Cryptography Essentials

This roadmap explains the cryptography every security professional and developer needs: what each primitive does, how it is used correctly, and how it commonly fails. No advanced math is required.

• Know basic programming or scripting
• Install OpenSSL in a lab
• Plan your study time

• CyberA4U Academy — courses

A cryptographic hash turns data into a fixed-size fingerprint. Hashes verify integrity and underpin signatures, but on their own they do not provide secrecy or authentication.

• Explain collision and preimage resistance
• Choose SHA-256/SHA-3 over MD5/SHA-1
• Distinguish hashes from HMACs

الأدوات والتقنيات: Crypto

• NIST FIPS 180-4 — Secure Hash Standard

Symmetric ciphers such as AES use one shared key to encrypt and decrypt. Modern use means authenticated modes like AES-GCM, which also detect tampering.

• Explain block ciphers and modes
• Prefer authenticated encryption (AES-GCM, ChaCha20-Poly1305)
• Understand why IVs/nonces must not repeat

الأدوات والتقنيات: Crypto

تعلّمها على CyberA4U:Module 22: Applied Cryptography and Attacks

• NIST FIPS 197 — Advanced Encryption Standard (AES)

Public-key cryptography uses a key pair: anyone can encrypt with the public key, only the private-key holder can decrypt. It enables key exchange and signatures at internet scale.

• Explain RSA and elliptic-curve key pairs
• Understand key exchange (Diffie-Hellman)
• Know why public-key encryption usually wraps a symmetric key

الأدوات والتقنيات: Crypto

تعلّمها على CyberA4U:Module 22: Applied Cryptography and Attacks

• RFC 8017 — PKCS #1: RSA Cryptography Specifications

A digital signature proves who created data and that it wasn't changed. Signatures secure software updates, certificates and many protocols.

• Explain signing and verification
• Know common algorithms (RSA-PSS, ECDSA, Ed25519)
• Understand what a signature does not prove

الأدوات والتقنيات: Crypto

• NIST FIPS 186-5 — Digital Signature Standard

Public key infrastructure binds public keys to identities using X.509 certificates issued by certificate authorities.

• Read the fields of an X.509 certificate
• Explain the chain of trust
• Understand revocation and certificate lifetimes

الأدوات والتقنيات: Crypto

• RFC 5280 — X.509 Certificate and CRL Profile

TLS protects web traffic. In the handshake the client and server agree on algorithms, authenticate the server with a certificate, and derive shared keys.

• Describe the TLS 1.3 handshake step by step
• Know which versions and cipher suites are safe
• Recognize common TLS misconfigurations

الأدوات والتقنيات: Crypto

• RFC 8446 — TLS 1.3
• The Illustrated TLS 1.3 Connection

Most real-world crypto failures are key-management failures: keys in source code, never rotated, or shared too widely. NIST SP 800-57 describes the key lifecycle.

• Describe the key lifecycle: generation, storage, use, rotation, destruction
• Use a KMS or HSM for important keys
• Limit who and what can use a key

الأدوات والتقنيات: Crypto

• NIST SP 800-57 Part 1 Rev. 5 — Recommendation for Key Management

Passwords must be stored with slow, salted, memory-hard hashing such as Argon2id, scrypt or bcrypt — never plain hashes or encryption.

• Explain salting and work factors
• Choose Argon2id or bcrypt parameters
• Plan migration from weak hashes

الأدوات والتقنيات: Crypto

• OWASP Password Storage Cheat Sheet

Crypto usually fails through misuse: weak algorithms, homemade schemes, predictable randomness, reused nonces or missing integrity checks.

• Recognize the most common crypto mistakes
• Use well-reviewed libraries
• Review code for crypto misuse

الأدوات والتقنيات: Crypto

تعلّمها على CyberA4U:Module 22: Applied Cryptography and Attacks

• OWASP Top 10 — A02:2021 Cryptographic Failures

JSON Web Tokens are signed claims used for authentication. Mistakes such as accepting unsigned tokens or confusing algorithms have caused serious vulnerabilities.

• Read a JWT's header, payload and signature
• Validate algorithm, issuer, audience and expiry
• Follow RFC 8725 best practices

الأدوات والتقنيات: Crypto

• RFC 8725 — JSON Web Token Best Current Practices

Keys, tokens and nonces need cryptographically secure randomness. General-purpose random functions are predictable and must not be used for secrets.

• Distinguish CSPRNGs from ordinary PRNGs
• Use the right API in your language
• Size tokens appropriately

الأدوات والتقنيات: Crypto

• NIST SP 800-90A Rev. 1 — Random Number Generation

HSMs are tamper-resistant devices that keep keys inside hardware. Cloud KMS services offer similar protection as a service.

• Explain what an HSM protects against
• Understand FIPS 140 validation
• Choose between an HSM and a cloud KMS

الأدوات والتقنيات: Crypto

• NIST — Cryptographic Module Validation Program

Crypto agility means being able to change algorithms without rewriting systems — important as quantum-resistant algorithms are standardized.

• Inventory where cryptography is used
• Avoid hard-coding algorithms
• Follow NIST post-quantum migration guidance

الأدوات والتقنيات: Crypto

• NIST — Post-Quantum Cryptography project

OpenSSL is the Swiss army knife of cryptography: generating keys, creating CSRs, inspecting certificates and testing TLS.

• Generate keys and certificate signing requests
• Inspect certificates and connections
• Create a small private CA for a lab

الأدوات والتقنيات: Crypto

• OpenSSL documentation — openssl(1)

Before choosing algorithms, decide what you're protecting, from whom, and for how long. Threat modeling keeps cryptography focused on real risks.

• Identify assets, adversaries and required lifetimes
• Decide between confidentiality, integrity and authenticity needs
• Document key custody and trust assumptions

الأدوات والتقنيات: Crypto

• OWASP Threat Modeling Cheat Sheet

Check that you can choose, use and review cryptography correctly for common situations.

• Pick the right primitive for a need
• Configure TLS and store passwords safely
• Spot crypto misuse in code

• CyberA4U CTF Arena — practice challenges

You now understand practical cryptography. Continue with Secure Coding, PKI-heavy roles, or the Secrets Management roadmap.

• Keep your OpenSSL lab
• Choose your next roadmap
• Explain one crypto concept to someone else

• CyberA4U CTF Arena — practice challenges