Cryptography basics

Information Technology (B.E./B.Tech) · Information security · free study notes for exams, placements and interviews

In short

Cryptography is the science of transforming information so that only intended parties can read it (confidentiality), detect tampering (integrity), confirm the sender (authentication) and prevent later denial (non-repudiation). It is the mathematical core under HTTPS, UPI, Aadhaar e-KYC, DigiLocker, net banking, VPNs and digital signatures on income-tax and GST filings. In Indian universities it appears in Information Security, Cryptography and Network Security and Network Security papers, and it carries marks in GATE CS/IT (number theory, RSA, modes of operation) and UGC-NET. Placement interviews at TCS, Infosys, Wipro, Cognizant, Accenture, Paytm, PhonePe, HDFC/ICICI tech teams and product companies regularly ask symmetric-versus-asymmetric, hashing-versus-encryption, and how TLS and digital signatures work. Legally, the Information Technology Act, 2000 recognises digital/electronic signatures (Sections 3 and 3A) and the Controller of Certifying Authorities (CCA) licenses India's CAs.

Explained

Goals, terminology and classification

Plaintext (P) - readable message; ciphertext (C) - transformed message; key (K) - the secret parameter; cipher - the algorithm pair (E, D) with C = E(K, P), P = D(K, C).
Security services: confidentiality, integrity, authentication, non-repudiation, plus availability and access control from the wider CIA model.
Cryptanalysis - breaking ciphers; cryptology = cryptography + cryptanalysis. Steganography hides the *existence* of a message (LSB in images); cryptography hides its *meaning*.
Kerckhoffs's principle: security must rest on secrecy of the key, never of the algorithm - "no security through obscurity".
Classification by key: symmetric (one shared secret key) and asymmetric/public-key (public + private key pair). By operation: substitution, transposition, product ciphers. By data handling: block ciphers (fixed-size blocks) and stream ciphers (bit/byte at a time).
Keyless primitive: cryptographic hash functions (no key) and MACs (keyed hashes).
Attack models: ciphertext-only, known-plaintext, chosen-plaintext (CPA), chosen-ciphertext (CCA), adaptive, plus side-channel (timing, power) and brute-force (exhaustive key search).
Perfect secrecy: only the one-time pad (truly random key, as long as the message, used once) is unconditionally secure - proved by Shannon; impractical because of key distribution. Everything else is computationally secure - breakable in principle but not in feasible time.

Classical ciphers (exam favourites)

Caesar cipher: C = (P + k) mod 26, k fixed; 25 keys, broken by brute force.
Monoalphabetic substitution: arbitrary letter permutation, 26! keys, yet broken by frequency analysis (E, T, A most common in English).
Playfair: 5×5 key matrix (I/J merged), encrypts digraphs by rules - same row → right neighbour, same column → below, else rectangle corners; hides single-letter frequencies.
Hill cipher: block of n letters as a vector; C = KP mod 26 with K invertible mod 26 (gcd(det K, 26) = 1); linear, so broken with enough known plaintext.
Vigenère: polyalphabetic, repeating keyword; Ci = (Pi + Ki) mod 26. Broken by Kasiski test / index of coincidence to find key length, then per-column frequency analysis.
Transposition: rail fence (zig-zag) and columnar transposition (write in rows, read columns in key order) - letters unchanged, positions shuffled.
Why they fail: small key space, preserved statistics, linearity. Modern ciphers deliberately break these through confusion (key-ciphertext relation is complex) and diffusion (one plaintext bit affects many ciphertext bits) - Shannon's two design principles.

Symmetric-key cryptography

Feistel structure: split block into L and R; each round Ri = Li−1 ⊕ f(Ri−1, Ki), Li = Ri−1. Decryption uses the same circuit with reversed subkeys, so f need not be invertible.
DES: 64-bit block, 56-bit effective key (64 with parity), 16 Feistel rounds, initial/final permutation, S-boxes (6 bits in, 4 out) give non-linearity. Broken by brute force (1998-99 in under a day); withdrawn as a standard.
Double DES is weak against the meet-in-the-middle attack (≈2⁵⁷ work, not 2¹¹²). Triple DES (3DES) = E(K3, D(K2, E(K1, P))); 112-bit effective security, slow, 64-bit block; now deprecated/disallowed for new designs.
AES (Rijndael): substitution-permutation network, not Feistel. 128-bit block; key 128/192/256 bits with 10/12/14 rounds. State is a 4×4 byte matrix; each round does SubBytes (byte S-box over GF(2⁸)), ShiftRows, MixColumns (matrix multiply in GF(2⁸)) and AddRoundKey; the final round omits MixColumns. Key expansion produces round keys. AES-128 is the workhorse of TLS, UPI, disk encryption and Wi-Fi WPA2/WPA3 (AES-CCMP/GCM).
Other symmetric ciphers: Blowfish, Twofish, IDEA, RC5, ChaCha20 (modern stream cipher used with Poly1305 on mobile).
Stream ciphers: keystream XORed with plaintext (RC4 - now broken and banned; ChaCha20 - current). Fast, no padding; never reuse a keystream (two ciphertexts XORed cancel the key).
Padding: PKCS#7 pads to the block size; PKCS#5 is the same scheme fixed to 8-byte blocks. Padding-oracle attacks arise when padding errors are distinguishable.
Key size vs security: symmetric 128-bit keys ≈ 2¹²⁸ work - infeasible; a key must be random, not a password. Passwords are stretched into keys by PBKDF2, bcrypt, scrypt or Argon2 with a salt and high iteration count.

Modes of operation and authenticated encryption

ECB (Electronic Codebook): each block encrypted independently - identical plaintext blocks give identical ciphertext (the famous "ECB penguin"); never use for data.
CBC: Ci = E(K, Pi ⊕ Ci−1), C0 = IV. Needs a random, unpredictable IV; errors propagate to the next block; not parallelisable for encryption.
CFB / OFB: turn a block cipher into a stream cipher; OFB keystream is plaintext-independent (bit errors do not propagate).
CTR (Counter): keystream = E(K, nonce‖counter); parallel, random access, no padding. Nonce reuse is fatal.
GCM: CTR plus a GHASH authentication tag - AEAD (authenticated encryption with associated data) giving confidentiality + integrity in one pass; AES-GCM and ChaCha20-Poly1305 are the TLS 1.3 standards.
Encrypt-then-MAC is the safe composition order; MAC-then-encrypt (old TLS) enabled padding-oracle attacks such as Lucky 13.

Hash functions, MACs and key derivation

A cryptographic hash h = H(M) maps any-length input to a fixed-length digest. Required properties:
1. Pre-image resistance - given h, infeasible to find M (one-way).
2. Second pre-image resistance - given M, infeasible to find M′ ≠ M with the same digest.
3. Collision resistance - infeasible to find any pair M ≠ M′ with H(M) = H(M′).
4. Avalanche effect - one input bit flip changes about half the output bits; plus fast computation and fixed output length.
Birthday attack: collisions need only about 2^n/2 work for an n-bit digest - so a 128-bit hash gives only 64-bit collision security.
Algorithms: MD5 (128-bit, collisions found 2004 - broken), SHA-1 (160-bit, collision demonstrated 2017 - retired), SHA-2 family (SHA-224/256/384/512) - current default, SHA-3 (Keccak) - sponge construction, structurally different, standardised as a hedge. Merkle-Damgård construction (MD5, SHA-1, SHA-2) is vulnerable to length extension, which HMAC and SHA-3 avoid.
MAC - keyed tag for integrity + sender authentication: HMAC(K, M) = H((K⊕opad) ‖ H((K⊕ipad) ‖ M)); CMAC uses a block cipher. A MAC gives no non-repudiation (both sides share the key).
Password storage: never plain or plain-hashed. Store salt + slow-hash output (bcrypt/Argon2). Salt defeats rainbow tables; pepper is a server-side secret added to the input.
Uses: file-integrity checksums, blockchain, Merkle trees, digital-signature pre-hashing, deduplication, HMAC in API authentication (used by Razorpay and most Indian payment gateways for webhook signature verification).

Public-key cryptography, signatures and PKI

Each user has a public key (published) and private key (secret). Encrypt with the receiver's public key → confidentiality; sign with the sender's private key → authentication and non-repudiation.
Number-theory background: prime factorisation, Euler's totient φ(n), Fermat's little theorem, Euler's theorem, modular exponentiation (square-and-multiply), extended Euclidean algorithm for modular inverse, discrete logarithm problem, CRT for fast RSA decryption.
RSA (Rivest-Shamir-Adleman): security rests on the hardness of factoring n = p·q.
1. Pick large primes p, q; n = pq; φ(n) = (p−1)(q−1).
2. Choose e with 1 < e < φ(n), gcd(e, φ(n)) = 1 (commonly 65537).
3. Compute d = e⁻¹ mod φ(n). Public key (e, n), private key (d, n).
4. C = Pᵉ mod n; P = C^d mod n. Minimum practical key size today is 2048 bits (3072+ preferred).
5. Textbook RSA is deterministic and malleable, so real use adds OAEP padding for encryption and PSS for signatures.
Diffie-Hellman key exchange: public p, g; A sends g^a mod p, B sends g^b mod p; both compute the shared key g^ab mod p. Provides key agreement, not authentication - vulnerable to man-in-the-middle unless the parties are authenticated. Ephemeral DH/ECDH gives forward secrecy (session keys die with the session).
ElGamal (encryption) and DSA/ECDSA/EdDSA (signatures) rest on the discrete-log problem. ECC gives equal strength with far shorter keys (256-bit ECC ≈ 3072-bit RSA), so it dominates mobile, smart cards and TLS 1.3 (curves P-256, Curve25519).
Digital signature flow: hash the message, encrypt/sign the digest with the sender's private key; the verifier re-hashes, verifies with the public key, and compares. Hashing first keeps signatures short and fast.
Hybrid cryptosystem (what everything really does): public-key crypto exchanges or wraps a random symmetric session key; the bulk data is then encrypted with AES. Asymmetric is ~100-1000× slower, so it is used only on small items.
PKI: CA issues X.509 certificates binding an identity to a public key; chain of trust from a root CA via intermediates; CRL and OCSP for revocation; RA verifies identity. In India the Controller of Certifying Authorities (CCA) under MeitY licenses CAs (eMudhra, (n)Code, Capricorn, NSDL, SafeScrypt, Verasys, IDRBT, CDAC) and runs the Root Certifying Authority of India (RCAI). DSC classes are used for MCA/ROC, GST, income-tax e-filing, EPFO, IRCTC-type tenders and GeM e-procurement; eSign (Aadhaar-OTP-based online signature) is an online alternative.
Legal position in India: IT Act 2000 Section 3 (digital signature using asymmetric crypto and hash function), Section 3A (electronic signature), Section 5 (legal recognition) and Section 35 (DSC application), plus the evidentiary presumption in Section 85B of the Evidence Act (now Section 93 of the BSA, 2023); Chapter VI covers CAs. The Digital Personal Data Protection Act, 2023 requires "reasonable security safeguards" - encryption is the usual control. RBI, SEBI and CERT-In directions mandate encryption in transit and at rest for regulated entities; Indian Standard references follow IS/ISO/IEC 27001 and 27002 controls on cryptography. Export/usage rules and permitted key lengths in specific sectors have changed over time - check the current RBI/CERT-In/CCA circular before quoting a number.

Practical issues: key management and modern threats

Key lifecycle: generation (CSPRNG - /dev/urandom, secrets in Python, never rand()), distribution, storage (HSM, TPM, Android Keystore, cloud KMS), rotation, revocation, destruction, escrow/backup.
Weak randomness breaks strong crypto - predictable IVs, nonces or primes have broken real systems.
Key distribution problem: n users need n(n−1)/2 symmetric keys; a KDC (Kerberos) or public-key crypto solves it.
TLS handshake (1.3, simplified): ClientHello with key share → ServerHello + certificate + signature → both derive secrets via HKDF from ECDHE → authenticated encryption (AES-GCM) with forward secrecy; one round trip, no RSA key transport, no static-key ciphersuites.
Attacks in practice: side channels (timing, power, cache), padding oracles, downgrade attacks, bad certificate validation, hardcoded keys in source or APKs, nonce/IV reuse, rolling your own crypto.
Post-quantum: Shor's algorithm would break RSA, DH and ECC; Grover's halves effective symmetric key strength (hence AES-256). NIST has standardised ML-KEM (Kyber) for key encapsulation and ML-DSA (Dilithium) / SLH-DSA (SPHINCS+) for signatures; migration and hybrid TLS deployments are under way.
Homomorphic encryption (compute on ciphertext), zero-knowledge proofs (prove without revealing) and secure multiparty computation are the research frontier, with ZKP used in privacy-preserving identity work.

Key points

Confidentiality, integrity, authentication, non-repudiation - the four services cryptography delivers; hashing alone gives only integrity.
Kerckhoffs's principle - assume the attacker knows the algorithm; only the key is secret.
Confusion and diffusion - Shannon's design goals; achieved by S-boxes and permutation/mixing layers.
Symmetric - one key, fast, key-distribution problem (n(n−1)/2 keys); AES is the standard.
Asymmetric - key pair, slow, solves key distribution and gives digital signatures; RSA/ECC/DH.
DES - 56-bit key, 64-bit block, 16 Feistel rounds, brute-forceable; 3DES gives 112-bit security but is deprecated.
AES - 128-bit block, 128/192/256-bit key, 10/12/14 rounds, SubBytes-ShiftRows-MixColumns-AddRoundKey.
Never ECB - it leaks plaintext patterns; use GCM (AEAD) or CBC with a random IV plus a separate MAC.
Nonce/IV rule - IVs must be unpredictable (CBC) and never repeat (CTR/GCM); reuse destroys security.
Hash properties - pre-image, second pre-image and collision resistance plus the avalanche effect; MD5 and SHA-1 are broken, use SHA-256/SHA-3.
Birthday bound - collision work is 2^n/2, not 2^n.
HMAC - keyed hash for integrity + authenticity; immune to length extension; gives no non-repudiation.
Password hashing - bcrypt/Argon2/PBKDF2 with a unique random salt, never plain SHA-256.
RSA - n = pq, ed ≡ 1 mod φ(n), C = Pᵉ mod n, P = C^d mod n; use ≥2048-bit keys with OAEP/PSS.
Diffie-Hellman - shared secret over a public channel; unauthenticated DH falls to MITM; ephemeral DH gives forward secrecy.
Digital signature - hash then sign with the private key; verified with the public key; legally recognised under IT Act 2000 Sections 3 and 3A, with CAs licensed by the CCA.
Hybrid model - asymmetric crypto moves the key, symmetric crypto moves the data (TLS, UPI, PGP).
Post-quantum - Shor breaks RSA/ECC; NIST's ML-KEM (Kyber) and ML-DSA (Dilithium) are the standardised replacements.

Formulas and examples

Caesar: C = (P + k) mod 26; P = (C − k) mod 26 — letters as A = 0 … Z = 25
Affine: C = (aP + b) mod 26, with gcd(a, 26) = 1
Hill: C = K·P mod 26, P = K⁻¹·C mod 26 — K is an n×n key matrix, gcd(det K, 26) = 1
Brute-force key search: 2ⁿ total keys, average 2ⁿ⁻¹ trials for an n-bit key
Symmetric keys for n users: n(n−1)/2; asymmetric: 2n keys (n pairs)
Euler totient: φ(pq) = (p−1)(q−1) for distinct primes p, q
RSA: n = p·q; choose e with gcd(e, φ(n)) = 1; d = e⁻¹ mod φ(n); C = Pᵉ mod n; P = C^d mod n
Diffie-Hellman: A = g^a mod p, B = g^b mod p, shared K = B^a mod p = A^b mod p = g^ab mod p
Birthday/collision bound: work ≈ 2^n/2 for an n-bit digest; 50% collision probability after ≈1.177·√N samples from N values
HMAC(K, M) = H((K ⊕ opad) ‖ H((K ⊕ ipad) ‖ M))
CBC: Ci = E(K, Pi ⊕ Ci−1), C0 = IV; CTR: Ci = Pi ⊕ E(K, nonce ‖ i)
Number of AES-128 blocks for an L-byte message = ceil(L/16)

Example 1 - RSA key generation, encryption and decryption (standard exam numbers). Let p = 7, q = 11 → n = 77, φ(n) = 6 × 10 = 60. Choose e = 13 (gcd(13, 60) = 1).

d = 13⁻¹ mod 60: 13 × 37 = 481 = 8 × 60 + 1 → d = 37.
Encrypt P = 5: C = 5¹³ mod 77. 5² = 25; 5⁴ = 625 mod 77 = 625 − 616 = 9; 5⁸ = 81 mod 77 = 4. So 5¹³ = 5⁸·5⁴·5¹ = 4 × 9 × 5 = 180 mod 77 = 180 − 154 = 26.
Decrypt: P = 26³⁷ mod 77. Use CRT: 26 mod 7 = 5, 5³⁷ mod 7 → exponent 37 mod 6 = 1 → 5. 26 mod 11 = 4, 4³⁷ mod 11 → exponent 37 mod 10 = 7 → 4⁷ = 16384 mod 11: 4²=5, 4⁴=25 mod 11=3, 4⁷=4⁴·4²·4=3×5×4=60 mod 11=5. Solve x ≡ 5 (mod 7), x ≡ 5 (mod 11) → x = 5 ✓ recovered plaintext.

Example 2 - Diffie-Hellman shared secret. p = 23, g = 5; Asha picks a = 6, Bikram picks b = 15.

A = 5⁶ mod 23: 5² = 2 (25 − 23), 5⁴ = 2² = 4, 5⁶ = 4 × 2 = 8.
B = 5¹⁵ mod 23: 5⁸ = 4² = 16; 5¹⁵ = 5⁸·5⁴·5²·5¹ = 16 × 4 × 2 × 5 = 640 mod 23 = 640 − 621 = 19.
Asha computes 19⁶ mod 23: 19 ≡ −4, (−4)⁶ = 4⁶ = 4096 mod 23 = 4096 − 4094 (23×178) = 2.
Bikram computes 8¹⁵ mod 23: 8 = 2³ so 8¹⁵ = 2⁴⁵; 2¹¹ = 1 mod 23 (order of 2 is 11), 45 mod 11 = 1 → 2¹ = 2. Shared key = 2 ✓.

Example 3 - Brute-force time and key length. A machine tries 10¹² keys per second (1 tera-key/s).

DES (2⁵⁶ ≈ 7.21 × 10¹⁶ keys): average 2⁵⁵ ≈ 3.6 × 10¹⁶ trials → 3.6 × 10⁴ s ≈ 10 hours - DES is dead.
AES-128 (2¹²⁷ ≈ 1.7 × 10³⁸ average trials) → 1.7 × 10²⁶ s ≈ 5.4 × 10¹⁸ years - about 400 million times the age of the universe.
Lesson: each extra key bit doubles the work; 128 bits is the practical floor.

Example 4 - Birthday attack on digest size.

MD5 (128-bit): collision work ≈ 2⁶⁴ ≈ 1.8 × 10¹⁹ - reachable; actual MD5 collisions are now found in seconds by exploiting structural flaws.
SHA-256: collision work ≈ 2¹²⁸ ≈ 3.4 × 10³⁸ - infeasible.
Classroom check: with a 32-bit checksum (N = 4.29 × 10⁹), a 50% collision chance needs ≈ 1.177 × √(4.29 × 10⁹) ≈ 77,000 files - which is why checksums are not signatures.

Example 5 - Classical cipher and mode arithmetic.

Caesar with k = 3: "INDIA" → I(8)+3 = 11 = L, N(13)+3 = 16 = Q, D(3)+3 = 6 = G, I → L, A(0)+3 = 3 = D → LQGLD.
Vigenère with keyword "KEY" on "DATA": K=10, E=4, Y=24, K=10 → D(3)+10 = 13 = N; A(0)+4 = 4 = E; T(19)+24 = 43 mod 26 = 17 = R; A(0)+10 = 10 = K → NERK.
AES-CBC on a 1,000-byte file: ceil(1000/16) = 63 blocks (PKCS#7 adds 8 bytes of padding to reach 1,008 bytes = 63 blocks), plus a 16-byte IV stored with the ciphertext → 1,024 bytes on disk.

Property	Symmetric (AES)	Asymmetric (RSA/ECC)	Hash (SHA-256)
Keys	1 shared secret	Public + private pair	None (MAC adds a key)
Speed	Very fast (GB/s)	Slow (ms per operation)	Very fast
Typical size	128/256-bit key	RSA 2048-4096, ECC 256	256-bit digest
Services	Confidentiality (+integrity with GCM)	Confidentiality, signature, key exchange, non-repudiation	Integrity only
Key distribution	Hard (n(n−1)/2 keys)	Easy (publish public key)	Not applicable
Reversible	Yes	Yes	No (one-way)
Main use	Bulk data, disk, TLS records	Key exchange, DSC, certificates	Passwords, signatures, blockchain

Mode	Parallel	Needs padding	Integrity	Verdict
ECB	Yes	Yes	No	Never use
CBC	Decrypt only	Yes	No (add HMAC)	Legacy, needs random IV
CTR	Yes	No	No	Good, nonce must be unique
GCM	Yes	No	Yes (AEAD)	Preferred today

# Correct, library-based usage - never implement AES or RSA yourself
import os, hashlib, hmac
from cryptography.hazmat.primitives.ciphers.aead import AESGCM

key   = AESGCM.generate_key(bit_length=256)   # CSPRNG-backed key
nonce = os.urandom(12)                        # 96-bit, unique per message
ct    = AESGCM(key).encrypt(nonce, b"PAN: ABCDE1234F", b"ctx-v1")
pt    = AESGCM(key).decrypt(nonce, ct, b"ctx-v1")   # raises if tampered

# Webhook/API signature check in constant time (Razorpay-style)
sig = hmac.new(b"secret", b"payload", hashlib.sha256).hexdigest()
ok  = hmac.compare_digest(sig, "received_signature_here")

Where it is used

Banking and payments: UPI/NPCI message signing and PIN block encryption, HSMs in bank data centres, EMV chip cards, SWIFT, IMPS; RBI cyber-security framework mandates encryption for regulated entities - roles such as payment-security engineer at NPCI, HDFC, ICICI, Paytm, PhonePe, Razorpay.
Government and e-governance: Aadhaar authentication (encrypted PID blocks), DigiLocker issued documents, GST and income-tax e-filing with DSCs, GeM and eProcurement tenders, eSign, passport and land-record systems; CCA-licensed CAs (eMudhra, (n)Code, Capricorn) and C-DAC/CDOT security products.
Product and web engineering: TLS/HTTPS configuration, JWT signing, OAuth tokens, password hashing with bcrypt/Argon2, database and field-level encryption, secrets in AWS KMS / Azure Key Vault / HashiCorp Vault - expected knowledge for backend, DevSecOps and cloud-security roles.
Telecom, defence and hardware: SIM/USIM authentication (A3/A8, Milenage), 5G key hierarchy, VPN IPsec/IKEv2 in enterprise WAN, secure boot and firmware signing, DRDO/ISRO and defence communication using indigenous crypto.
Security services industry: TCS, Infosys, Wipro, HCL, Accenture, Deloitte, PwC and EY teams doing crypto assessments, key-management design, PKI deployment, HSM integration and TLS/cipher audits against ISO/IEC 27001 and PCI-DSS.
Blockchain and new tech: SHA-256 hashing and ECDSA signatures in crypto-asset platforms, Merkle trees, zero-knowledge identity pilots, and post-quantum migration planning in BFSI.

Interview questions

Q: What is the difference between symmetric and asymmetric encryption? A: Symmetric uses one shared secret key and is fast, so it encrypts bulk data; asymmetric uses a public-private key pair, is far slower, and is used for key exchange and digital signatures. Real systems combine both in a hybrid scheme.
Q: Is hashing encryption? A: No - hashing is a one-way, fixed-length fingerprint with no key and no way back; encryption is reversible with a key. Hashing provides integrity, not confidentiality.
Q: Why should you never use ECB mode? A: Each block is encrypted independently, so identical plaintext blocks produce identical ciphertext blocks and the data's structure leaks; it also offers no integrity protection.
Q: What does a digital signature provide that a MAC does not? A: Non-repudiation - only the holder of the private key could have produced it, and any third party can verify it. A MAC uses a shared key, so either party could have created it.
Q: Why is Diffie-Hellman vulnerable to a man-in-the-middle attack? A: It establishes a shared secret but authenticates nobody, so an attacker can run separate exchanges with each side. It must be combined with certificates or signatures, as TLS does.
Q: What is forward secrecy? A: Using ephemeral key-exchange keys (ECDHE) so that each session key is independent - compromising the server's long-term private key later does not decrypt past recorded sessions.
Q: Why hash a message before signing it? A: Signing is slow and size-limited, so the fixed-size digest is signed instead; this keeps signatures short and constant-sized, and collision resistance of the hash preserves security.
Q: What is a salt and why is it needed? A: A unique random value stored with each password hash; it makes identical passwords hash differently and defeats precomputed rainbow tables. It is not secret - a secret server-side value is called a pepper.
Q: Why is SHA-256 a bad choice for storing passwords? A: It is deliberately fast, so an attacker can test billions of guesses per second on a GPU; password hashing needs a deliberately slow, memory-hard function such as bcrypt, scrypt or Argon2.
Q: What breaks if you reuse an IV or nonce? A: In CTR/GCM the keystream repeats, so XORing two ciphertexts reveals the plaintext relationship and, in GCM, can leak the authentication key; in CBC a predictable IV enables chosen-plaintext attacks such as BEAST.
Q: Which is stronger, a 256-bit ECC key or a 2048-bit RSA key? A: The 256-bit ECC key is comparable to about 3072-bit RSA, so it is slightly stronger with far smaller keys and faster operations - which is why TLS 1.3 and mobile systems prefer ECC.
Q: How will quantum computers affect cryptography? A: Shor's algorithm would break RSA, Diffie-Hellman and ECC; Grover's algorithm halves symmetric strength, so AES-256 remains safe. NIST's ML-KEM (Kyber) and ML-DSA (Dilithium) are the standardised post-quantum replacements.
Q: Under Indian law, what makes a digital signature legally valid? A: Sections 3, 3A and 5 of the IT Act, 2000 recognise digital/electronic signatures created with asymmetric crypto and a hash function, using a certificate from a CA licensed by the Controller of Certifying Authorities.

Common mistakes

Calling encryption and hashing interchangeable, or claiming a hash "decrypts" - and using a hash where confidentiality is needed.
Treating public-key crypto as a replacement for symmetric crypto, instead of explaining the hybrid model used in TLS, PGP and UPI.
Arithmetic slips in RSA: using n instead of φ(n) when computing d, choosing e not coprime to φ(n), or doing modular exponentiation without reducing at each step.
Forgetting that collision resistance costs only 2^n/2 work (birthday bound), and so overstating the strength of short digests.
Writing "DH provides authentication" or "RSA provides key exchange with forward secrecy" - DH only agrees a key, and static RSA key transport has no forward secrecy.
Implementing AES, RSA or a "custom cipher" in lab work instead of calling a vetted library, and hardcoding keys or IVs in the source or an APK.
Confusing a digital signature with a scanned handwritten signature or a DSC token's PIN, and ignoring certificate validation (expiry, chain, revocation) in code.
Ignoring padding and IV/nonce handling in exam answers on modes, or using a predictable counter such as all zeros.