Tutorial 1: Encryption, Hashing, and MACs

Unit 2 · Cryptography and key management

Objectives

Distinguish encryption, hashing, and message authentication.
Select primitives for confidentiality, integrity, and authenticity.
Explain why passwords require slow salted password hashing.

Encryption is reversible with a key and protects confidentiality. Hashing is designed to be one-way and supports fingerprints, but a plain hash is not proof of origin. A message authentication code (MAC) uses a shared secret to provide integrity and authenticity to parties that share that secret.

ciphertext = Encrypt(key, plaintext)
digest = Hash(file)
tag = MAC(sharedSecret, message)
passwordRecord = SlowHash(password, uniqueSalt)

Use reviewed libraries and authenticated encryption modes such as AES-GCM or ChaCha20-Poly1305. Do not invent algorithms or reuse nonces. Password storage needs a memory- or CPU-hard password hashing function, unique salts, rate limiting, and recovery controls.

Exercises

Choose encryption, hashing, or MAC for four security requirements.
Explain why a public hash cannot authenticate an API response.
List the fields needed to verify authenticated encryption.

Self-check

Which primitive is reversible?
What does a salt prevent?
What does a MAC key provide?

Self-Check Quiz

1. What does authenticated encryption provide?

Answer

Confidentiality plus integrity and authenticity for the ciphertext and associated data.

2. Should passwords be encrypted for storage?

Answer

Normally no. Store a salted, slow password-hash verification record rather than a reversible password.

Homework

Design credential storage for an enterprise portal.
Specify an authenticated-encryption envelope for a stored document.
Explain nonce uniqueness and password-rate limiting.

Sample answer

A sound design uses a password-hashing function with a unique random salt and tuned cost, plus MFA and rate limits. Documents use authenticated encryption with a unique nonce, stored key identifier, ciphertext, and authentication tag. Keys are protected separately from data.