Part I, Foundations · Lesson 1
What cryptography actually does
The short version
Cryptography is a set of tricks for sending messages so that only the right person can read them, nobody can secretly change them, and you know who really sent them. Each trick depends on a secret number called a key. Quantum computers threaten some of these tricks, but not all of them.
You'll learn to
- Name the three jobs cryptography does: confidentiality, integrity and authenticity.
- Explain what a key is and why longer keys are harder to guess.
- Describe what a hash function does, and see the avalanche effect with real SHA-256.
- Sort everyday cryptography into the parts quantum computers threaten and the parts they mostly don't.
Every time you see a padlock in your browser, send a message in a chat app or unlock your phone, cryptography is quietly doing several jobs at once. Most people think of it as "scrambling data." That's one job out of three, and the other two matter just as much.
This lesson gives you the map for the whole course. By the end you'll know the handful of building blocks almost all digital security is made from, and which of them a quantum computer would actually damage.
The three jobs
Think about sending a sealed letter through the post. You want three things from it:
- Confidentiality: only the intended reader can read it. Nobody who intercepts it learns what it says.
- Integrity: nobody changed it on the way. If someone edits "pay $100" into "pay $900," you notice.
- Authenticity: it really came from who it claims to come from, not an impostor.
Cryptography provides each of these with a different tool. Encryption gives confidentiality. Hash functions help with integrity. Digital signatures give authenticity (and integrity too). A secure connection, like the one to your bank, uses all of them together.
Keys: the secret ingredient
A key is a secret number that controls a cryptographic algorithm. Good cryptography assumes the attacker knows exactly how the algorithm works. The design is published, studied and attacked by experts for years. The only thing the attacker doesn't have is the key.
That's a feature, not a bug. A lock whose security depends on nobody knowing how locks work is a bad lock. A lock that stays secure even when the blueprints are public is a good one.
Keys are measured in bits. Each extra bit doubles the number of possible keys. A 128-bit key has 2128 possibilities, about 3.4 × 1038. Trying them all one by one, even with every computer on Earth, is not a realistic plan. This "try every key" attack is called brute force, and making it hopeless is the first goal of choosing a key size.
Encryption with a shared key
The oldest kind of encryption uses one key for both locking and unlocking. This is symmetric encryption: the sender and receiver hold the same secret key.
The workhorse today is AES, the Advanced Encryption Standard, which the US National Institute of Standards and Technology (NIST) published in 2001 as FIPS 197. AES is fast and trusted for everything from disk encryption to video calls. It comes with 128-, 192- or 256-bit keys.
Symmetric encryption has one awkward problem: both sides need the same key before they can talk securely. If you and a website have never met, how do you agree on a secret key while everyone on the network is listening? Hold that thought. Solving it is the subject of the next lesson, and it's exactly the part quantum computers threaten.
Hash functions: digital fingerprints
A hash function takes any input, a word or a whole movie, and produces a short fixed-size output called a hash or digest. SHA-256, standardized by NIST in FIPS 180-4, always produces 256 bits, usually written as 64 hexadecimal characters.
A good cryptographic hash behaves like a fingerprint:
- Same input, same output. Every time, on every computer.
- One-way. Given a hash, you can't work backwards to the input, short of guessing inputs and checking.
- Collision-resistant. It's infeasible to find two different inputs with the same hash.
- Avalanche effect. Change one character of the input and about half of the output bits flip, with no visible pattern.
That last property is easier to see than to describe. The widget below runs real SHA-256 in your browser. Compare "Pay Alice $100" with "Pay Alice $900," then try your own.
Notice what doesn't happen: the hashes of two nearly identical messages are not nearly identical. There's no "warmer, colder" signal for an attacker to follow. That's why hashes are used to detect tampering. If a file's hash matches the one the publisher listed, the file hasn't changed.
Hashes have no key, so a hash alone doesn't prove who made something. An attacker who swaps a file can also swap the hash next to it. Proving origin is a job for signatures.
Digital signatures: a wax seal that can't be copied
A digital signature is the electronic version of a wax seal, except it can't be lifted off one letter and pressed onto another. The signer uses a private key that only they hold. Anyone can check the signature with the matching public key.
A signature is tied to the exact content signed. Change one bit of the document and the signature no longer verifies. So a signature gives authenticity (it came from the key holder) and integrity (it hasn't changed) at once.
Signatures are everywhere, usually out of sight. Your phone checks a signature before installing a software update. Your browser checks signatures on a website's certificate to confirm it's really talking to your bank. We'll see how signatures work in the next lesson.
Putting it together: what happens behind the padlock
When your browser connects to a website over HTTPS, it runs a protocol called TLS. In simplified form, it does four things:
- Key exchange. Browser and server agree on a fresh shared secret key, even though anyone could be listening. This uses public-key cryptography.
- Authentication. The server proves who it is with a certificate, which is a signed statement binding the site's name to its public key.
- Encryption. All the actual data flows under fast symmetric encryption, such as AES, using the shared key.
- Integrity checks. Every chunk of data carries a check value so tampering is detected.
Public-key cryptography does the clever setup. Symmetric cryptography does the heavy lifting. Keep that split in mind, because quantum computers affect the two very differently.
Where quantum computers come in
Here's the preview of the rest of the course in one table. It's a simplification, and later lessons fill in the details.
| Building block | Examples | Large quantum computer |
|---|---|---|
| Public-key key exchange and signatures | RSA, Diffie-Hellman, elliptic curves (ECDH, ECDSA, Ed25519) | Broken by Shor's algorithm |
| Symmetric encryption | AES | Weakened somewhat by Grover's algorithm; still considered fine at standard key sizes |
| Hash functions | SHA-256, SHA-384 | Weakened somewhat; still considered fine |
The broken row is the one that matters. Public-key cryptography is the part that lets strangers set up secure connections, and today's versions all rest on two math problems that a large quantum computer could solve. The fix isn't to stop using cryptography. It's to replace those public-key algorithms with new ones designed to resist quantum attack, which NIST standardized in 2024.
What to remember
Cryptography isn't one thing. It's a toolkit: keys, symmetric encryption, hashes and signatures, combined into protocols like TLS. Quantum computers don't break the whole toolkit. They break one drawer of it, the public-key drawer, which happens to be the one that makes the internet work between strangers. The next lesson opens that drawer.
Summary
- Cryptography does three jobs: confidentiality, integrity and authenticity.
- Algorithms are public; security rests on keeping the key secret, and each extra key bit doubles the attacker's work.
- Symmetric encryption (AES) is fast but needs a shared key; public-key cryptography solves how to agree on one.
- Hashes like SHA-256 are fingerprints: one character changed flips about half the output bits.
- Signatures prove who made something and that it hasn't changed.
- Quantum computers break today's public-key algorithms; symmetric encryption and hashes are only modestly weakened.
Questions
Get five of six right to mark the lesson complete. They also feed the final exam.
Sources
- NIST FIPS 197: Advanced Encryption Standard (AES)
- NIST FIPS 180-4: Secure Hash Standard (SHA-256 and family)
- NIST Post-Quantum Cryptography project
- NIST PQC FAQs (on AES and Grover's algorithm)
