Lesson 6 — Intermediate

Cryptography Basics (Symmetric, Asymmetric, Hashing)

Cryptography ka matlab hai data ko isi tarah badalna ki bina sahi key ke padhna mushkil ho. Is lesson mein hum symmetric aur asymmetric encryption, hashing, aur digital signatures samjhenge — HTTPS se UPI tak har secure system inhi par chalta hai.

Cryptography kya hai

Purani history: Caesar cipher (alphabet shift) se lekar aaj ke AES/RSA tak — maqsad same tha, method tez ho gaya. Aaj ka crypto itna strong hai ki supercomputer bhi bina key ke centuries lagayega.

Symmetric vs Asymmetric encryption

SYMMETRIC (shared key)
  Ek hi key encrypt + decrypt dono karti hai
  Fast — large data ke liye ideal
  Algorithms : AES (aaj standard), 3DES, ChaCha20
  Problem    : key doosre ko deni kaise? (exchange mein risk)

ASYMMETRIC (public + private key)
  Public key encrypt karti, private key decrypt (aur ulta)
  Slow — key exchange + signatures ke liye
  Algorithms : RSA, ECC, Diffie-Hellman (key exchange)
  Faida      : private key kabhi share nahi karni padti

REAL WORLD (HTTPS) :
  1. Asymmetric se symmetric key safely exchange
  2. Phir symmetric se poora data (speed chahiye)
  Dono ka mix = practical crypto

Hashing — one-way function

Hashing : input -> fixed-size digest (one-way)
  Chhota sa input badlo -> digest pura badal jaata hai
  Reverse karna practically impossible

Algorithms:
  MD5 / SHA-1  : ab broken — sirf checksum ke liye
  SHA-256/SHA-3 : aaj standard (integrity)
  bcrypt/PBKDF2/Argon2 : passwords ke liye specifically

Use cases:
  Passwords : hash + salt karke store (plain text kabhi nahi)
  Integrity : file ka hash compare -> badla toh pata chal jaayega
  Signatures: pehle hash banao, phir sign karo (fast)
  Blockchain: har block ka hash (chain)

Digital signature aur PKI

Digital signature do cheezein deta hai: Integrity (file badli nahi) aur Non-repudiation (bada mana nahi sakta ki maine sign nahi kiya). Paper signature ka crypto version:

Signature flow (concept):
1. Sender file ka HASH banata hai
2. Hash ko apni PRIVATE key se encrypt = signature
3. File + signature bhejta hai
4. Receiver PUBLIC key se signature khol ke hash nikaalta hai
5. File se apna hash banake compare
6. Match = file intact + sender verify

PKI (Public Key Infrastructure):
  CA (Certificate Authority) -> public key ko identity se jodta hai
  SSL/TLS certificate -> browser ko guarantee ki site wahi hai
  Chain of trust : root CA -> intermediate -> website

• WhatsApp end-to-end: keys devices pe hain — Meta bhi padh nahi sakta (asymmetric exchange + symmetric session).
• Aadhaar/DSC signing: certificates se identity verify hoti hai (jaise MCA filings mein DSC).
• Password storage: server pe bcrypt/Argon2 + salt — DB leak ho toh bhi passwords nahi milte.
• File integrity: download ke baad SHA-256 check — original hai toh match.

Exercise

Common mistakes

• Hashing ko encryption samajhna: Encryption key se reversible hai, hashing one-way hai. Password ke liye hashing isi liye — decrypt karke wapas nahi milega.
• Asymmetric ko fast samajhna: Asymmetric slow hai, symmetric fast. Real systems dono use karte hain — asymmetric for keys/signing, symmetric for bulk data.
• MD5/SHA-1 ko secure password hash soch lena: MD5/SHA-1 toot chuke hain. Passwords ke liye bcrypt/Argon2, integrity ke liye SHA-256 — ye sahi answer hain.

Signing  : document hash + tumhari private key = signature
Verify   : public key + hash se check = sahi hai
Ek line  : private = tumhara pen, public = sabko pen pehchante hain
Ye hi principle HTTPS, Aadhaar signing aur apps mein chalta hai