Cryptography Foundations

The problem cryptography solves

Imagine shouting a secret across a crowded room — everyone hears it. Sending data across the internet is a little like that: your message passes through many machines you do not control, and any of them could be listening. Cryptography is the maths that lets you send a secret across that crowded room so only the right person can understand it.

Two words you will use forever:

• Plaintext — the original, readable message (like "Hello").
• Ciphertext — the scrambled version after encryption (like "8f3a9c1d").

Encryption turns plaintext into ciphertext using a key. Decryption turns it back — but only for someone who has the right key. Anyone snooping in the middle just sees meaningless scramble.

Why every hacker learns this

Half of security is protecting data with cryptography; the other half is spotting where it was used *wrongly*. Weak or misused crypto is behind countless breaches, so you need to know how it is meant to work.

Flag: ASEC{secrets_need_protection}

The three goals behind every control

Before the maths, know *what* you are protecting. Almost every security control exists to defend one of three things, together called the CIA triad.

• Confidentiality — only authorised people can read the data. This is what encryption provides.
• Integrity — the data has not been secretly changed. This is the principle that guarantees data has not been tampered with, and it is what hashing and digital signatures provide.
• Availability — the data and systems are there when you need them (backups, redundancy).

Bring it to life

When you buy something online: encryption keeps your card number confidential, a hash proves the order details have integrity (were not altered), and the shop staying online is availability.

Three cousins people constantly confuse

They all transform data, so beginners mix them up. Telling them apart is the single most useful thing in this whole room.

• Encoding (like Base64 or hex) only changes the *format* so systems can handle the data. It is reversible by anyone, needs no key, and provides zero security.
• Hashing (like SHA-256) is a one-way function. You can turn input into a fixed fingerprint, but you can never turn the fingerprint back into the input. It is the one-way one.
• Encryption (like AES or RSA) scrambles data so only someone with the key can reverse it. It is the one that needs a key to reverse.

The test that catches most mistakes

Ask: "Can I reverse it, and do I need a key?" Encoding: reversible, no key. Hashing: not reversible at all. Encryption: reversible, but only with the key.

See "encoding is not encryption" for yourself

The best way to believe that encoding gives no security is to reverse some yourself. Base64 represents data as letters, digits, + and /, often ending with = padding. It looks secret; it is not.

It shows up everywhere — tokens, email attachments, data URLs — so recognising and decoding it is a core skill.

Here is a Base64 string. Decode it (any online Base64 decoder works, or base64 -d in a terminal) to reveal the flag:

QVNFQ3tiYXNlNjRfaXNfZW5jb2Rpbmd9

The one-way fingerprint

Hashing feels strange at first: it turns any input into a fixed-length fingerprint, and there is no way back. Feed in one letter or an entire film, and out comes a short string like 5e884898…. Change the input by a single character and the fingerprint changes completely.

Two everyday jobs use this:

• Storing passwords. A website should never store your actual password — it stores the hash. When you log in, it hashes what you typed and compares fingerprints. If the database leaks, attackers get fingerprints, not passwords.
• Checking integrity. Publish a file's hash, and anyone who downloads it can hash their copy to prove it was not altered.

The magic word: salt

Since the same password always hashes to the same fingerprint, attackers precompute giant tables of common passwords. The defence is a salt: a random value added to each password before hashing, so two identical passwords get different fingerprints and those tables become useless.

Flag: ASEC{hashing_is_one_way}

Encryption comes in two flavours

There are two ways to do encryption, and the difference is entirely about the keys.

• Symmetric encryption uses one shared key. Both sides lock and unlock with the same key. It is very fast (AES is the classic example) — but it has a problem: how do you get that shared key to the other person without a snooper grabbing it on the way?
• Asymmetric encryption uses a key pair: a public key you can share with the whole world, and a private key you keep secret. Anything locked with the public key can only be unlocked by the matching private key. RSA is the classic example.

Asymmetric solves the key-sharing problem: you can hand out your public key openly, and people use it to send you messages only *you* can open.

Flag: ASEC{public_locks_private_unlocks}

The secret is the key, not the method

Beginners often assume secure systems must use secret, mysterious algorithms. The opposite is true. Good cryptography follows Kerckhoffs's principle: a system should stay secure even if attackers know exactly how it works. The algorithm is public; only the key is secret.

Why? Because algorithms studied openly by thousands of experts get their weaknesses found and fixed. A secret home-made algorithm has been checked by nobody.

The golden rules for beginners

• Never invent your own crypto. Use trusted, standard libraries (AES, RSA, SHA-256, bcrypt).
• Protect the key. Most real-world "crypto breaks" are not clever maths — they are leaked keys, reused values, or keys hard-coded into source code.

Flag: ASEC{never_roll_your_own}

Everything, working together, every day

You use all of this every time you see the padlock in your browser. That padlock is HTTPS — the secure version of HTTP — and it is a beautiful combination of everything in this room.

Here is the trick it pulls off:

1. Asymmetric encryption is used first, just to safely agree on a shared secret key — no snooper can grab it.
2. Then fast symmetric encryption takes over, using that shared key to protect the actual data for the rest of the visit.
3. Hashing runs alongside to prove nothing was altered in transit (integrity).

So the slow-but-clever asymmetric method sets things up, the fast symmetric method does the heavy lifting, and hashing guards integrity. Confidentiality and integrity — two of the CIA triad — delivered at once.

When you can explain what that little padlock actually does, you understand practical cryptography better than most people ever will.

Your graduation flag for this room: ASEC{you_understand_crypto}

Job-Ready Notes

Tools to know: CyberChef, openssl, hashcat, a little Python.
Cheat sheet

echo -n data | base64                        # encode
openssl enc -aes-256-cbc -in f -out f.enc     # symmetric encrypt

Interview practice

• Symmetric vs asymmetric encryption — when to use each?
• Why do we salt as well as hash passwords?
• State Kerckhoffs's principle.