Home / Learn / Security & Cryptography

🔐 Security & Cryptography

Protecting systems and secrets. 51 topics, from beginner to advanced.

Security and cryptography protect data and systems from attackers. This area covers encryption, hashing, digital signatures, authentication and common vulnerabilities such as injection and weak passwords. Each topic explains both how a protection works and how it is typically attacked, which is the basis of defensive engineering.

Who this area is for

Developers who handle user data, students of cybersecurity, and anyone responsible for keeping a system or its secrets safe.

Real-world use cases

Storing passwords as salted hashes so a database leak does not reveal them.
Encrypting traffic with TLS so network observers cannot read it.
Preventing SQL injection by using parameterized queries.
Storing user passwords with a slow, salted hash instead of plain text.
Rotating an API key that was accidentally committed to a public code repository.

Topics in Security & Cryptography

Beginner (17)

CIA Triad — Confidentiality, integrity and availability goals of security.
Threats and Vulnerabilities — Potential dangers and the weaknesses they exploit.
Passwords and Hashing — Storing credentials as one-way digests.
Salting — Adding random data to hashes to defeat precomputed attacks.
Multi-Factor Authentication — Verifying identity with several independent proofs.
Malware Types — Viruses, worms, trojans and ransomware.
Phishing — Deceptive messages tricking users into revealing secrets.
Social Engineering — Manipulating people rather than systems.
Principle of Least Privilege — Granting only the access needed to do a task.
Authentication vs Authorization — Proving who you are versus what you may do.
Access Control Models — DAC, MAC and RBAC schemes.
Encryption Basics — Transforming data so only key holders can read it.
Symmetric Encryption — Encryption using one shared secret key.
AES — Widely used block cipher standard.
Asymmetric Encryption — Encryption with paired public and private keys.
RSA — Public-key system based on factoring large numbers.
Hash Functions — Functions mapping data to fixed-size fingerprints.

Intermediate (17)

SHA Family — Standard cryptographic hash algorithms.
Digital Signatures — Proving origin and integrity with private keys.
Public Key Infrastructure — Certificates and authorities binding keys to identities.
Diffie-Hellman Key Exchange — Agreeing on a shared secret over an open channel.
Block Cipher Modes — Schemes like CBC and GCM for encrypting long messages.
Message Authentication Codes — Keyed tags verifying message integrity.
SQL Injection — Attack inserting malicious SQL through user input.
Cross-Site Scripting — Attack injecting script into pages seen by others.
CSRF — Attack tricking a user's browser into unwanted requests.
Buffer Overflow — Writing past a buffer's end to corrupt memory.
Denial of Service — Overwhelming a service to make it unavailable.
Man-in-the-Middle Attacks — Interception of communication between two parties.
Network Intrusion Detection — Monitoring traffic to spot attacks.
Security Auditing and Logging — Recording events to investigate incidents.
Penetration Testing — Authorized simulated attacks to find weaknesses.
Secure Coding — Writing software that resists exploitation.
OWASP Top Ten — Catalog of the most critical web application risks.

Advanced (17)

Elliptic Curve Cryptography — Public-key crypto with small keys based on curve math.
Zero-Knowledge Proofs — Proving a statement true without revealing why.
Homomorphic Encryption — Computing on encrypted data without decrypting.
Post-Quantum Cryptography — Algorithms resistant to quantum attacks.
Side-Channel Attacks — Extracting secrets from timing, power or cache behavior.
Return-Oriented Programming — Chaining existing code snippets to bypass non-executable memory.
ASLR and Stack Canaries — Mitigations randomizing layout and detecting stack corruption.
Sandboxing — Confining code to limit what it can affect.
Trusted Execution Environments — Hardware-isolated enclaves protecting code and data.
Reverse Engineering — Analyzing binaries to understand their behavior.
Digital Forensics — Collecting and analyzing evidence from digital systems.
Threat Modeling — Systematically identifying and prioritizing threats.
Zero Trust Architecture — Never trusting any request implicitly regardless of location.
Secure Multi-Party Computation — Jointly computing results while keeping inputs private.
Supply Chain Security — Protecting the dependencies and tooling software relies on.
Cryptographic Protocol Design — Combining primitives into secure communication protocols.
Differential Privacy — Adding noise so aggregate results hide individuals.

How to study Security & Cryptography

Learn each attack by reading how it works and then by reproducing it on a practice system you own, such as a deliberately vulnerable training app. Then write the fix and confirm that the attack no longer works. Only test systems you have permission to test.

Frequently asked questions

Should I write my own encryption?

No. Use vetted libraries and standard protocols such as TLS and AES-GCM. Custom cryptography is very easy to get subtly wrong.

What is the difference between encryption and hashing?

Encryption is reversible with the right key, so it protects data in transit or at rest. Hashing is one-way and is used to verify data or store passwords.

How should passwords be stored?

Store only a salted hash produced by a slow, purpose-built algorithm such as bcrypt, scrypt or Argon2. Never store passwords in plain text.

Is security something I can add at the end of a project?

Not reliably. Security depends on design choices such as authentication, input handling and secret storage. Adding it late usually means rewriting those parts.

Should I roll my own encryption?

No. Use well-reviewed libraries and standard protocols. Subtle mistakes in home-made cryptography are easy to make and hard to notice.

Open the interactive Security & Cryptography area Take the Security & Cryptography quiz