HackBlue

Tools · Workbench

Cryptography and passwords in practice

Tutorials on hashing versus encryption, password storage, TLS certificates, OpenSSL, GPG, SSH keys, password managers, and MFA.

  • 20 lessons
  • 3 h of reading
  • 4 topics
Start with lesson 1All workbenches

You do not need to invent cryptography to use it well. You need to know which primitive answers which question, how to check that a certificate or signature is what it claims, and which defaults are safe. These tutorials stay on those practical decisions.

Every command runs locally on files and keys you generate for the lesson.

Command-line tools

6 lessons

  1. 01OpenSSL command line for beginners: hashes, random bytes, keys, and encryptionLearn the OpenSSL subcommands you will use most: dgst for hashes, rand for random data, genpkey for keys, and enc for file encryption with a proper key derivation function.11 min
  2. 02Verifying file integrity with SHA-256 checksums on Linux, macOS, and WindowsCompute and verify SHA-256 checksums for downloads and evidence, use checksum files, and understand why a checksum from the same site is weaker than a signed one.8 min
  3. 03GnuPG tutorial: create keys, encrypt files for someone, and sign your ownGenerate a modern GPG key, export and import public keys, encrypt a file for a recipient, sign and verify files, and protect your key with a passphrase and revocation certificate.12 min
  4. 04How to verify a software download’s GPG signature, step by stepFind the publisher’s signing key, confirm its fingerprint from independent sources, verify a signed checksum file, and read GPG’s output correctly.9 min
  5. 05Encrypting files with age: a simple modern alternative to GPGUse age to generate keys, encrypt files for one or more recipients, use SSH keys as recipients, and understand when age is a better fit than GPG.8 min
  6. 06SSH certificates with ssh-keygen: a lab certificate authority for users and hostsReplace scattered authorized_keys files with short-lived SSH user certificates signed by a CA, restrict principals and validity, and configure servers to trust the CA.11 min

Certificates and TLS

3 lessons

  1. 01Reading an X.509 certificate with OpenSSL: subject, SAN, validity, key usage, and chainDecode a certificate field by field, find the Subject Alternative Names browsers actually check, verify dates and key usage, and compute fingerprints.10 min
  2. 02Troubleshooting TLS with openssl s_client: SNI, chains, protocols, and verification errorsConnect to a TLS server with s_client, show the full chain, test specific protocol versions, and interpret verify return codes to fix real certificate problems.10 min
  3. 03Auditing a server’s TLS configuration with testssl.shRun testssl.sh against your own server, read protocol, cipher, certificate, and header results, and fix the common findings with a modern nginx configuration.10 min

Crypto in code

6 lessons

  1. 01Storing passwords correctly in code: Argon2id and bcrypt with PythonHash and verify passwords with Argon2id or bcrypt, choose parameters, handle rehashing when parameters change, and avoid fast hashes and homemade schemes.10 min
  2. 02HMAC explained with Python: signing webhooks and API requests correctlyUse HMAC-SHA256 to prove a message came from someone holding a shared secret, verify webhook signatures in constant time, and include timestamps to stop replays.9 min
  3. 03AES-GCM authenticated encryption in Python: keys, nonces, and associated dataEncrypt and decrypt with AES-256-GCM using the cryptography library, understand why a nonce must never repeat with the same key, and use associated data to bind context.11 min
  4. 04Digital signatures with Ed25519: sign, verify, and publish a public keyCreate Ed25519 signatures in Python and with ssh-keygen, verify them, and understand what a signature proves and how to distribute the public key safely.9 min
  5. 05Secure random numbers: why Math.random and random.random are not for secretsGenerate tokens, keys, and passwords with a cryptographically secure random number generator in Python, JavaScript, and the shell, and recognize insecure generators in code reviews.8 min
  6. 06JSON Web Tokens explained: structure, signing algorithms, and validating them correctlyDecode a JWT’s header, payload, and signature, choose HS256, RS256, or EdDSA, and validate tokens with a library that pins algorithms and checks expiry, audience, and issuer.11 min

Concepts by experiment

5 lessons

  1. 01Why ECB mode is unsafe: seeing patterns leak through encrypted dataEncrypt the same data with ECB, CBC, and GCM, see repeated blocks survive ECB encryption, and learn which modes to choose and which to avoid.9 min
  2. 02RSA in practice: key sizes, OAEP for encryption, PSS for signaturesGenerate RSA keys, choose a safe size, encrypt small secrets with OAEP and sign with PSS, and understand why raw RSA and PKCS#1 v1.5 encryption are avoided in new designs.10 min
  3. 03Elliptic curve key exchange with X25519: how two parties agree on a keyRun an X25519 Diffie-Hellman exchange in Python, derive a symmetric key with HKDF, and see why authentication is still needed to stop a machine in the middle.10 min
  4. 04Encoding vs encryption vs hashing: telling base64, AES, and SHA-256 apartLearn the difference between reversible encoding, keyed encryption, and one-way hashing by recognizing their outputs and reversing what can be reversed on the command line.8 min
  5. 05Post-quantum cryptography for practitioners: ML-KEM, ML-DSA, and hybrid TLSUnderstand which algorithms quantum computers threaten, what NIST standardized in FIPS 203, 204, and 205, how hybrid key exchange works in TLS today, and how to start a crypto inventory.10 min