🔐 Cyber Security Lesson 05 — Cryptography

1. Symmetric vs Asymmetric Encryption

Symmetric Example (AES):
  Encrypt: data + key → ciphertext
  Decrypt: ciphertext + same key → data

Asymmetric Example (RSA):
  Ko gives his Public Key to Ma Ma
  Ma Ma encrypts message with Ko's Public Key
  Only Ko's Private Key can decrypt it!

2. Hashing

Hashing = One-way function → fixed-length output
Encryption ≠ Hashing  (hash ကို decrypt လို့ မရ!)

SHA-256 example:
"hello"      → 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b982
"hello!"     → ce06092fb948d9af6f32f0fddcd83ea3529fc3e62d7c32b6cde285b3b048c58
↑ tiny change → completely different hash (Avalanche effect)

Common hash algorithms:
MD5      — 128-bit — ❌ Broken (collision attacks)
SHA-1    — 160-bit — ❌ Broken
SHA-256  — 256-bit — ✅ Strong (Bitcoin uses this)
SHA-512  — 512-bit — ✅ Very strong
bcrypt   — ✅ Best for passwords (has salt + rounds)
Argon2   — ✅ Winner of Password Hashing Competition

# PHP password hashing
$hash = password_hash("mypassword", PASSWORD_BCRYPT);
// $2y$10$... (includes salt automatically)

$valid = password_verify("mypassword", $hash); // true

# Python
import hashlib
h = hashlib.sha256(b"hello").hexdigest()

3. SSL/TLS — HTTPS ဘယ်လို အလုပ်လုပ်သလဲ

TLS Handshake (simplified):
1. Client → Server: "Hello, TLS 1.3 support ရတယ်"
2. Server → Client: Certificate (Public Key ပါတဲ့) ပေး
3. Client: Certificate ကို CA နဲ့ verify လုပ်
4. Client: Session key generate → Server Public Key နဲ့ encrypt ပြီး ပို့
5. Server: Private Key နဲ့ decrypt → session key ရ
6. Both: Symmetric AES key တစ်ချောင်းကို share ပြီး data encrypt

Result: All communication encrypted!
  HTTP  → data plain text (wireshark နဲ့ ဖတ်လို့ ရ)
  HTTPS → encrypted (wireshark မှာ gibberish ပဲ ပြ)

4. Digital Signatures

Digital Signature = Document ကို sign လုပ်ပြီး verify လုပ်

How it works:
1. Ko writes document
2. Ko hashes document → SHA-256
3. Ko encrypts hash with his PRIVATE KEY = Signature
4. Sends document + signature

Verification (by Ma Ma):
1. Decrypt signature with Ko's PUBLIC KEY → hash
2. Hash the document herself
3. If hashes match → ✅ Ko did sign it (Authenticity)
                   → ✅ Document unchanged (Integrity)

Real world uses:
📜 Code signing (software downloads)
✉️ Email signing (S/MIME, PGP)
🔗 SSL certificates
₿ Bitcoin transactions

5. PKI — Certificate Authority

PKI = Public Key Infrastructure
CA  = Certificate Authority (trusted third party)

CA examples: DigiCert, Let's Encrypt, Comodo

Chain of Trust:
Root CA (OS/Browser built-in)
  └── Intermediate CA
        └── Website Certificate (mysite.com)

When you visit https://mysite.com:
1. Site shows certificate
2. Browser checks: Is it signed by trusted CA?
3. Certificate expired? Domain match?
4. ✅ Lock icon shows → safe connection

Self-signed certificates:
- Free, instant
- Browser shows "Not secure" warning
- OK for internal/dev use only

6. Cryptography Quick Reference