understanding the SPN structure, the four steps of each round, and why 128-bit blocks matter will help you use it better.
AES Modes of Operation: Security vs Disaster Is Just One Option
Published: Sat Feb 01 2025
AES itself is secure, but choosing the wrong mode of operation can lead to disaster. ECB leaks patterns, CBC needs proper IV, and GCM provides both encryption and authentication. Choosing the right mode matters more than key length.
Symmetric Encryption in Real-World Systems
Published: Sat Feb 01 2025
Theory is one thing, practice is another. How does symmetric encryption work in HTTPS? How do you properly encrypt files? What are the pitfalls of database encryption? This article shows symmetric encryption in real systems.
RSA's Core Idea: Why Factoring Large Numbers Is So Hard
Published: Sat Feb 01 2025
RSA's security rests on a simple mathematical fact: multiplying two large primes is easy, but factoring the result back is extremely hard. Understand this core idea, and you understand the foundation of asymmetric encryption.
RSA in Modern Systems: Real Usage and Why It's Being Replaced
Published: Sat Feb 01 2025
RSA is no longer used for direct encryption in modern systems. TLS 1.3 removed RSA key exchange entirely. Understand RSA's real role today, its security pitfalls, and why the world is moving to elliptic curves.
Elliptic Curve Cryptography: Smaller Keys, Same Security
Published: Sat Feb 01 2025
Elliptic curve cryptography achieves RSA-equivalent security with keys 10x smaller. Understand how points on a curve create one-way functions, and why ECC dominates modern cryptography.
Diffie-Hellman: How Strangers Agree on a Secret
Published: Sat Feb 01 2025
Diffie-Hellman solves an impossible-sounding problem: two people who've never met can create a shared secret over a public channel. Understand this foundational protocol that makes secure internet possible.
Digital Signatures: Proving Who Sent the Message
Published: Sat Feb 01 2025
Digital signatures prove authorship and integrity like handwritten signatures, but with mathematical guarantees. Understand how they work, what they guarantee, and how to use them correctly.
Certificates and PKI: Building Trust on the Internet
Published: Sat Feb 01 2025
Digital signatures prove a key signed something, but how do you know whose key it is? Certificates and PKI solve the identity problem. Understand how trust is built from root CAs to your browser's padlock.
HMAC and Data Integrity: Detecting Tampering with Shared Secrets
Published: Sat Feb 01 2025
Digital signatures need asymmetric keys. But when two parties already share a secret, HMAC provides a faster way to verify data hasn't been tampered with. Understand MACs, HMAC construction, and when to use them.
TLS Deep Dive: How HTTPS Actually Works
Published: Sat Feb 01 2025
Every HTTPS connection uses TLS, but what actually happens when you visit a website? Walk through the TLS 1.3 handshake step by step, understand how all the cryptographic primitives work together.
Password Storage: Why You Should Never Encrypt Passwords
Published: Sat Feb 01 2025
Encrypting passwords is wrong. Hashing with SHA-256 is wrong. Learn why password storage requires specialized algorithms like bcrypt, Argon2, and scrypt, and how to implement them correctly.
Key Management: The Hardest Part of Cryptography
Published: Sat Feb 01 2025
The encryption algorithm is never the weak point—key management is. Learn how to generate, store, distribute, rotate, and destroy cryptographic keys without making your encryption worthless.
Building Secure Systems: Putting It All Together
Published: Sat Feb 01 2025
You know the primitives: encryption, hashing, signatures, TLS. Now learn how to combine them into secure systems. End-to-end encryption, secure APIs, defense in depth, and avoiding common architectural mistakes.
Why You Should Never Roll Your Own Crypto
Published: Sat Feb 01 2025
"I'll just implement a simple encryption..." Famous last words. Even experts get it wrong. Learn from history's most catastrophic cryptographic failures and understand why implementation details can break mathematically perfect algorithms.
Encryption ≠ Security: System-Level Failures
Published: Sat Feb 01 2025
The encryption was perfect. The system was still breached. Learn from real-world cases where strong cryptography meant nothing because of plaintext leaks, operational failures, and fundamental design flaws.
Building Security Judgment
Published: Sat Feb 01 2025
How do you know when something is secure enough? Learn threat modeling, think like an attacker, and develop the judgment to make good security decisions—even when there's no perfect answer.