Match the function to the question
Cryptography uses mathematical constructions to protect information and establish evidence about it. Start with the question you need answered: who may read this, has it changed, who authorized it, or how do two systems establish protected communication? Different tools answer different questions.
| Tool | Useful question | Important dependency |
|---|---|---|
| Encryption | Can someone without the key read the protected content? | Appropriate algorithm, mode, key handling and endpoint protection. |
| Cryptographic hash | Does this exact byte sequence match a known digest? | A trustworthy reference digest; a hash by itself is unkeyed. |
| Message authentication code | Did someone holding the shared secret authenticate this data? | Both parties share a protected key. |
| Digital signature | Does this signed data verify under a particular public key? | Trustworthy key ownership and verification of the intended content. |
| Key establishment | How do peers obtain shared keying material? | An authenticated protocol and sound implementation. |
On a narrow screen, scroll the table sideways. Keyboard users can focus the table and use the arrow keys.
Encoding changes representation. Base64, for example, makes binary data convenient to transport as text; anyone who knows the format can decode it. Compression reduces size. Neither operation supplies the secrecy promised by encryption.
Encryption protects content with a key
Symmetric encryption uses shared secret key material. AES is a standardized block cipher with 128-, 192- or 256-bit keys, as specified in FIPS 197. A complete encryption scheme also defines how blocks or streams are handled and how integrity is protected.
Authenticated encryption combines confidentiality with an integrity check. Its implementation must follow the selected scheme’s requirements for nonces, keys and verification. A nonce is a value with scheme-specific uniqueness or randomness rules; treating it as an arbitrary reusable field can break the design.
Public-key techniques use a related public/private pair for tasks such as signatures or establishing secret material. Practical systems often combine public-key operations with efficient symmetric encryption for the message data. Product descriptions that mention only an algorithm name leave out the protocol and its operation.
A longer number is meaningful only in context. AES key length, an RSA modulus length and an elliptic-curve parameter are different quantities. Compare algorithms through security-strength guidance and protocol requirements, rather than ranking their printed bit counts.
Use hashes with a trusted reference
A cryptographic hash maps a message to a fixed-size digest. A secure design makes finding certain collisions or reversing the function computationally infeasible under its security assumptions. Different inputs can mathematically share an output because the output space is finite; the practical protection is the difficulty of deliberately finding the relevant collision.
Passwords need a specialized storage process with salts and an appropriate cost, so an attacker must spend effort testing guesses. Argon2, described in RFC 9106, is a memory-hard function for that purpose. Use a maintained authentication library and its current guidance; a fast general-purpose hash alone is a poor password-storage design.
Connect a signature to an identity
A digital signature is generated with a private signing key and verified with the corresponding public key. NIST’s Digital Signature Standard describes signature mechanisms. Verification establishes a relationship between the signed data and key; identifying the responsible person or organization requires trustworthy key ownership and operating controls.
A certificate can bind an identity or name to a public key under an issuer’s signature. A relying system checks the chain, intended use, relevant name and status according to its protocol. Trust is built from those checks, not from the appearance of a certificate file.
For a document workflow, also inspect what was signed. A valid signature over an unrelated attachment or an earlier revision cannot establish authorization for the document currently being acted on. The application must connect the verified bytes to the business action.
See how a protocol combines the pieces
TLS is an example of composition. Its handshake establishes authenticated communication and keying material; its record protection uses the resulting keys to protect traffic. The TLS 1.3 specification, RFC 9846 describes those roles. The application still decides how the peer identity fits the service being requested.
For a file upload, the protected browser connection is one layer. The service then needs authorization for the destination folder, protected storage, access logging and a recovery policy. After a recipient downloads the file, that copy belongs to another protection boundary.
Key management connects all these layers over time. NIST’s key-management guidance covers key protection and lifecycle concerns. Record owners, permitted uses, dependencies, replacement procedures and recovery requirements. Retire keys only after determining what still requires them.
Use maintained protocols and libraries for real systems. A small educational example can explain a primitive, while deployment requires error handling, updates, testing and expert review of the complete system.