A hash function turns a file of any size into a short digest, and the commands that compute one are already on every Linux machine. This post runs the hashing scenes of the Security Primitives tool by hand: hashing a real document, a few thousand words long; changing one bit of it, and counting how much of the digest …

AES encrypts with one key that both ends hold: the same 32 bytes lock and unlock. This post runs the shared-key scene of the Security Primitives tool with openssl enc: making the key and the IV, and passing both by hand; encrypting a message and a document, and decrypting them; decrypting with a wrong key; changing a …

A key pair is two numbers tied by a mathematical relation: what one half does, only the other undoes. This post makes Bob's key pair from the Security Primitives tool with openssl: making the private key; looking at the numbers inside it, and checking their relation; computing the public half from it; naming a public …

Anyone holding Bob's public key can encrypt to him, and only his private key decrypts. No secret has to travel first. This post runs the public-key scene of the Security Primitives tool with openssl pkeyutl: encrypting a message to bob.pub and decrypting it with bob.key; trying the public key on the ciphertext, as Eve …

A signature runs the key pair the other way from encryption: the private half makes it, the public half checks it. This post runs the signature scene of the Security Primitives tool with openssl, one step per command: hashing the message; signing the digest with Bob's private key; reading the digest back out of the …

An HMAC (hash-based message authentication code) is a hash mixed with a shared key: anyone can hash a message, and only a holder of the key can compute its tag. This post runs the HMAC scene of the Security Primitives tool with openssl, and the tags are the ones the tool shows: what the name means, and where HMAC is …

In a key agreement each end sends a public key share, combines its own private half with the other's public half, and both arrive at the same secret. No key crosses the wire. This post runs the last three scenes of the Security Primitives tool with openssl: how key agreement differs from sending the key wrapped; Alice …

Every secure protocol is a combination of a few primitives: TLS, SSH, a signed JWT and a Git commit all use the same handful. The tool plays them one at a time, with no protocol around them. Each primitive answers an attack the one before it could not stop. The names Alice, Bob, Eve and Mallory Cryptography writes …