Chapter 1 — Cryptography and trust services: foundations and decisions
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 The case"]
N2["1.2 What cryptography protects"]
N3["1.3 Four kinds of transformation"]
N4["Lab — One letter changes the fingerprint"]
N5["1.4 The padlock and the certificate"]
N6["1.5 Simple safe decisions"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 The case"]
N2["1.2 What cryptography protects"]
N3["1.3 Four kinds of transformation"]
N4["Lab — One letter changes the fingerprint"]
N5["1.4 The padlock and the certificate"]
N6["1.5 Simple safe decisions"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 The case]
|
v
[1.2 What cryptography protects]
|
v
[1.3 Four kinds of transformation]
|
v
[Lab — One letter changes the fingerprint]
|
v
[1.4 The padlock and the certificate]
|
v
[1.5 Simple safe decisions]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) explain in plain words what cryptography protects; (2) tell encoding, hashing, encryption and signatures apart; (3) see what a padlock and a certificate do and do not promise; (4) make simple, safe decisions about cryptographic tools.
1.1 The case
Leo Fernandes has no security background. He signs up for a one-month introductory course and, as practice, helps the fictional Willow Lane Community Library, a small library with a public website, a members' e-book account system, two staff laptops, a public Wi-Fi network and an email newsletter. His guide is Inês Hartley, the volunteer who looks after the library's IT. Every person, place and number in this book is synthetic. Leo's goal is to understand the core risks well enough to explain them to the library team and to complete one guided task safely. He will use cryptography, never invent it.
1.2 What cryptography protects
Inês explains three promises. Confidentiality means only the right people can read something, such as a member's address. Integrity means changes are noticed, such as a website file altered by an intruder. Authenticity means you can tell who sent or published something, such as an email from the library. Cryptography delivers these promises with mathematics and keys, which are secret values. It does not stop someone guessing a weak password, clicking a fake link or leaving a laptop unlocked. Leo writes the three words on a card and asks of every tool which promise it keeps, because each tool keeps different promises.
1.3 Four kinds of transformation
Leo meets four things that look like scrambled text. Encoding, such as Base64, just changes how data is written; anyone can reverse it, so it hides nothing. Hashing, such as SHA-256, turns any data into a short fingerprint that cannot be turned back, and a tiny change gives a completely different fingerprint. Encryption, such as AES, hides data so only someone with the key can read it. A digital signature lets anyone check who signed something using a public key. The lab below shows the hash behaviour on synthetic text: one changed letter produces an unrelated fingerprint.
Lab — One letter changes the fingerprint
# SHA-256 fingerprints of synthetic text (FIPS 180-4 via hashlib).
import hashlib
a = "Willow Lane opening hours: 9-17"
b = "Willow Lane opening hours: 9-18"
ha, hb = hashlib.sha256(a.encode()).hexdigest(), hashlib.sha256(b.encode()).hexdigest()
print("A:", ha[:32] + "...")
print("B:", hb[:32] + "...")
print("match:", ha == hb)
Run with python3 lab_fingerprint.py. Verified output:
A: 7a5d91566f93af7abf7fc2c33d868004...
B: c029501271e71ec3fc765840b69dfabd...
match: False
1.4 The padlock and the certificate
When Leo opens the library website, the browser shows a padlock. Inês explains that it means the connection uses TLS, the protocol in RFC 8446, so people on the same Wi-Fi cannot read or change what passes between Leo and the site. The site proves its name with a certificate, defined in RFC 5280, issued by an authority the browser trusts. The padlock does not mean the site is honest, free of bugs or the one Leo meant to visit; a fake site with a similar name can have its own padlock. So Leo checks the address carefully, not just the padlock.
1.5 Simple safe decisions
Inês gives Leo four rules for decisions he can make himself. Use well-known tools and settings rather than home-made tricks. Never click through a browser certificate warning on a site that should be trusted; report it instead. Keep secrets such as passwords and keys out of emails, chats and shared documents. When unsure, ask before changing anything. Leo notices the rules are about behaviour, not mathematics. Most real problems at small organisations come from settings and habits, and a beginner who follows these rules already avoids the commonest mistakes made by people who know far more theory.
Worked example
Leo maps the library's website, e-book accounts and newsletter to the three promises, runs the fingerprint lab and explains to a staff member why the padlock alone is not enough.
Synthetic case. Willow Lane Community Library, Leo and Inês are invented; RFC 8446 and RFC 5280 are real.
Errors and limits
These are first approximations; real systems combine several mechanisms. A padlock on a fake site still looks like a padlock.
Exercises
- EX001 — Leo's goal. What is Leo trying to achieve in this course? Rubric: 3 = understand core risks, explain them and complete one guided task safely;; 2 = part;; 1 = design cryptography;; 0 = none.
- EX002 — Integrity in a library. Give a library example of integrity. Rubric: 3 = noticing that a website file was altered by an intruder;; 2 = example;; 1 = confidentiality example;; 0 = none.
- EX003 — Things cryptography cannot stop. Name two things cryptography cannot prevent. Rubric: 3 = weak password guessing, clicking fake links, unlocked laptops (two);; 2 = one;; 1 = says it prevents all;; 0 = none.
- EX004 — Base64 secrecy. Does Base64 hide a password? Explain. Rubric: 3 = no; it is encoding anyone can reverse without a key;; 2 = no;; 1 = yes;; 0 = none.
- EX005 — One-letter change. In the lab, what happened when one letter changed? Rubric: 3 = the SHA-256 fingerprint changed completely, match False;; 2 = changed;; 1 = same;; 0 = none.
- EX006 — Reversing a hash. Can a SHA-256 fingerprint be turned back into the original text? Rubric: 3 = no, hashing is one-way;; 2 = no;; 1 = yes;; 0 = none.
- EX007 — Who reads encrypted data. Who can read data encrypted with AES? Rubric: 3 = only someone holding the right key;; 2 = key holder;; 1 = anyone;; 0 = none.
- EX008 — Signature check. What does a digital signature let anyone check? Rubric: 3 = who signed it and that it was not changed, using a public key;; 2 = who signed;; 1 = hides content;; 0 = none.
- EX009 — Padlock promise. What does the browser padlock actually promise? Rubric: 3 = the connection is protected by TLS to the site named in the certificate;; 2 = TLS connection;; 1 = site is honest;; 0 = none.
- EX010 — Fake site padlock. Why can a fake library site still show a padlock? Rubric: 3 = it can get its own certificate for a look-alike name;; 2 = own certificate;; 1 = impossible;; 0 = none.
- EX011 — Certificate warning. What should Leo do if the library site shows a certificate warning? Rubric: 3 = not click through; report it;; 2 = report;; 1 = click through;; 0 = none.
- EX012 — Secrets in chat. Where should passwords and keys never be shared? Rubric: 3 = email, chat or shared documents;; 2 = one place;; 1 = anywhere fine;; 0 = none.
- EX013 — Rules focus. What do Inês's four rules mostly concern? Rubric: 3 = behaviour and settings rather than mathematics;; 2 = behaviour;; 1 = maths;; 0 = none.
Synthesis
Cryptography keeps promises of confidentiality, integrity and authenticity through keys, and beginners stay safe by matching tools to promises and following simple rules.