Cryptography

What the maths guarantees, and the far longer list of what it does not.

25 sketches

• HSMsIt cannot be copied. It can be asked
• Certificate authoritiesAny of them can say yes
• Certificate expiryToo short to do by hand
• Crypto agilityHow fast could you swap it?
• Cryptographic trustEverything hangs from a list
• Digital signaturesIt proves a key, not a promise
• EncryptionIt all turns on the handle
• Encryption at restIt answers theft, not access
• Encryption in transitThree states, one still bare
• Forward secrecyYesterday's key no longer exists
• HashingThe mark, not the message
• Key managementThe maths is not the weak link
• Key rotationTurn it before you need to
• Nonce reuseTwice with the same key
• Password hashingCost per guess
• PeppersThe half that is not in the database
• Post-quantum cryptographyCaptured today, opened later
• Public-key cryptographyOne half in public
• RandomnessIf it can be guessed, it is not random
• SaltsSame password, different stored value
• Digital signatures provide integrity, not secrecyA wax seal on a postcard
• Key rotation cannot undo past disclosureThe new key starts today
• Envelope encryption separates data keys from master keysThe master stays behind the wall
• Crypto agility starts with inventoryYou cannot swap what you have not found
• Encoding is not encryptionThe chart is on the wall