Identity & cryptography
Understand trust, protect sensitive data, and learn why cryptographic systems fail.
40 guides · 7 labs · 3 local projects · 2 learning paths
Start here
Sign-in, sessions and recovery
Sessions, password storage, passkeys and MFA, and account recovery.
Session management: cookies, timeouts, rotation and revocation
Model authentication as transitions in server authority, set session cookies and timeouts to current NIST and OWASP values, and verify fixation prevention, expiry, reauthentication, revocation and stolen-cookie defenses.
Password storage: hashing parameters and rehash on login
Choose Argon2id, scrypt, PBKDF2 or bcrypt with current minimum parameters, store a versioned hash, and upgrade old hashes after a successful login without overwriting a reset.
Passkeys and MFA: WebAuthn enrollment, sign-in and replacement
Register, verify and replace passkeys with WebAuthn so phishing resistance survives the account’s whole lifecycle, and map passkeys and other MFA methods to the NIST SP 800-63B-4 assurance levels.
Account recovery: password resets, help-desk resets and account linking
Treat password resets, support-desk recovery and account linking as new grants of authority: single-use high-entropy proofs, atomic consumption, session revocation, and stable identity rather than email matching.
Case study: the Okta support-system breach and session tokens in HAR files (2023)
How a service account password saved to a personal browser profile let an attacker download customers' HAR files from Okta's support system, replay the session tokens inside them against five customers, and stay unseen for two weeks; and why HAR files are credentials, admin sessions need binding, and every exposed credential must be rotated.
Case study: Citrix Bleed (CVE-2023-4966)
How a NetScaler memory over-read leaked session cookies that bypassed passwords and MFA in 2023, why patching did not end hijacked sessions, and how the pattern returned in 2025.
Federation and tokens
OAuth and OpenID Connect, JWT validation, SAML and SCIM provisioning.
OAuth 2.0 and OpenID Connect login: authorization code with PKCE
Implement OAuth 2.0 and OpenID Connect login with the authorization code flow and PKCE, keep each transaction bound to its browser, and block redirect, mix-up, code-injection and token-theft attacks.
JWT validation: algorithms, keys, claims and key rollover
Validate a JWT against a fixed algorithm, trusted keys and the expected issuer, audience and type, reject the known header attacks, and rotate signing keys without accepting arbitrary keys or breaking valid tokens.
SAML single sign-on: verify signed assertions without losing the identity boundary
Bind a validated SAML assertion to its trusted issuer, the exact signed element, your service, the browser request and a replay record before creating a local session, and keep your SAML library ahead of its advisories.
SCIM deprovisioning: make account disablement remove every usable authority
Connect SCIM resource updates to current sessions, tokens, group-derived permissions and background jobs, with explicit tenant mapping, CAEP revocation events and a measurable revocation contract.
Defend JWTs against forgery, confusion and replay
Verify a JWT as an issuer-, type- and audience-bound assertion with an algorithm allowlist and trusted keys, closing the alg "none", key-confusion, header-injection, weak-secret and replay attacks.
Stop account takeover with the right MFA and login defenses
Rank MFA options by the attacks they stop, implement TOTP and push approvals correctly, and close the login, reset and recovery paths that attackers use instead of breaking the second factor.
Defend OAuth and OIDC against redirect and token attacks
Apply RFC 9700 and RFC 10017: exact redirect matching, PKCE with downgrade protection, state and iss binding, refresh-token rotation, sender-constrained tokens, and a backend-for-frontend so browser tokens cannot be stolen.
Case study: Storm-0558 and the forged Microsoft tokens (2023)
How a stolen 2016 consumer signing key and a token validation gap let Storm-0558 read enterprise Exchange Online mail in 2023, and what the review board found about rotation, logging and culture.
Authorization and workload identity
Authorization models you can test, and short-lived identities for services.
Workload identity federation: short-lived, scoped identities for services and CI
Trace how a running workload obtains a short-lived identity, write cloud trust policies that match immutable claims instead of names or wildcards, and keep the resulting credential limited by audience and authorization.
Authorization models: RBAC, ABAC, ReBAC and policy as code you can test
Translate roles, attributes and relationships into explicit subject-action-resource decisions, prevent broken object level authorization (BOLA), and verify ownership and tenant boundaries with tests.
Encryption, keys and secrets
Authenticated encryption, key rotation, TLS, post-quantum planning and secrets.
Secrets management: storage, rotation and leaked-secret response
Follow one application credential from issuance through caching, rotation, revocation and restored backups, prove that its old value stops working, and respond correctly when a secret leaks.
AEAD records: AES-GCM nonces, associated data and key limits
Build an encrypted record whose tag binds ciphertext to the intended tenant, record, purpose and format, keep nonces unique within each key’s usage limit, and verify the design with actual AES-GCM.
Envelope encryption and key rotation: data keys, KMS keys and backups
Encrypt each record with its own data key, wrap that key in a KMS or HSM key, and keep wrapping-key rotation, data re-encryption, key deletion and restored backups as separate, tested operations.
Operate TLS and certificates: configuration, renewal and verification
Configure a modern TLS profile with hybrid post-quantum key exchange, automate renewal for certificate lifetimes that fall to 47 days, and verify every termination point with a fresh handshake.
Post-quantum migration: cryptographic inventory, hybrid TLS and deadlines
Inventory public-key cryptography by operation, owner and lifetime, turn on hybrid ML-KEM key exchange where it is already available, and plan signature and archive migration against the NIST, NSA, NCSC and EU dates.
Choose cryptographic algorithms and parameters by job
A sourced quick reference for October 2026: which algorithm and parameters to use for encryption, hashing, passwords, MACs, signatures, key agreement, key derivation, randomness and TLS, the matching APIs in Node.js, Python, Java, Go and .NET, and where post-quantum migration stands.
Contain a leaked secret, then investigate and clean up
Revoke an exposed API key, token or private key at its issuer before anything else, end the sessions it minted, check the provider's logs, then remove every copy and replace it with a credential that expires on its own.
Secrets at runtime: Vault, Kubernetes Secrets, CSI driver, External Secrets and SOPS
How a running workload should get its credentials: encrypt Kubernetes Secrets with a KMS v2 provider and lock down RBAC, mount from an external store with the Secrets Store CSI Driver, sync with External Secrets Operator, issue dynamic credentials with Vault and its Agent Injector, keep Git copies encrypted with SOPS, and make rotation reach the process.
Case study: the LastPass breach (2022)
How an attacker went from a compromised developer laptop to a DevOps engineer's home computer, the keys to LastPass's cloud backups and a copy of customer vaults; why each vault's safety then rested on its master password and PBKDF2 iteration count; and what it teaches about backup keys, privileged endpoints, KDF upgrades and unencrypted metadata.
Case study: certificate expiry outages at Ericsson (2018) and Microsoft Teams (2020), and Equifax's blind spot
How an expired certificate inside Ericsson's core-network software cut mobile data for millions in about 11 countries, how an expired authentication certificate took Microsoft Teams offline, how an expired inspection certificate left Equifax blind for 19 months, through its 2017 breach, and the inventory, automation and testing that prevent each.
Privacy engineering
Collect less, prove deletion, choose privacy transformations deliberately and build GDPR privacy by design into code.
Data minimization and retention: collect less and prove that deletion works
Design collection and deletion around a data-flow graph that includes logs, derived tables, exports and restored backups, and use per-person keys so deletion can reach copies you cannot edit.
Tokenization, pseudonymization and privacy transformations: choose deliberately
Choose between vault tokens, keyed pseudonyms, format-preserving encryption, aggregation and differential privacy by the joins, reversibility and leakage each allows, and test re-identification on the data you release.
GDPR privacy by design for engineers: Articles 25, 32 and 35 in code
Turn GDPR data protection by design and by default, security of processing and DPIA triggers into engineering work: a personal-data inventory checked in CI, defaults that collect and share less, a DPIA screen at design time, and access and erasure requests that reach every store.
Historical failures
How attacks on weak or legacy cryptography work, and what they teach. For new systems, use the current guidance above.
How the attacks work
ECB mode: why it leaks patterns and what to use instead
Derive exactly what ECB reveals and why a longer key cannot fix it, find where ECB enters real code, and replace it with an authenticated mode.
Padding oracle attacks
Use a byte-level CBC example to see how a tiny validity signal becomes plaintext information, then design verification that checks more than the error message.
Hash collisions and digital signatures: MD5, SHA-1 and what to use
Distinguish collisions from preimages, follow a colliding pair through signing and verification, and retire MD5 and SHA-1 from the verifiers that still accept them.
Weak RSA key generation: shared primes, ROCA and safe keys
Recover a toy RSA factor with a greatest common divisor, distinguish shared primes, structured primes, duplicate keys and key length, and check a fleet of real public keys.
RC4 keystream bias
Understand why fresh RC4 keys do not remove keystream bias and how repeated secret positions turn a small statistical effect into evidence.
64-bit block ciphers and the Sweet32 mechanism
Calculate the birthday effect for 64-bit blocks and derive the CBC relation that can turn a collision into a plaintext disclosure.
Case studies, 2001 to 2017
WEP: RC4 key reuse and weak IVs
Separate WEP’s repeated-keystream failure, weak-IV key recovery, and unkeyed integrity weakness through a concrete two-packet exercise.
Flame: MD5 certificate forgery
Follow how a weak digest and an overpowered certificate trust path enabled forged code-signing authority, without equating the event with RSA key theft.
Lucky Thirteen and POODLE: two different oracles
Compare two CBC oracles by their signal, protocol rules, and attacker prerequisites instead of treating them as interchangeable padding bugs.
FREAK and Logjam: export-grade key exchange
Trace two export-grade downgrade paths and separate RSA factorization from finite-field Diffie–Hellman discrete logarithms.
DROWN: one RSA key across incompatible protocols
Map an RSA key across services to see how an SSLv2 oracle could compromise TLS traffic on a different endpoint.
Sweet32: the cost of a small block size
Read the 2016 Sweet32 demonstrations as evidence about traffic volume, repeated secrets, and session lifetime rather than treating a block-size threshold as an instant exploit.
ROCA: structured RSA key generation
Understand why mathematically structured RSA primes were factorable despite normal key lengths, then plan replacement around generation provenance.
Cryptography without shortcuts
Pick primitives by job, build authenticated records, rotate keys, run TLS, plan post-quantum migration, then study past failures.
Learning path · 14 stepsIdentity through the whole lifecycle
Connect login, token verification, phishing-resistant credentials, recovery and authorization to testable boundaries.
JWT validation lab: Validate the purpose and audience of a token
An API accepts a correctly signed token intended for another service. Repair claim validation after the trusted signature verifier has finished.
Password reset token lab: Make a recovery credential single-use
A recovery link can be redeemed twice when two requests arrive together. Repair redemption so token validation and account changes share one atomic operation.
AES-GCM nonce reuse lab: Fix a nonce allocator that breaks after restart
A service encrypts payment instructions with AES-GCM. Its local counter resets after a restart and exposes another message. Repair the allocator without changing the encryption algorithm.
JWT verification lab: Verify a JWT before trusting it
An API decodes the JWT it receives and trusts the claims without checking the signature or the algorithm, so an attacker can forge an admin token with alg "none" or sign one with a key the API never issued. Repair the verifier so it confirms the algorithm and signature first, then the claims.
OAuth redirect and PKCE lab: Match redirect URIs and verify PKCE
An authorization server accepts any redirect_uri that starts with a registered one, skips PKCE for codes issued without a challenge and accepts the plain method. Repair both checks so stolen or injected codes cannot be redeemed.
Insecure randomness lab: Generate unguessable API keys
An integration service issues 16-character API keys from Math.random, which is not built to be unpredictable. Take every character from the system’s secure generator, lengthen the key and map bytes without bias.
Password hashing lab: Verify and upgrade an Argon2 password hash on login
A login check verifies stored password hashes but never upgrades a weak or outdated one, so hashes created with tiny parameters or the wrong Argon2 variant stay that way forever. Repair check_login to verify with Argon2id at the policy minimum and rehash on a successful login.
Bind ciphertext to the correct record
Use Web Crypto AES-GCM to reject tampered ciphertext and cross-tenant record transplants. Repair authenticated context binding.
Verify tokens through rotation and revocation
Operate a real loopback JWKS endpoint and signed-token API. Repair issuer, audience, purpose and session checks, then test planned rotation, stale key caches and emergency revocation.
Prove deprovisioning reaches sessions and queued work
Repair a durable SQLite identity lifecycle model. Disable current sessions/tokens, remove group-derived authority, cancel pending jobs, and handle duplicate, stale and interrupted changes without crossing tenant boundaries.
JWT inspector
Decode a JWT, flag alg none, key confusion, weak HMAC secrets, risky kid, jku and jwk headers and missing or expired claims, and verify HS256, RS256, ES256 or Ed25519 signatures.