Unit 01 · 1 h 34 min
Encoding, hashing and encryption
Three different tools that look alike. Tell them apart on sight and stop calling base64 encryption.
Cryptography Basics
Hashes, keys, signatures and where they fail.
- Time
- 18 h 31 min
- Lessons
- 62
- Machine
- Ubuntu 24.04 LTS
- Builds on
- Linux Foundations
What you earn
RootCertificateCryptography Basics, certificate of completion CompTIASecurity+CompTIA Security+ ISC2CISSPCertified Information Systems Security Professional
Prepares you for CompTIA Security+ and Certified Information Systems Security Professional. Root is not affiliated with these issuers.
You will be able to
- Tell encoding, hashing and encryption apart on sight
- Verify releases and configs, and know what a signature cannot prove
- Audit password storage, password vaults and MFA
- Encrypt data at rest and in transit without classic mistakes
- Keep keys in a KMS, rotate them and read the audit trail
Units and lessons
Unit 02 · 1 h 55 min
Hashes and integrity
Use hashes to prove a file has not changed, from downloads to configs to signed webhooks.
Unit 03 · 1 h 49 min
Passwords done right
Why plain hashes fail for passwords, and how salts and slow functions like Argon2id fix it.
Unit 04 · 1 h 42 min
Symmetric encryption
One key locks and unlocks. Use AES properly: authenticated modes, unique nonces and keys kept out of code.
Unit 05 · 1 h 42 min
Public keys and key exchange
Two keys instead of one: share the public half, guard the private half, and agree secrets in the open.
Unit 06 · 1 h 52 min
Digital signatures
Prove who made a file and that nobody changed it, with OpenSSL, GnuPG and SSH keys.
- 1Sign an invoice, catch a forgery18 min · machine
- 2Verify a signed release with GnuPG20 min · machine
- 3Sign files with your SSH key16 min · machine
- 4Verify a whole folder14 min · machine
- 5Case file: signed, shipped and backdoored24 min · machine
- 6Case file: retired software on a build machine20 min · machine
Unit 07 · 2 h 3 min
Certificates and PKI
Read certificates, follow the chain to a trusted root, and catch expired, misnamed and forged ones.
- 1Read a certificate16 min · machine
- 2Follow the chain to the root18 min · machine
- 3Catch expiry before it catches you15 min · machine
- 4Right certificate, wrong name14 min · machine
- 5Watch a TLS handshake20 min · machine
- 6Case file: the certificate inside the box18 min · machine
- 7Case file: the sensor that went quiet22 min · machine
Unit 08 · 1 h 36 min
Key management: where keys live
Find keys in code, build a key inventory, use a KMS that never hands out its keys, rotate and read the audit log.
Unit 09 · 1 h 16 min
Password managers, MFA and passkeys
Look inside a stolen vault backup, measure what the master password setting buys, and see why passkeys stop phishing and synced codes do not.
Unit 10 · 1 h 14 min
Encryption at rest: laptops, phones and backups
Audit disk encryption across macOS, Windows, Linux and phones, catch suspended protection, and encrypt backups before they leave.
Unit 11 · 1 h 48 min
Crypto in practice: the review
Put it all together: audit a TLS config and real code, fix randomness, and plan the move to post-quantum crypto.
Use OpenSSL, GnuPG, SSH and a key management service on a real machine to verify releases, store passwords, manage keys and check certificates. Case files from real breaches show what each mistake costs.