Category
11 articles in this category.
IPsec protects IP traffic with ESP, and IKEv2 negotiates the keys. Learn the SKEYSEED key derivation, pre-shared-key authentication, and AES-GCM, with Python code checked against 280 of NIST's own known-answer test vectors.
26 min read
OTR brings deniable, forward-secret encryption to instant messaging, with a SIGMA-style key exchange, DSA signatures, and the Socialist Millionaires' Protocol. Learn the full version 3 wire format, with Python code checked against NIST's own DSA test vectors.
27 min read
Kerberos is a ticket-based authentication protocol from the 1980s that still runs most corporate networks. Learn the AS, TGS, and AP exchanges, the DER message format, and the AES encryption types of RFC 3962 and RFC 8009, with Python code that reproduces the MIT reference encodings and runs a full login.
40 min read
Noise is a framework for building secure channels from Diffie-Hellman exchanges. A protocol is a short pattern of tokens and a name. Learn the three state objects, the 38 handshake patterns, pre-shared keys, and the security properties, with a Python engine that reproduces 1,352 official test vectors.
34 min read
OPAQUE is a password-authenticated key exchange that gives a server nothing to steal: not the password, not a dictionary-attackable verifier. Learn the oblivious pseudorandom function at its core, the envelope that hides a client's key pair, and the 3DH handshake, with Python code that reproduces the official RFC 9807 test vectors.
30 min read
SRP is a password-authenticated key exchange. The server stores only a verifier, the password never crosses the network, and an eavesdropper cannot test guesses. Learn the SRP-6 mathematics of RFC 5054, the proofs of RFC 2945, and the checks that decide its security.
22 min read
SSH secures remote logins with a binary packet protocol, a curve25519-sha256 key exchange, and an Ed25519 host key. Learn the handshake and the chacha20-poly1305@openssh.com cipher, with Python code that reproduces the IETF draft's own worked example byte for byte.
29 min read
WireGuard is a VPN protocol built on the Noise IKpsk2 handshake. Learn the two handshake messages, the cookie mechanism against denial of service, the replay window, and the timers, with Python code that reproduces an official test vector and the Linux kernel self-test.
37 min read
Understanding TLS: The Backbone of Secure Internet Communication
22 min read
The Signal Protocol is a modern, open-source cryptographic protocol that provides end-to-end encryption for voice calls, video calls, and instant messaging conversations.
12 min read
Understanding Pretty Good Privacy: Hybrid Encryption for Secure Messaging and Data
11 min read
