Basic Cryptography — Cheat Sheet

Tags: cryptography, encryption, hashing, tls, aes, rsa, security

Level: basic

TL;DR: Core cryptographic building blocks: symmetric ciphers for speed, asymmetric key pairs for identity and exchange, and hashing for integrity.

Key concepts

Symmetric encryption uses a single shared secret key for encryption and decryption.

AES is the standard symmetric block cipher, typically executed in GCM mode.

Asymmetric cryptography uses a public key for encryption/verification and a private key for decryption/signing.

RSA and ECC (Elliptic Curve Cryptography) enable secure key exchange and digital signatures.

Cryptographic hash functions map arbitrary data to a fixed-size digest deterministically and unidirectionally.

Hashes are irreversible and sensitive to input changes via the avalanche effect.

Salt is random data added to passwords before hashing to defeat rainbow tables.

Key Derivation Functions like Argon2, bcrypt, and PBKDF2 intentionally slow brute-force attacks.

HMAC combines a hash function with a secret key to verify data integrity and authenticity.

TLS uses asymmetric cryptography to exchange keys and symmetric ciphers to encrypt session traffic.

Typical questions and ready answers

Q: What is the operational difference between symmetric and asymmetric encryption?R: Symmetric encryption uses one shared key for both operations and is fast for bulk data. Asymmetric uses paired public and private keys, solving secure key distribution.

Q: Why should you never use SHA-256 directly for user password storage?R: SHA-256 is designed for speed, allowing attackers to compute billions of guesses per second. Password storage requires memory-hard, salted KDFs like Argon2id or bcrypt.

Q: What is Authenticated Encryption with Associated Data (AEAD)?R: AEAD modes like AES-GCM provide confidentiality, integrity, and authenticity in one operation, preventing undetected ciphertext tampering.

Pitfalls and common mistakes

Reusing an initialization vector (IV) or nonce with the same key in AES-GCM.

Using AES in ECB mode, which preserves data patterns across identical blocks.

Attempting to roll proprietary cryptographic algorithms instead of vetted standards.

Failing to use constant-time comparison functions when checking signatures or HMACs.

Hardcoding encryption keys in source repositories or plaintext environment files.

Snippets and commandsTypeScript

```import crypto from 'node:crypto';

export function encryptAesGcm(plainText: string, key: Buffer) {

const iv = crypto.randomBytes(12);

const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);

const encrypted = Buffer.concat([cipher.update(plainText, 'utf8'), cipher.final()]);

const tag = cipher.getAuthTag();

return {

ciphertext: encrypted.toString('hex'),

iv: iv.toString('hex'),

tag: tag.toString('hex')

};

}

```

To review

[ ] Distinguish trade-offs between RSA key lengths and ECC curve efficiency.

[ ] Walk through the core phases of the TLS 1.3 handshake.

[ ] Compare encrypt-then-MAC versus integrated AEAD modes.

[ ] Review proper salt generation and cost parameters for Argon2id.

References

NIST SP 800-38D Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode

RFC 8446 The Transport Layer Security (TLS) Protocol Version 1.3

OWASP Cryptographic Storage Cheat Sheet