---
{
  "title": "Cryptography",
  "summary": "Understand encryption, hashing, and digital signatures through a software-update example, with clear guidance on keys and trust.",
  "topic": "foundations",
  "level": "Beginner",
  "updated": "2026-10-12",
  "units": [
    5
  ],
  "aliases": [],
  "sources": [
    {
      "title": "NIST: Cryptographic Standards and Guidelines",
      "url": "https://csrc.nist.gov/projects/cryptographic-standards-and-guidelines"
    },
    {
      "title": "NIST: Cryptography",
      "url": "https://www.nist.gov/cryptography"
    }
  ],
  "published": "2026-10-02",
  "editorialVersion": 2
}
---

## Start with the security question

Cryptography uses mathematical algorithms and keys to help protect information. Different tools address different goals. Encryption can protect confidentiality. Cryptographic hashes help compare data without comparing every byte directly. Digital signatures allow verification of a signature under a public key and help detect changes to signed information.

These mechanisms are related, but they are not interchangeable. Before choosing an algorithm, describe the problem: must an unauthorized reader be unable to understand a stored file, must a downloader detect a changed file, or must a device verify who signed a software update? A clear question makes the choice easier.

## Three jobs in one software update

Imagine a fictional application delivering an update. Transport encryption protects the connection between the download service and the device. A published checksum may help the device detect accidental corruption. A verified digital signature can establish that the update was signed by a key the device trusts and that the signed content has not changed.

The checksum alone does not establish the publisher's identity. If an attacker can replace both the download and its checksum on the same compromised page, the two will agree. The signature's usefulness also depends on how the device acquired the trusted verification key and whether the signing key remains protected.

![Encryption, hashing, and digital signatures address different questions about information.](/diagrams/cryptography.svg)

## Keys connect mathematics to operations

[[symmetric-encryption]] uses a shared secret key for the relevant encryption and decryption operations. [[asymmetric-encryption]] involves a public and private key pair. Real protocols often combine several mechanisms rather than choosing one family for every job.

The algorithm can be public; the required secret material must remain protected. Operational questions quickly become central: Who can retrieve the key? Where is it stored? How is access recorded? What happens when an employee leaves or a key may have leaked? [[key-management]] explains those responsibilities.

Consider an encrypted archive stored beside a text file containing its decryption key. The encryption may be mathematically sound, yet someone who can read both files can recover the contents. This illustrates a system design problem rather than a failure of encryption itself.

## Encoding is a different operation

Base64 represents bytes as text so they can travel through systems expecting textual data. It requires no secret. Reversing that representation is routine decoding, not breaking encryption. A value that looks unreadable to a person is not necessarily protected.

[[hashing]] is also different from reversible encryption. A plain hash is not a general-purpose way to keep a short, predictable secret confidential. Password storage requires a design intended for passwords, including appropriate salts and a suitable password hashing scheme. Avoid treating every function that produces scrambled-looking output as the same tool.

## How to learn safely

For a first exercise, compute a file's hash, edit one character, and compute it again. Observe the result, then ask where the expected hash would need to come from for the comparison to be trustworthy. This builds a useful distinction between detecting a difference and proving an origin.

For production software, use maintained cryptographic libraries and established protocols appropriate to the requirement. Inventing a custom combination can introduce weaknesses that are hard to recognize in ordinary testing. Continue with [[symmetric-encryption]], [[hashing]], and [[key-management]] to understand the parts separately.