Tales from the Crypt: A Cryptography Primer

on YouTube ↗52m

" summary

Explains concrete rules and tradeoffs: prefer RSA 2048 minimum (4096 if possible) with OAEP padding and use AES for bulk data, never do not use ECB mode, prefer CBC or GCM where appropriate. Generate keys and salts from a cryptographically secure RNG such as /dev/random or OpenSSL. Hash passwords with a KDF (Argon2i recommended, bcrypt or PBKDF2 acceptable), tune memory/threads and aim for ~0.5s per login, salt everything, and use hybrid RSA+AES when payloads exceed key size.

AI-written summary · about

" chapters (14)

1. 0:00Intro
2. 1:52What To Expect 0 • Gain a working understanding of common terms used in cryptography. Understand the key drivers for choosing cryptography methodologies, algorithms and strengths. Know which PHP modules to use.
3. 6:40How Secret is Secret? Asymmetric Encryption is more secret than Symmetric Encryption. No shared secrets. How predictable is your secret? Who has access to your secrets? Secrets encrypted at rest? Those secrets? Are your secrets encrypted in transit?
4. 8:15Computational Cost Complexity of algorithm increases cost. • Key length increases cost. Some algorithms specifically target memory and thread utilization to increase cost. Feedback loops increase cost.
5. 11:47Achieving Maximum Entropy • Use Cryptographically Secure Pseudo-Random Number Generators (CSPANG). Salts add global randomness to hashing. Feedback loops add local randomness to block ciphers. • Initialization Vectors add global randomness to block ciphers. Some ciphers introduce randomness with padding
6. 17:01Symmetric Key Cryptography uses shared secrets Asymmetric Key Cryptography uses private/ public key pairs
7. 20:15Symmetric Key Cryptography Shared secrets • Lower computation costs than most asymmetric algorithms for same key size Uses algorithms against blocks or streams of data Most implementations will use block as stream ciphers use less resources making them less secure
8. 26:26(HMAC) Hashing combined with key SHA-256 or better is preferred to ensure uniqueness
9. 29:11Asymmetric Key Cryptography RSA and DSA are available in PHP. Use RSA Uses very large prime integers Very computationally expensive • Uses key pairs to protect secret
10. 35:06length of the key size Signatures use hashing Crypto often mixed with symmetric key cryptography
11. 36:24Padding is how RSA creates additional entropy • Use Optimal Asymmetric Encryption Padding (OAEP) Do not use PKCS1-V1_5 as it is no longer considered cryptographically secure
12. 38:01Always use Key Derivation Functions like bcrypt and PBKDF2 If you are currently using MD5 or SHA for hashing, use a random salted with your hash now and a key derivation function soon.
13. 42:00argon2i is the new hotness scrypt is preferred bcrypt is acceptable
14. 45:36Disclaimers 0 Although every app is different, commonalities exist across most applications I am only recommending what I know and have vetted directly or indirectly via my work experience If you think you are different, ask yourself if the advantages outweigh the risks

" related talks

• 47mPractical Security FoundationsOren Eini · Build Stuff 2022
• 28mModern CryptographyJohn Downey · GoGaRuCo 2012
• 46mCryptography For BeginnersAdam Englander · Dutch PHP Conference 2018
• 01h 04m Cryptography For Newcomers - The hitchhiker's guide to cipher in devs Matthias Dugué · PiterPy 2019
• 51mDon’t Throw Away the Key: What Developers Should Know about EncryptionLiz Moy · NDC TechTown 2023
• 52mUnlocking the unknowns: Cryptography Essentials for Spring DevelopersLaurentiu Spilca · Spring I/O 2025
• 55mCrypto for Developers: Making Sane ChoicesAdam Caudill · CodeMash 2018
• 36mModern Cryptography for the Absolute BeginnerJeffrey Cohen · RailsConf 2019