Information Security & Cryptography

Applied defensive security: symmetric AES-GCM vs asymmetric RSA/ECC, digital signatures, PKI certificate chains, packet filtering firewalls, and WireGuard tunneling.

Symmetric vs Asymmetric Encryption & MAC Authenticity

Modern cryptographic systems combine Symmetric Authenticated Ciphers (AES-GCM) for bulk data throughput with Asymmetric Public-Key Ciphers (RSA / ECC) for key exchange and digital identity verification.

Authenticated Encryption with Associated Data (AEAD):AES-GCM and ChaCha20-Poly1305 provide confidentiality and integrity simultaneously. Modifying a single bit of ciphertext triggers MAC authentication failure before decryption.
Elliptic Curve Cryptography (ECC):Achieves equivalent 128-bit cryptographic strength using a 256-bit key (Curve25519 / secp256k1) compared to a massive 3072-bit key required in traditional RSA.
X.509 Public Key Infrastructure (PKI):Certificate Authorities (CAs) cryptographically sign server public keys, establishing a verifiable Chain of Trust anchored in OS root trust stores.

Symmetric Session Key Generation: Client and server generate a random 256-bit AES key for bulk payload encryption.
Digital Signature Signing & Verification: Sender hashes the payload with SHA-256 and encrypts the hash with their private key. The receiver decrypts with sender's public key to verify unforgeable authenticity.
TLS 1.3 1-RTT Handshake: Client sends KeyShare (ECDH public parameter) in ClientHello; Server responds with ServerHello and Finished, establishing zero-latency encrypted sessions.

Definition: Authenticated Encryption (AEAD)

A cryptographic mode of operation that guarantees both data confidentiality (encryption) and data integrity/authenticity (MAC verification tag) in a single unified primitive.

RSA Encryption & Decryption Mathematics

Encryption: C = M^e mod N <===> Decryption: M = C^d mod N

Variable Definitions & Term Breakdown:

N = p × qModulus product of two large 1024-bit primes

e, dPublic exponent (typically 65537) and private modular inverse exponent

M, CPlaintext message integer and Ciphertext encrypted integer

RSA vs Elliptic Curve (ECC) Cryptography Comparison

Security Level	RSA Key Size	ECC Key Size	Performance Speedup
112-bit Security	2048 bits	224 bits	3x Faster
128-bit Security (Standard)	3072 bits	256 bits (Curve25519)	5x FasterModern
256-bit Security (Top Secret)	15360 bits	512 bits	10x Faster

Key size requirements for equivalent security strength

Tip

Never use ECB mode (Electronic Codebook) for AES! ECB does not use an initialization vector (IV), encrypting identical plaintext blocks into identical ciphertext blocks, which preserves visible visual patterns in the data.

PythonPython Cryptography: AES-GCM Authenticated Encryption Simulation

1import hmac
2import hashlib
3import os
4 
5# Simulated AEAD Authenticated Encryption Primitive
6key = os.urandom(32) # 256-bit symmetric key
7plaintext = b'ProgrammersOS Confidential Payload'
8 
9# Symmetric XOR stream cipher simulation + HMAC-SHA256 Auth Tag
10nonce = os.urandom(12)
11keystream = hashlib.sha256(key + nonce).digest()[:len(plaintext)]
12ciphertext = bytes(p ^ k for p, k in zip(plaintext, keystream))
13auth_tag = hmac.new(key, nonce + ciphertext, hashlib.sha256).digest()
14 
15print('Ciphertext Hex:', ciphertext.hex())
16print('Auth Tag Hex:   ', auth_tag.hex())
17 
18# Receiver Decryption with Verification
19expected_tag = hmac.new(key, nonce + ciphertext, hashlib.sha256).digest()
20if hmac.compare_digest(auth_tag, expected_tag):
21    decrypted = bytes(c ^ k for c, k in zip(ciphertext, keystream))
22    print('Decrypted:', decrypted.decode())
23else:
24    print('INTEGRITY COMPROMISED - REJECTED')

Output

Ciphertext Hex: ...
Auth Tag Hex:    ...
Decrypted: ProgrammersOS Confidential Payload

BashOpenSSL CLI Certificate Inspection

1# Inspect remote server TLS Certificate Chain
2openssl s_client -connect programmersos.com:443 -servername programmersos.com
3 
4# Generate 256-bit Elliptic Curve Private Key (Curve25519)
5openssl genpkey -algorithm ed25519 -out private.pem

Output

[Certificate Chain Verified: Valid -> Intermediate CA -> Root CA]

Quick Syntax & Reference Sheet

Concept / Rule	Syntax / Usage
AEAD Symmetric Rule	`Always use AES-256-GCM or ChaCha20-Poly1305 for authenticated encryption.`
Password Hashing	`Never use SHA-256 for passwords. Use Argon2id or bcrypt with work factors.`

Common Pitfalls & Developer Mistakes

✕ Mistake 1:

Reusing the same Nonce / IV with the same AES-GCM key

Why it happens: Reusing a nonce in GCM mode allows an attacker to compute the authentication key H, completely breaking both confidentiality and authenticity.

Correction: Always generate a cryptographically secure random 96-bit nonce for EVERY individual encryption operation.

# Correct Nonce Generation:
nonce = os.urandom(12) # 96-bit unique nonce

Frequently Asked Questions

What is the difference between Hashing and Encryption?

Encryption is a two-way mathematical function with a key (reversible). Hashing is a one-way mathematical function without a key (irreversible), turning arbitrary data into a fixed-length checksum.