Introduction
Security is not just a buzzword, but a fundamental need for any modern application. Developers work daily with data that must be protected from interception, tampering, and unauthorized access. Cryptography is not magic, but a set of rigorous mathematical tools that ensure confidentiality, integrity, and authentication. In this article, we will break down three key components of practical cryptography: TLS/SSL, JWT, and encryption algorithms (AES, RSA, hashing). You will learn how they work, where they are applied, and what mistakes even experienced programmers make.
What Lies Behind the Acronym TLS/SSL
The TLS (Transport Layer Security) protocol is the foundation of secure communication on the internet. When you see HTTPS in the address bar, it means the connection is protected by TLS. Its predecessor SSL (Secure Sockets Layer) is now obsolete, but the name is often used interchangeably.
How TLS Works
- Handshake: The client and server exchange greeting messages, agree on the protocol version and cipher suite.
- Authentication: The server provides a digital certificate (X.509) signed by a certificate authority (CA). The client verifies its authenticity.
- Key Exchange: Asymmetric encryption (e.g., RSA or ECDHE) is used to securely transmit a session key.
- Symmetric Encryption: All subsequent data is encrypted using fast algorithms like AES with the session key.
Important for developers: Never disable certificate verification in production. Even if you work with internal services, use self-signed certificates, but do not ignore errors. This is a common vulnerability leading to man-in-the-middle (MITM) attacks.
JSON Web Tokens (JWT) — Stateless Authentication
JWT is a compact, URL-safe way to transmit claims between parties. It is widely used for authentication and information exchange in REST APIs.
JWT Structure
The token consists of three parts separated by dots:
- Header: Token type and signing algorithm (e.g., HS256 or RS256).
- Payload: Data (claims) such as user_id, role, expiration (exp).
- Signature: A signature created from the header and payload using a secret key (for HMAC) or private key (for RSA).
Signature Types
| Algorithm | Type | Keys | Example Use Case |
|---|---|---|---|
| HS256 | Symmetric | One secret key | Internal microservices where the key can be securely stored |
| RS256 | Asymmetric | Pair: private (sign) and public (verify) | OpenID Connect, third-party applications |
Mistakes to avoid:
- Do not store sensitive data in the payload (passwords, card numbers). JWT is signed but not encrypted — the payload is readable in Base64.
- Always check expiration (exp) and issuer (iss).
- Use a short token lifetime (15–30 minutes) combined with refresh tokens.
Symmetric and Asymmetric Encryption: AES and RSA
AES (Advanced Encryption Standard)
AES is a symmetric block cipher. It uses the same key for encryption and decryption. Today, it is the de facto standard for protecting data at rest (e.g., database encryption) and in transit (within VPN or TLS).
Modes of Operation:
- GCM (Galois/Counter Mode): Provides encryption and authentication (integrity). Recommended for most modern applications.
- CBC (Cipher Block Chaining): Requires a separate MAC for integrity verification, vulnerable to padding oracle attacks.
Example in Python (using the cryptography library):
from cryptography.fernet import Fernet
key = Fernet.generate_key()
cipher = Fernet(key)
encrypted = cipher.encrypt(b"Secret data")
print(cipher.decrypt(encrypted))
RSA (Rivest–Shamir–Adleman)
RSA is an asymmetric algorithm where encryption is performed with a public key, and decryption
Comments