yuval.guide — Guides and hands-on courses on DevOps, cloud, Linux, Python, Kubernetes, networking and AI.

A hash function turns a file of any size into a short digest, and the commands that compute one are already on every Linux machine. This post runs the hashing scenes of the Security Primitives tool by hand: hashing a real document, a few thousand words long; changing one bit of it, and counting how much of the digest …

AES encrypts with one key that both ends hold: the same 32 bytes lock and unlock. This post runs the shared-key scene of the Security Primitives tool with openssl enc: making the key and the IV, and passing both by hand; encrypting a message and a document, and decrypting them; decrypting with a wrong key; changing a …

A key pair is two numbers tied by a mathematical relation: what one half does, only the other undoes. This post makes Bob's key pair from the Security Primitives tool with openssl: making the private key; looking at the numbers inside it, and checking their relation; computing the public half from it; naming a public …

Anyone holding Bob's public key can encrypt to him, and only his private key decrypts. No secret has to travel first. This post runs the public-key scene of the Security Primitives tool with openssl pkeyutl: encrypting a message to bob.pub and decrypting it with bob.key; trying the public key on the ciphertext, as Eve …

A signature runs the key pair the other way from encryption: the private half makes it, the public half checks it. This post runs the signature scene of the Security Primitives tool with openssl, one step per command: hashing the message; signing the digest with Bob's private key; reading the digest back out of the …

An HMAC (hash-based message authentication code) is a hash mixed with a shared key: anyone can hash a message, and only a holder of the key can compute its tag. This post runs the HMAC scene of the Security Primitives tool with openssl, and the tags are the ones the tool shows: what the name means, and where HMAC is …

In a key agreement each end sends a public key share, combines its own private half with the other's public half, and both arrive at the same secret. No key crosses the wire. This post runs the last three scenes of the Security Primitives tool with openssl: how key agreement differs from sending the key wrapped; Alice …

Every secure protocol is a combination of a few primitives: TLS, SSH, a signed JWT and a Git commit all use the same handful. The tool plays them one at a time, with no protocol around them. Each primitive answers an attack the one before it could not stop. The names Alice, Bob, Eve and Mallory Cryptography writes …

The tools that secure protocols are built from, shown with no protocol around them. Where they are used for the web, see Web Security on the networking page . Interactive views Security Primitives — a hash, a shared key, a key pair, a signature, an HMAC and a Diffie-Hellman key agreement, played by Alice and Bob on a …

A bearer token replaces the session's record with a signature. curl sends the password once, to /login, inside TLS. The server answers with a token: the claims (who, which role, until when, for which services), signed with the server's private key. curl sends the token with every request, as Authorization: Bearer …