Use cryptography correctly. This one-day course covers symmetric encryption (AES-GCM), asymmetric crypto (RSA, ECDSA, Ed25519), password hashing (Argon2id, bcrypt), key derivation, TLS configuration, certificate management, common crypto mistakes, key management (KMS, Vault) and post-quantum readiness. Hands-on in Python, Node.js, Java and Go.
Hands-on cryptography in four languages. Every module includes implementation exercises. (Times are approximate.)
Implement AES-256-GCM encryption and decryption in Python, Node.js, Java and Go. Understand authenticated encryption, nonce generation (never reuse), and additional authenticated data (AAD). Compare AES-GCM with AES-CBC and understand why CBC with HMAC is fragile. Each language uses its standard library, not a wrapper.
Generate RSA and ECDSA key pairs. Sign and verify data with ECDSA (P-256, P-384) and RSA-PSS. Encrypt and decrypt with RSA-OAEP. Understand key sizes, performance tradeoffs, and when to use each algorithm. Cover Ed25519 as the modern alternative.
Passwords must be hashed with memory-hard functions. Implement Argon2id (preferred), bcrypt, and scrypt. Understand the tuning parameters (time, memory, parallelism) and how to set them for your hardware. Cover the migration path from older hashing to Argon2id without forcing password resets.
Derive keys from passwords (PBKDF2) and from shared secrets (HKDF). Understand the extract-then-expand pattern. Implement both in Python and Node.js. Cover when to use each and why HKDF is not a password hashing function.
Cryptographic security depends on unpredictable random numbers. Use the OS CSPRNG (os.urandom, crypto.randomBytes, SecureRandom, crypto/rand). Understand why Math.random() and random.random() are not cryptographically secure. Cover seeding, entropy sources, and testing randomness.
Configure TLS correctly for web servers and APIs. Cover TLS 1.3 (preferred), cipher suite selection, HSTS, OCSP stapling, and certificate transparency. Test your configuration with testssl.sh and SSL Labs. Understand the common misconfigurations that downgrade security.
Manage X.509 certificates for TLS and code signing. Cover certificate lifecycle (issuance, renewal, revocation), Let's Encrypt automation, private CAs for internal services, and certificate pinning. Implement automated certificate renewal in a CI/CD pipeline.
Review the most common cryptographic mistakes developers make: ECB mode, nonce reuse, unauthenticated encryption, using encryption for integrity, weak random numbers, key in source code, and rolling your own crypto. Each mistake is demonstrated and then corrected.
Store keys in hardware or managed services, not in your application. Implement key management with AWS KMS, GCP KMS, Azure Key Vault, and HashiCorp Vault. Cover envelope encryption, key rotation, access policies, and audit logging. Understand the operational model for each option.
Quantum computers will break RSA and ECC. Understand the timeline, the NIST post-quantum standards (ML-KEM, ML-DSA, SLH-DSA), and what you should do today: inventory your cryptographic assets, plan migration to hybrid (classical + PQ) schemes, and test PQ algorithms in your environment.
Hands-on lab: given a set of cryptographic operations implemented incorrectly (wrong mode, reused nonce, missing authentication, weak random), identify each flaw and fix it. Then implement a complete encrypt-sign-verify-decrypt pipeline. Course wrap-up and take-away reference card.
One day of hands-on cryptography for developers. AES-GCM, ECDSA, password hashing, TLS, key management and post-quantum readiness. Four languages, one day.
Corporate and sovereign cohorts, and bespoke on-site delivery, on request.