Lesson 5: Cryptography and PKI

Cryptography transforms data to protect it. Symmetric encryption uses the same secret key for encryption and decryption (for example, AES is a common symmetric cipher), while asymmetric encryption uses a public/private key pair (for example, RSA). Hash functions (like SHA-256) produce a fixed-size digest of data, used for integrity checks (they are one-way; you can't reverse the hash). For example, passwords are often stored as hashes so the actual password is not kept in the system. In practice, symmetric ciphers are fast for encrypting large data, while asymmetric algorithms are used for secure key exchange or digital signatures. Understanding both types and their purposes is essential for secure system design.

A Public Key Infrastructure (PKI) manages keys and digital certificates to bind identities with public keys. Certificates are digital documents issued by Certificate Authorities (CAs) that vouch for a public key belonging to a specific entity. For instance, an SSL/TLS certificate proves that a website is legitimate. PKI involves a chain of trust: a root CA issues certificates to intermediate CAs, which in turn issue certificates to end entities. A key concept is certificate revocation, which invalidates a certificate if its key is compromised. It's important to know how CAs verify identities and how web browsers check certificates during HTTPS connections.