1 of 20

DATSEC1 • CRYPTOGRAPHY

Module 1

Cryptography Foundations�and Practical Tooling

Security goals • plaintext/ciphertext • keys • encoding vs. hashing vs. encryption • classical vs. modern cryptography

CyberChef • OpenSSL • Python

Prof. Justin David Pineda | Assistant Professorial Lecturer

Welcome to Module 1 of DATSEC1. This module establishes the foundation for almost everything else we will discuss in cryptography.

When people hear the word cryptography, they normally think immediately about encryption—scrambling a message so that other people cannot read it. Encryption is certainly an important part of cryptography, but cryptography is much broader than that.

We use cryptography to protect confidentiality, verify that information has not been modified, establish identity, protect passwords, secure websites, sign software, protect financial transactions, and many other things.

Think about what happens when you open your banking application. Your phone communicates with a server somewhere on the Internet. You do not want another person connected to the same network to simply read your username, password, account balance, or transaction details. Cryptography helps make that communication secure.

But this module is also practical. We are not going to study cryptography purely from a mathematical perspective. We will experiment with the concepts using CyberChef, OpenSSL, and Python.

The important question throughout this module is:

What does each cryptographic technique actually do?

By the end of the module, you should not simply recognize terms like Base64, SHA-256, AES, plaintext, or ciphertext. You should understand what problem each one solves—and equally important, what problem it does not solv

2 of 20

DATSEC1 • CRYPTOGRAPHY

Why Cryptography Matters

Module 1 — Cryptography Foundations and Practical Tooling

Prof. Justin David Pineda | Assistant Professorial Lecturer

Nearly every digital interaction depends on cryptography—even when users never see it.

💬

Messaging

Protects conversations from unauthorized reading and detects tampering.

₱

Online Banking

Secures credentials, transactions, sessions, and server identity.

Passwords

Good systems store password verifiers using one-way hashing—not reversible encryption.

✓

Software

Digital signatures help prove software origin and integrity.

Core question for this module:

What problem is a technique solving—and what problem is it NOT solving?

Cryptography is already around us almost every time we use technology.

When you send a message using a modern messaging application, cryptography may protect that conversation so that unauthorized people cannot simply read it.

When you access an online banking website, cryptography helps protect your credentials and transactions while they travel across the Internet.

When systems store passwords correctly, they should generally not store the actual password. Instead, they use specialized password-hashing mechanisms so that the system can verify a password without needing to keep the original password in readable form.

Cryptography is also used in software distribution. For example, digital signatures can help a computer verify that software actually came from the expected publisher and that the package has not been modified.

A useful analogy is physical security.

Imagine an office building. We do not use one security mechanism for everything. We have locks to restrict access, CCTV for monitoring, IDs to establish identity, tamper-evident seals to detect interference, and signatures to authorize documents.

Cybersecurity works similarly.

Cryptography provides different mechanisms for different security requirements.

So whenever we encounter a cryptographic technique, we should ask:

What security problem is this solving?

And equally important:

What security problem is it NOT solving?

That distinction will prevent many common cybersecurity mistakes.

3 of 20

DATSEC1 • CRYPTOGRAPHY

Learning Objectives

Module 1 — Cryptography Foundations and Practical Tooling

Prof. Justin David Pineda | Assistant Professorial Lecturer

Explain the fundamental security goals of cryptography: confidentiality, integrity, authentication, and non-repudiation.

Use the terms plaintext, ciphertext, key, algorithm, encryption, and decryption correctly.

Differentiate encoding, hashing, and encryption based on purpose, reversibility, and key usage.

Compare classical cryptography with modern cryptographic systems at a conceptual level.

Use CyberChef, OpenSSL, and Python for simple cryptographic experiments and interpret the results.

For this module, there are five main things I want you to understand.

First, you should understand the fundamental security goals associated with cryptography: confidentiality, integrity, authentication, and non-repudiation.

Second, you should be comfortable with basic terminology such as plaintext, ciphertext, keys, algorithms, encryption, and decryption.

Third—and this is particularly important—you should be able to differentiate encoding, hashing, and encryption.

Students often confuse these three because their outputs can all look strange or unreadable.

For example, if I convert a message into Base64, the result might look like random characters. But that does not mean the information has been encrypted.

Fourth, we will distinguish between classical and modern cryptography. Classical cryptography is useful because it teaches us the basic concepts. However, something like a Caesar cipher should never be used to protect actual sensitive information today.

Finally, we will use practical tools.

CyberChef allows us to visually experiment with data transformations. OpenSSL allows us to work with cryptographic functions from the command line. Python allows us to perform similar operations programmatically.

The objective is not simply to memorize commands.

The objective is to understand what happens to the data when we execute those commands.

4 of 20

DATSEC1 • CRYPTOGRAPHY

The Security Goals of Cryptography

Module 1 — Cryptography Foundations and Practical Tooling

Prof. Justin David Pineda | Assistant Professorial Lecturer

Confidentiality

Keep information secret from unauthorized parties.��Example: encrypted chat.

Integrity

Detect whether data was modified after it was created or sent.��Example: file hash.

Authentication

Establish that an entity or message is genuinely who/what it claims to be.��Example: certificate.

Non-repudiation

Provide strong evidence linking an action/message to its signer.��Example: digital signature.

Cryptography is not “just encryption.” Different mechanisms support different security properties.

A secure design starts by identifying the required security property before selecting the cryptographic mechanism.

Let's start with four important security goals.

The first is confidentiality.

Confidentiality means preventing unauthorized people from reading information.

Think of confidentiality as placing a document inside a locked safe. The document still exists, but only someone with the correct access mechanism should be able to read it.

Encryption is commonly used to provide confidentiality.

The second is integrity.

Integrity answers a different question:

Has the information been changed?

Imagine downloading an installer from the Internet. You might want to know whether the file you downloaded is exactly the same file that the publisher released.

Cryptographic hashes and message authentication mechanisms can help with this.

Third is authentication.

Authentication concerns identity or authenticity.

For example, when your browser connects to a banking website, you want confidence that you are communicating with the legitimate server rather than an attacker pretending to be the bank.

Finally, we have non-repudiation.

This is about providing strong evidence connecting an action or message to a particular signer. Digital signatures are commonly associated with this concept, though real-world non-repudiation also depends on how keys, identities, processes, and evidence are managed.

The important takeaway is:

Cryptography is not synonymous with encryption.

Encryption primarily addresses confidentiality. Other cryptographic mechanisms support other security goals.

5 of 20

DATSEC1 • CRYPTOGRAPHY

Plaintext, Ciphertext, Keys, and Algorithms

Module 1 — Cryptography Foundations and Practical Tooling

Prof. Justin David Pineda | Assistant Professorial Lecturer

INPUT

PLAINTEXT�Readable/original data

→

ENCRYPTION ALGORITHM

Transforms plaintext using a key.

→

CIPHERTEXT�Unreadable-looking output

→

↺

DECRYPT

Recover plaintext with the correct key.

Key

Secret or controlled value that determines the transformation. Security should depend on the key—not secrecy of the algorithm.

Algorithm

Defined mathematical procedure such as AES. Modern algorithms are usually public and heavily analyzed.

★

Kerckhoffs's Principle

A system should remain secure even if everything except the key is public.

Let's establish some basic vocabulary.

Plaintext is the original readable information.

For example:

Transfer ₱10,000 to Account A.

If we encrypt that information, the output becomes ciphertext.

Ciphertext should appear unintelligible to someone who does not possess the necessary key.

To transform plaintext into ciphertext, we use an encryption algorithm together with a key.

A useful analogy is a padlock.

The algorithm is like the design of the padlock. Everyone can know how the padlock works.

The key is what provides the specific control over access.

Modern cryptography generally assumes that attackers can know which algorithm we are using.

For example, AES is publicly documented. Researchers, governments, universities, cybersecurity professionals, and attackers can all study AES.

That does not automatically make AES insecure.

The security should primarily depend on protecting the key.

This idea is related to Kerckhoffs's Principle: a cryptographic system should remain secure even if everything about the system—except the key—is public knowledge.

This is why creating a "secret custom encryption algorithm" is generally a bad security strategy.

Security through obscurity is not a substitute for sound cryptography.

6 of 20

DATSEC1 • CRYPTOGRAPHY

Encoding: Representation, Not Security

Module 1 — Cryptography Foundations and Practical Tooling

Prof. Justin David Pineda | Assistant Professorial Lecturer

Encoding changes how data is represented so systems can store, transmit, or display it reliably.

Base64

Text → bytes → printable characters��Example:�Hello → SGVsbG8=��No secret key is required.

Hexadecimal

Bytes represented using 0–9 and A–F.��Example:�A → 41��Common in debugging and crypto output.

URL Encoding

Represents reserved URL characters safely.��Example:�space → %20��Designed for transport—not secrecy.

Rule of thumb: if anyone can reverse it without a secret, it is not encryption.

This is one of the most important distinctions in today's discussion.

Encoding is not encryption.

Encoding changes the representation of information so that another system can properly store, transmit, or process it.

Consider Base64.

Suppose we encode:

Hello

We might get:

SGVsbG8=

To someone unfamiliar with Base64, that output might look encrypted.

But anyone who recognizes Base64 can immediately decode it.

No password is required.

No secret key is required.

Therefore, Base64 does not provide confidentiality.

Another example is hexadecimal representation.

Computers fundamentally work with bytes. Hexadecimal gives us a convenient human-readable way to represent those bytes.

URL encoding is another example. A space might become %20 because certain characters need special representation inside URLs.

Think of encoding like translating the format rather than hiding the information.

For example, imagine changing a Philippine phone number from:

0917 123 4567

to:

+63 917 123 4567.

The representation changed, but the information is not secret.

A simple rule you can remember is:

If anyone can reverse the transformation without possessing a secret, it probably is not encryption.

7 of 20

DATSEC1 • CRYPTOGRAPHY

Hashing: A One-Way Fingerprint

Module 1 — Cryptography Foundations and Practical Tooling

Prof. Justin David Pineda | Assistant Professorial Lecturer

A cryptographic hash function maps data of any size to a fixed-size digest.

Key Properties

• Deterministic�• Fixed-size output�• One-way / preimage resistant�• Small input change → very different digest�• Collision resistance

✓

Common Uses

• File integrity checks�• Digital signatures�• Message authentication constructions�• Content identification�• Password verification*

Examples

SHA-256 and SHA-3 are modern general-purpose hashes.��MD5 and SHA-1 are considered broken for collision-resistant security uses.

*Passwords require dedicated password-hashing/KDF schemes such as Argon2, scrypt, bcrypt, or PBKDF2—not plain SHA-256.

Hashing is very different from both encoding and encryption.

A cryptographic hash function takes an input and produces a fixed-size output called a hash, digest, or sometimes informally a fingerprint.

For example, I can calculate the SHA-256 hash of a small text file.

I can also calculate the SHA-256 hash of a 5 GB disk image.

The inputs are dramatically different in size, but SHA-256 still produces a 256-bit digest.

One important property is that hashing is designed to be one-way.

Encryption is intended to be reversible with the correct key.

Hashing is not.

A good analogy is a fingerprint.

Your fingerprint can help identify or compare something, but we cannot reconstruct your entire body simply from your fingerprint.

Hashes are frequently used for integrity checking.

Suppose I provide you with a file and tell you its SHA-256 hash.

You download the file and calculate the hash yourself.

If your result is different from mine, then something changed.

Another interesting property is the avalanche effect.

If we hash:

DATSEC1

and then change only one character:

DATSEC2

the resulting hashes should look completely different.

One important cybersecurity note: passwords should not simply be processed with ordinary fast hashing such as SHA-256. Password storage should use dedicated password-hashing or key-derivation functions such as Argon2, scrypt, bcrypt, or PBKDF2, normally with unique salts.

8 of 20

DATSEC1 • CRYPTOGRAPHY

Encryption: Confidentiality Through a Key

Module 1 — Cryptography Foundations and Practical Tooling

Prof. Justin David Pineda | Assistant Professorial Lecturer

Encryption is a reversible transformation intended to protect confidentiality.

1. Plaintext

Original readable data:��“Meet at 10:00”

2. Key + Algorithm

A cryptographic key controls the transformation.��Example algorithm: AES

→

3. Ciphertext

Output should reveal no useful plaintext information without the key.

Encryption protects secrecy; integrity/authentication require the right mode or additional mechanism.

Encryption has a specific purpose:

Protecting confidentiality.

We begin with plaintext.

For example:

Meet at 10:00.

We provide the plaintext to an encryption algorithm together with a cryptographic key.

The result is ciphertext.

Someone looking at the ciphertext should not be able to determine the original message without the appropriate key.

The key distinction from encoding is the presence of secret or controlled key material.

With Base64, anyone can reverse the operation.

With properly implemented encryption, knowing which algorithm was used should not be enough.

You still need the key.

Think about a hotel room.

Everyone knows how hotel door locks work conceptually. That does not mean everyone can enter your room.

The security comes from possession or authorization of the appropriate credential.

However, remember something important:

Encryption by itself does not automatically guarantee every security property.

It primarily addresses confidentiality.

Modern systems often use authenticated encryption, which provides confidentiality while also detecting unauthorized modifications.

This is why simply saying "the data is encrypted" is not enough when evaluating a security architecture.

We need to ask:

What algorithm?

What mode?

How are the keys generated?

How are the keys protected?

How is integrity provided?

Cryptography is about the complete design, not just the word "encrypted."

9 of 20

DATSEC1 • CRYPTOGRAPHY

Encoding vs. Hashing vs. Encryption

Module 1 — Cryptography Foundations and Practical Tooling

Prof. Justin David Pineda | Assistant Professorial Lecturer

Technique

Primary Purpose

Reversible?

Secret Key?

Typical Example

Security?

Encoding

Representation / transport

Yes

Base64

Hashing

Fingerprint / integrity

Designed as no

SHA-256

Yes*

Encryption

Confidentiality

Yes, with key

Yes

AES

Yes

*Hashing is a security primitive only when an appropriate cryptographic hash/KDF is used for the intended purpose.

This table summarizes one of the central lessons of the module.

Encoding is primarily about representation.

It is reversible, normally requires no secret key, and examples include Base64 and hexadecimal.

Hashing produces a one-way digest.

It is not intended to be reversed and normally does not require a secret key.

Encryption protects confidentiality.

It is intentionally reversible—but only with the appropriate key.

Here's a practical example.

Suppose my password is:

MyPassword123

If I convert it to Base64, I have not protected the password.

If I encrypt the password, the password can potentially be recovered by whoever has the decryption key.

If I need to verify passwords securely, I generally want a dedicated password-hashing mechanism.

So when you encounter unfamiliar data during cybersecurity work, do not immediately say:

"It's encrypted."

Instead ask:

Could this be encoded?

Could this be a hash?

Could this actually be ciphertext?

Being precise with these terms is an important cybersecurity skill.

10 of 20

DATSEC1 • CRYPTOGRAPHY

Classical Cryptography: Learning the Core Ideas

Module 1 — Cryptography Foundations and Practical Tooling

Prof. Justin David Pineda | Assistant Professorial Lecturer

Classical ciphers are historically important and useful for understanding substitution, transposition, keys, and cryptanalysis—but they are not secure for modern use.

Caesar Cipher

Shift each letter by a fixed amount.��HELLO +3 → KHOOR��Tiny keyspace; easily brute-forced.

Substitution Cipher

Replace each plaintext symbol with another symbol.��Larger keyspace, but language frequency leaks patterns.

Vigenère Cipher

Uses a repeating keyword to vary shifts.��Stronger than Caesar historically, but still breakable using statistical analysis.

Lesson: “looks scrambled” is not the same as “cryptographically secure.”

Classical cryptography refers to historical techniques used before modern computer-based cryptography.

The Caesar cipher is probably the most familiar example.

Suppose we shift every letter three positions forward.

A becomes D.

B becomes E.

And:

HELLO

becomes:

KHOOR.

This teaches us important concepts: plaintext, ciphertext, algorithm, key, encryption, and decryption.

But it is obviously not secure today.

There are only a small number of possible shifts. A computer—or even a student manually trying the possibilities—can recover the message quickly.

Substitution ciphers are more complicated because each letter can map to another letter.

However, natural languages have statistical patterns. In English, certain letters and combinations occur much more frequently than others.

An attacker can exploit these patterns through frequency analysis.

The Vigenère cipher improved on simple substitution by using a repeating keyword to vary the shifts, but it too can be attacked once enough ciphertext is available.

The lesson is important:

Something looking scrambled does not mean it is secure.

Classical cryptography is excellent for learning concepts and cryptanalysis.

It is not appropriate for protecting modern sensitive information.

11 of 20

DATSEC1 • CRYPTOGRAPHY

Modern Cryptography: Designed for Real Adversaries

Module 1 — Cryptography Foundations and Practical Tooling

Prof. Justin David Pineda | Assistant Professorial Lecturer

Symmetric Cryptography

Same secret key is used for encryption and decryption.��Fast and efficient for bulk data.��Example: AES.

Asymmetric Cryptography

Uses a public/private key pair.��Supports key exchange, encryption in some schemes, and signatures.��Examples: RSA, ECC.

Hashing & MACs

Hashes provide digests; MACs provide integrity + authentication using a secret key.��Examples: SHA-256, HMAC.

Modern systems combine primitives.

Example: HTTPS uses asymmetric mechanisms to establish trust/key material, symmetric encryption for traffic, and authenticated encryption to protect integrity.

Modern cryptography can broadly be introduced through several families of mechanisms.

First is symmetric cryptography.

The same secret key is used for encryption and decryption.

AES is the standard example.

Symmetric encryption is generally very fast, making it suitable for protecting large amounts of data.

The challenge is key distribution.

If two parties need to share a secret key, how do they securely establish or exchange it?

This brings us to asymmetric cryptography.

Asymmetric cryptography uses a mathematically related public key and private key.

The public key can be shared.

The private key must remain protected.

Public-key cryptography supports important capabilities such as digital signatures and key-establishment mechanisms.

RSA and elliptic-curve cryptography are common examples, though their exact capabilities depend on the scheme.

We also have hash functions and MACs.

A hash creates a digest.

A Message Authentication Code, such as HMAC, combines cryptographic processing with a secret key to provide integrity and message authentication.

Real systems typically combine several cryptographic primitives rather than relying on only one.

HTTPS is a good example. Multiple cryptographic mechanisms work together to establish trust, derive session keys, and protect network traffic.

12 of 20

DATSEC1 • CRYPTOGRAPHY

Keys: The Critical Asset

Module 1 — Cryptography Foundations and Practical Tooling

Prof. Justin David Pineda | Assistant Professorial Lecturer

Strong algorithms can still fail when keys are weak, exposed, reused incorrectly, or poorly managed.

Generate

Use cryptographically secure randomness.

→

Store

Protect keys from unauthorized access; avoid hard-coding secrets.

→

Distribute

Deliver keys only to authorized parties through secure mechanisms.

→

Rotate

Replace keys based on policy, compromise, or lifecycle requirements.

→

Revoke / Destroy

Retire compromised or expired keys so they can no longer be used.

In practice, key management is often harder than choosing the algorithm.

Cryptographic algorithms receive a lot of attention, but in real environments, key management is often the difficult part.

Imagine buying the strongest safe available and then leaving the key taped to the front of the safe.

The safe may be excellent.

The implementation is still insecure.

Cryptographic keys have a lifecycle.

First, they must be generated securely.

We need cryptographically secure randomness. Predictable keys undermine the entire system.

Next, keys need to be stored securely.

Hard-coding an encryption key inside source code, for example, can expose the key to anyone who obtains the code or application package.

Keys must also be distributed appropriately.

Only authorized systems or people should obtain them.

Keys may eventually need to be rotated.

Perhaps organizational policy requires periodic rotation, or perhaps we suspect that a key has been compromised.

Finally, keys need to be revoked or destroyed when they should no longer be trusted.

This is why enterprise cryptography involves technologies and processes such as key-management systems, secrets managers, hardware security modules, access controls, logging, and key-rotation procedures.

Choosing AES may take five seconds.

Managing the AES key securely for several years is the harder engineering problem.

13 of 20

DATSEC1 • CRYPTOGRAPHY

Tool Familiarization: CyberChef

Module 1 — Cryptography Foundations and Practical Tooling

Prof. Justin David Pineda | Assistant Professorial Lecturer

CyberChef is a browser-based “recipe” environment for transforming and analyzing data. It is excellent for learning because every step is visible.

Try Encoding

Input: your name��Operations:�To Base64 → From Base64�To Hex → From Hex��Observe reversibility.

Try Classical Ciphers

Use ROT13 or Caesar-style operations.��Change the shift/key and observe patterns.��Ask: how difficult is recovery?

Try Hashing

Generate SHA-256 for two nearly identical messages.��Compare the digests.��Observe the avalanche effect.

Do not paste real passwords, confidential data, production keys, or client information into online tools.

Our first practical tool is CyberChef.

CyberChef is extremely useful for cybersecurity because it allows us to build what it calls recipes.

A recipe is essentially a sequence of data transformations.

For example, we can enter our name and apply To Base64.

Then we can immediately apply From Base64 and recover the original value.

That demonstrates that Base64 is reversible encoding.

We can also experiment with hexadecimal.

Then we can try ROT13 or Caesar-style transformations.

After that, we can generate SHA-256 hashes.

One experiment I strongly recommend is this:

Hash:

Hello World

Then change just one character:

Hello world

Calculate the hash again.

The results should be dramatically different.

CyberChef makes these concepts visual, which is why it is useful for learning.

However, remember an operational security rule:

Do not paste actual passwords, production secrets, private keys, confidential company information, or client data into public online tools.

For classroom exercises, we use synthetic or test data.

The lesson is not only how to use a cybersecurity tool.

It is also how to use tools responsibly.

14 of 20

DATSEC1 • CRYPTOGRAPHY

Tool Familiarization: OpenSSL

Module 1 — Cryptography Foundations and Practical Tooling

Prof. Justin David Pineda | Assistant Professorial Lecturer

OpenSSL provides command-line cryptographic utilities. It is useful for hashes, random data, certificates, keys, and encryption experiments.

SHA-256 digest

openssl dgst -sha256 sample.txt

Random bytes

openssl rand -hex 16

Inspect version

openssl version

Lab discipline

Use only test data. Record the command, input, output, and what security property the operation demonstrates.

Our second tool is OpenSSL.

Unlike CyberChef, OpenSSL is primarily command-line based.

This may initially look less friendly, but command-line tools are extremely important in cybersecurity because they can be scripted, automated, and used in many technical environments.

For example:

openssl dgst -sha256 sample.txt

calculates the SHA-256 digest of a file.

We can use:

openssl rand -hex 16

to generate random bytes represented in hexadecimal.

And:

openssl version

allows us to check which OpenSSL version is installed.

Later, OpenSSL becomes even more useful because it can work with certificates, keys, certificate signing requests, TLS-related artifacts, and other cryptographic operations.

When using command-line tools, I want you to develop a habit of documenting four things:

Command → Input → Output → Interpretation

Do not submit a screenshot showing a command without understanding what happened.

Explain what the command did and what security concept it demonstrates.

That distinction separates simply following instructions from actually learning cybersecurity.

15 of 20

DATSEC1 • CRYPTOGRAPHY

Tool Familiarization: Python

Module 1 — Cryptography Foundations and Practical Tooling

Prof. Justin David Pineda | Assistant Professorial Lecturer

Python helps us inspect bytes, encoding, and hashes programmatically. For production cryptography, use well-maintained cryptographic libraries rather than inventing algorithms.

import base64, hashlib��msg = b"DATSEC1"�print(base64.b64encode(msg).decode())�print(hashlib.sha256(msg).hexdigest())

What to Observe

1. Base64 output is reversible.�2. SHA-256 produces a fixed-length digest.�3. Both operate on bytes.�4. Neither example encrypts the message.

Never implement your own “custom encryption” for real systems.

Python gives us another way to experiment with cryptographic concepts.

In the example, we import base64 and hashlib.

We define:

msg = b"DATSEC1"

Notice the b before the quotation mark.

That indicates that we are working with bytes.

This becomes important because cryptographic functions ultimately operate on bytes rather than abstract human-readable characters.

First, we encode the message using Base64.

Again, this is reversible.

Then we calculate its SHA-256 digest.

This produces a fixed-size hexadecimal representation of the hash.

Notice something important:

Neither operation in this example actually encrypts the message.

Base64 encodes it.

SHA-256 hashes it.

This is exactly the kind of distinction I want you to recognize.

Another critical rule:

Do not invent your own encryption algorithm for production systems.

Developers sometimes believe that a custom algorithm is more secure because attackers do not know how it works.

In cryptography, that is usually the opposite of what we want.

Use established algorithms and well-maintained cryptographic libraries that have been reviewed extensively.

16 of 20

DATSEC1 • CRYPTOGRAPHY

Choosing the Right Technique

Module 1 — Cryptography Foundations and Practical Tooling

Prof. Justin David Pineda | Assistant Professorial Lecturer

Send binary data safely in text

→

ENCODING

Base64

Check whether a download changed

→

HASHING

SHA-256

Keep a file confidential

→

ENCRYPTION

AES-based authenticated encryption

Verify a password without storing it

→

PASSWORD HASHING / KDF

Argon2 / scrypt / bcrypt / PBKDF2

Prove who signed a document

→

DIGITAL SIGNATURE

Public-key signature scheme

Start with the security objective. Then select the primitive and implementation.

This slide turns the concepts into practical decisions.

Suppose I need to transmit binary data through a text-only format.

I may use encoding, such as Base64.

Suppose I downloaded an ISO file and want to verify whether it was modified.

I can calculate its SHA-256 hash and compare it with a trusted value.

Suppose I have a confidential document that unauthorized people should not be able to read.

Now I need encryption.

Suppose I need to verify passwords.

I should use an appropriate password-hashing or key-derivation function such as Argon2, scrypt, bcrypt, or PBKDF2—not reversible encryption and not a plain fast hash.

Suppose I need evidence that a particular private key holder approved or signed a document.

That is where digital signatures become relevant.

The sequence should therefore be:

Identify the security requirement → choose the appropriate cryptographic primitive → implement it correctly.

Do not start with:

"Let's use AES."

Start with:

"What security problem are we trying to solve?"

Then choose the technology.

That is a much better cybersecurity mindset.

17 of 20

DATSEC1 • CRYPTOGRAPHY

Module Summary

Module 1 — Cryptography Foundations and Practical Tooling

Prof. Justin David Pineda | Assistant Professorial Lecturer

Cryptography supports multiple goals

Confidentiality, integrity, authentication, and non-repudiation are distinct requirements.

Encoding ≠ hashing ≠ encryption

They differ in purpose, reversibility, and use of keys.

Keys matter

Modern cryptography assumes algorithms can be public; key protection is critical.

Classical ciphers teach concepts

They are useful for learning but not appropriate for modern security.

Tools make concepts observable

CyberChef, OpenSSL, and Python let us experiment with transformations and verify what each technique actually does.

There are five major ideas I want you to remember from this module.

First, cryptography supports several security goals.

Confidentiality is only one of them.

We also care about integrity, authentication, and non-repudiation.

Second:

Encoding, hashing, and encryption are different things.

Encoding changes representation.

Hashing creates a one-way digest.

Encryption provides reversible confidentiality using a key.

Third, keys are critical.

A strong cryptographic algorithm can become ineffective if its keys are exposed or poorly managed.

Fourth, classical ciphers are useful educational tools because they allow us to understand basic cryptographic concepts.

But they should not be mistaken for secure modern cryptography.

Finally, tools such as CyberChef, OpenSSL, and Python allow us to see these concepts rather than merely reading definitions.

Whenever you encounter a cryptographic operation, ask:

What is the input?

What is the output?

Is it reversible?

Does it require a key?

What security property does it provide?

If you can answer those five questions, you will already avoid many common misconceptions about cryptography.

18 of 20

DATSEC1 • CRYPTOGRAPHY

Knowledge Check — Class Participation

Module 1 — Cryptography Foundations and Practical Tooling

Prof. Justin David Pineda | Assistant Professorial Lecturer

Choose ONE question to answer. Explain in your own words and use a practical example when possible.

Why is Base64 not a form of encryption?

What is the difference between plaintext and ciphertext?

What role does a cryptographic key play in encryption?

How is hashing different from encryption?

Which cryptographic security goal protects data from unauthorized reading?

How can hashing help detect whether a file was modified?

Why are classical ciphers such as Caesar cipher unsuitable for protecting modern data?

What is one practical difference between symmetric and asymmetric cryptography?

Why is key management important even when a strong algorithm such as AES is used?

Give one real-world scenario and identify whether you would use encoding, hashing, encryption, or a digital signature—and explain why.

For our Class Participation activity, there are ten questions on the slide.

You only need to choose one question.

I do not expect everyone to answer all ten.

The purpose is to see whether you can explain one concept clearly in your own words.

Try not to simply repeat the definition from the slide.

For example, if you choose:

Why is Base64 not encryption?

Do not simply answer:

"Because Base64 is encoding."

Explain why.

A stronger answer would say that Base64 changes the representation of information, but anyone who recognizes Base64 can reverse it without possessing a secret key. Therefore, it does not provide confidentiality.

Whenever possible, give me a practical example.

If you choose the question about hashing, perhaps talk about verifying a downloaded installer.

If you choose encryption, perhaps talk about protecting files on a stolen laptop.

If you choose key management, imagine a company using excellent encryption but storing the encryption key in a public repository.

The objective is not memorization.

I want to see whether you can connect the cryptographic concept to an actual cybersecurity situation.

19 of 20

DATSEC1 • CRYPTOGRAPHY

Exercise for Next Meeting — Crypto Tool Familiarization

Module 1 — Cryptography Foundations and Practical Tooling

Prof. Justin David Pineda | Assistant Professorial Lecturer

Group Exercise: “What Does This Technique Actually Do?”

Part A — CyberChef

Perform and reverse:�• Base64 encoding�• Hex encoding�• ROT13 / Caesar cipher��Then generate SHA-256 for two similar messages.

Part B — OpenSSL / Python

Generate at least:�• One SHA-256 digest�• One random value�• One Base64 output in Python��Record commands/code and outputs.

Part C — Analysis

For each operation identify:�• Purpose�• Reversible or not?�• Key required?�• Security property�• Appropriate real-world use

Submission / presentation: 5–7 slides per group with screenshots, observations, and a short conclusion. Use only test/sample data.

For the exercise, you will work as a group and perform practical experiments.

The title is:

“What Does This Technique Actually Do?”

That question summarizes the purpose of the exercise.

Part A — CyberChef

Start with simple test data.

Try Base64 encoding.

Decode it and confirm that you can recover the original message.

Do the same with hexadecimal.

Then experiment with ROT13 or a Caesar cipher.

Finally, calculate SHA-256 hashes for two nearly identical messages.

Take screenshots, but screenshots alone are not enough.

Explain what you observed.

Part B — OpenSSL or Python

Generate at least one SHA-256 digest.

Generate a random value using OpenSSL.

Then perform Base64 encoding using Python.

Again, document what happened.

Part C — Analysis

This is actually the most important part.

For every operation, answer:

What was its purpose?

Was it reversible?

Did it require a secret key?

What security property did it provide?

Where would this technique realistically be used?

Your presentation should be approximately 5–7 slides per group.

Do not overload the slides with screenshots.

Show enough evidence that you performed the experiment, then focus on your interpretation.

And again, use only test data.

No actual passwords.

No company secrets.

No client data.

No production cryptographic keys.

20 of 20

DATSEC1 • CRYPTOGRAPHY

References

Module 1 — Cryptography Foundations and Practical Tooling

Prof. Justin David Pineda | Assistant Professorial Lecturer

NIST. (2020). Recommendation for Key Management: Part 1 — General (SP 800-57 Part 1 Rev. 5).

NIST. (2015). Secure Hash Standard (SHS) (FIPS PUB 180-4).

NIST. (2001; updated). Advanced Encryption Standard (AES) (FIPS PUB 197).

Paar, C., & Pelzl, J. (2010). Understanding Cryptography: A Textbook for Students and Practitioners. Springer.

Ferguson, N., Schneier, B., & Kohno, T. (2010). Cryptography Engineering. Wiley.

Menezes, A. J., van Oorschot, P. C., & Vanstone, S. A. (1996). Handbook of Applied Cryptography. CRC Press.

OpenSSL Project. OpenSSL Documentation — command-line and cryptographic library references.

GCHQ. CyberChef — browser-based data transformation and analysis tool.

Python Software Foundation. Python Standard Library: hashlib and base64 modules.

Note: Tool demonstrations are for controlled educational use. Do not process confidential, client, or production secrets in public/online tools.

These are the primary references supporting our introductory discussion.

You will notice that several references come from NIST, particularly standards and guidance relating to cryptographic algorithms and key management.

For example, NIST SP 800-57 discusses key-management practices.

FIPS 180-4 specifies the Secure Hash Standard, including SHA-family algorithms.

FIPS 197 specifies AES.

We also have several established cryptography textbooks.

Understanding Cryptography by Paar and Pelzl is particularly useful for students because it balances theory and implementation.

Cryptography Engineering by Ferguson, Schneier, and Kohno takes a practical engineering perspective.

The Handbook of Applied Cryptography is an older but influential reference covering a wide range of cryptographic concepts.

For our practical work, we will also refer to documentation for OpenSSL, CyberChef, and the Python standard library.

One final reminder as we move into the practical portion of the course:

Cryptographic tools are powerful, but using a tool does not automatically mean we are doing cryptography correctly.

Throughout DATSEC1, our approach will be:

Understand the security requirement → understand the cryptographic concept → use the tool → interpret the result.

That progression is more important than simply memorizing commands.