Course
Applied Cryptography for Engineers
Hash, encrypt, sign, and manage keys like a builder — the primitives production systems actually use, and the misuse patterns that quietly break them.
Hashing, Integrity, and Password Storage
What hash functions guarantee, how to store passwords safely, and how to authenticate messages with HMAC.
- 01Choosing a Hash Function: SHA-256, BLAKE2, and the MD5 TrapWhat collision resistance actually means, which hashes to use today, and why MD5 keeps showing up where it shouldn't.18mOpen
- 02Password Hashing Done Right: Argon2id, bcrypt, and the Cost DialWhy fast hashes fail for passwords, how to tune Argon2id, and the storage format that makes verification safe.25mOpen
- 03HMAC and the Length-Extension AttackWhy `H(secret || m)` is forgeable, how HMAC fixes it, and the constant-time verify every webhook needs.22mMembers
Symmetric Encryption and Key Exchange
AEAD ciphers, nonces, and how two endpoints agree on a shared secret over a hostile network.
- 01Authenticated Encryption: AES-GCM and ChaCha20-Poly1305Encryption without integrity is forgeable — AEAD fixes it, and AAD binds ciphertext to context.30mMembers
- 02Nonce Reuse and the Ways AEAD Dies in ProductionThe forbidden attack: why one reused nonce in GCM leaks plaintext and forges tags — and the schemes that resist it.25mMembers
- 03Key Exchange: X25519 and Building a Secure ChannelHow two strangers agree on a shared secret, why ephemeral keys buy forward secrecy, and where MITMs live.28mMembers
Signatures, Key Management, and Real-World Failures
Verifying artifacts with signatures, keeping keys safe in production, and the classic mistakes.
- 01Digital Signatures: Ed25519 and Verifying ArtifactsSigning releases so anyone can verify them — Ed25519, supply-chain tooling, and the ECDSA nonce bug.30mPremium
- 02Key Management: Envelope Encryption, KMS, and RotationThe hard part isn't the math — it's where keys live. Envelope encryption and rotation without downtime.32mPremium
- 03The Misuse Patterns That Break Real SystemsECB penguins, timing leaks, `rand()` as a CSPRNG — the failure catalog and the audit questions that catch it.28mPremium