Cryptography A–Z (2026): ECES Certification Prep

— Symmetric Cryptography

This is the foundation of the entire course. We start at the very beginning — how ciphers actually transform data using substitution and transposition — and build up through the binary math that powers encryption, including a hands-on look at XOR that you can do yourself. From there we cover keys and keyspace, stream versus block ciphers, and the full story of the standards: how DES built the industry and fell to brute force, why 3DES was a patch that's now retired, and how AES came to run the world. We finish with modes of operation — why ECB leaks patterns, how CBC and CTR work, and why authenticated encryption (AES-GCM) is the modern default.

The theme: one shared key, built for speed — and everything the rest of cryptography is built on top of.

Maps to ECES Domain 2 (Symmetric Cryptography & Hashes).

Includes exam tips, real-world war stories, a recap, knowledge-check questions, and a downloadable student PDF.

Asymmetric Cryptography

Here we solve the problem symmetric cryptography couldn't: how do two strangers share a secret over a hostile network? This lesson unpacks the public/private key pair and the one-way trapdoor math behind it, then walks the classical big three — RSA, Diffie-Hellman, and elliptic curve cryptography — covering what each is for and where it's used. You'll learn how digital signatures deliver authentication and non-repudiation, why we use hybrid encryption in practice, and which signature algorithms are approved in 2026 (and which have been retired). We close on the headline change of the decade: the quantum threat and the new post-quantum standards — ML-KEM, ML-DSA, and SLH-DSA — that are already being deployed.

The theme: two keys, one revolution — and the migration that's reshaping security right now.

Maps to ECES Domain 3 (Number Theory & Asymmetric Cryptography).

Includes exam tips, real-world war stories, a recap, knowledge-check questions, and a downloadable student PDF.

Hashing & Message Integrity

This module is about proving that data hasn't changed. We cover what a hash really is — a one-way fingerprint — and the security properties that make one cryptographic, including a live demonstration of the avalanche effect where a single deleted letter transforms the entire output. You'll learn the birthday attack and why it dictates hash sizes, the crucial difference between hashing, encryption, and encoding, and the 2026 scorecard: MD5 and SHA-1 are broken, SHA-2 and SHA-3 are the approved families. We finish with the two applications everyone gets wrong — HMAC for authenticated integrity, and password storage done right with salting and slow, memory-hard hashes like Argon2.

The theme: integrity you can prove, and the everyday mistakes that cause the biggest breaches.

Maps to ECES Domain 2 (Symmetric Cryptography & Hashes).

Includes exam tips, real-world war stories, a recap, knowledge-check questions, and a downloadable student PDF.

This lesson is the trust machinery behind every padlock in your browser. We start with the problem certificates solve — how do you know a public key really belongs to who it claims? — then read an X.509 certificate field by field and meet the cast: certificate authorities, registration authorities, intermediates, and the trust store. You'll walk the chain of trust, compare validation levels and trust models, and trace the full certificate lifecycle, including the exam-favorite distinction that expired is not the same as revoked. We finish with what's changing fast in 2026: shrinking certificate lifetimes, automation, Certificate Transparency, and the arrival of post-quantum certificates.

The theme: how raw keys become verified identities — who vouches for whom, and how.

Maps to ECES Domain 4 (Applications of Cryptography).

Includes exam tips, real-world war stories, a recap, knowledge-check questions, and a downloadable student PDF.

This is where everything comes together. In this lesson, we take the primitives you've learned — symmetric ciphers, key exchange, hashing, and certificates — and watch them go live in the systems you use every single day.

We'll walk the TLS 1.3 handshake step by step (including the new post-quantum hybrid key exchange), break down VPN technologies from IPsec to WireGuard, and tell the full Wi-Fi security story — why WEP collapsed and how WPA2 and WPA3 fixed it. Then we cover data at rest with full-disk and file encryption, secure email with PGP and S/MIME, modern end-to-end messaging like Signal, the authentication protocols behind your network (Kerberos, CHAP, EAP-TLS), and finish with steganography — the art of hiding a message's very existence.

The theme running through it all: real systems rarely fail because the math broke — they fail at the seams, in how the pieces are wired together. By the end, you'll be able to look at any secure system and name exactly which cryptographic tools it's using, and why. This lesson maps directly to Domain 4 of the ECES exam.

You can't defend what you don't understand how to attack — so this final content module teaches you to think like the adversary. We classify attacks by what the attacker knows (the attack models), then cover the classic techniques from thousand-year-old frequency analysis to the linear and differential cryptanalysis that stress-test modern ciphers. You'll see why real-world breaks usually come from brute force, side channels, and password cracking rather than elegant math. We finish with the quantum threat done properly: what a quantum computer actually does, the all-important Shor-versus-Grover distinction, and how quantum key distribution differs from post-quantum cryptography.

The theme: know how ciphers break, and you'll never design blind.

Maps to ECES Domain 5 (Cryptanalysis & Quantum Computing).

Includes exam tips, real-world war stories, a recap, knowledge-check questions, and a downloadable student PDF.