Applied Cryptographic Engineering
Visual explainers for the course. Each one runs in the browser: change the inputs, step through the algorithm or the attack, and see exactly where things go right or wrong.
Symmetric encryption
Why ECB leaks: block cipher modes
Real AES encrypts an image three ways. In ECB the picture survives encryption; in CBC and CTR it turns to noise.
AES-128 · ECB · CBC · CTROpen →Reusing a nonce cancels the key
Two messages under the same key and nonce share a keystream. XOR the ciphertexts and the key disappears; a guessed word reveals the rest.
C₁ ⊕ C₂ = P₁ ⊕ P₂Open →CBC padding oracle
A server that only says “bad padding” is enough to decrypt any message, byte by byte, without the key. This demo attacks real AES-CBC.
PKCS#7 · ≤ 256 queries per byteOpen →Authentication and passwords
A timing leak in a MAC check
An early-exit comparison takes longer the more leading bytes match. Measure it and recover a secret tag one character at a time.
memcmp · constant-time compareOpen →Storing passwords: salt and cost
Why identical passwords must not give identical hashes, and why a password hash should be slow on purpose.
SHA-256 · PBKDF2 · bcrypt · Argon2idOpen →Replay protection
Sequence numbers and sliding windows: why a valid MAC is not enough.
counter · window · nonceComing soonHMAC and length extension
Why H(key ‖ message) is not a MAC, and how HMAC fixes it.
SHA-256 · HMACComing soonDeriving keys with HKDF
One secret in, many independent keys out: extract, then expand.
RFC 5869 · salt · infoComing soonPublic keys and protocols
Forward secrecy
An eavesdropper records three sessions and steals the server key years later. With RSA key transport every session opens; with ephemeral Diffie–Hellman none does.
RSA key transport vs (EC)DHEOpen →Hybrid encryption with RSA-OAEP
Encrypt the data with AES, encrypt the AES key with RSA, and handle errors safely.
RSA-OAEP · DEK · AEADComing soonSigning software updates
Trust, version checks and what happens when the signing key leaks.
Ed25519 · rollbackComing soonValidating a certificate chain
Break one field at a time and watch which check fails.
X.509 · chain · revocationComing soonTLS 1.3 handshake and key schedule
Messages on the wire, and the HKDF tree that turns one shared secret into all traffic keys.
RFC 8446 · 1-RTT · 0-RTTComing soonOperations
Envelope encryption with KMS and HSM
Data keys, key-encryption keys and rotation without re-encrypting everything.
DEK · KEK · rotationComing soonPlanning the post-quantum migration
Hybrid key exchange, key and signature sizes, and a migration plan.
ML-KEM · ML-DSA · SLH-DSAComing soon