$cat ~/posts/criptografia-ciencia-a-parte

bilingual · en / pt

← /blog

cryptography is a science of its own

2026-09-16·en·31 min read·criptografiasegurancaiaestudos

I left a class on cryptography angry at how it was run, and went looking. It wasn't the subject that lost me: I was following well enough to notice the class drifting off topic and leaving wrong things behind on the way. This post is what I wish I had heard, written for someone who has never seen the math and for someone who already lives in it.

A note on scope: I am not a cryptographer. This whole post is the argument for why that sentence matters.

the question that stayed

Every developer uses cryptography every day. You opened this page over TLS, and if it asks for a password anywhere, there is a hash in the middle. It is the most universally used and least universally understood technology in our profession.

And the question that stuck with me was: why does nobody explain the concept before the acronym? You can sit through a full hour of WEP, WPA2, WPS, SSL, tokens and certificates and walk out unable to say what a key is. The acronym is the end of the story. Starting there is starting at the end.

So let's start at the beginning. And the beginning is a lot older than it sounds.

three thousand years of scrambling

The first cryptography we have a decent record of had no math in it at all. It was a stick.

The Spartans wrapped a strip of leather around a rod of a specific thickness and wrote the message along its length. Unwrapped, the strip was a pile of loose letters that meant nothing. To read it you needed a rod of the same thickness. They called it a scytale.

Notice what the thickness of the rod is in that story: it's the key. Nobody used the word, but the role is exactly that: the piece of information that separates who can read from who can't.

About six hundred years later, Caesar was doing something else. Instead of scrambling the position of the letters, he replaced each letter with another one, three places further down the alphabet. A becomes D, B becomes E, and so on until the alphabet wraps around.

shift the alphabet three places: the whole operation fits on one line, and for that same reason the key space fits in twenty-five tries.

Those two ideas, move the position and swap the symbol, are the basis of everything that came in the following three thousand years. The rest was refinement.

And the obvious refinement showed up fast: instead of shifting the alphabet by a fixed number, shuffle the whole thing. Every letter becomes some other letter, with no pattern. That gives a number of possible arrangements with twenty-six digits, which at the time looked like the end of the conversation.

It wasn't.

  1. 700 BCscytalesparta wraps the strip around the rod. the thickness is the key, and nobody yet has a word for that.
  2. 50 BCCaesar ciphersubstitution by fixed shift. twenty-five possible keys, which only becomes a problem once someone thinks to try them all.
  3. 850Al-Kindifrequency analysis in Baghdad. the first systematic method for breaking a cipher without holding the key.
  4. 1553Vigenèrethe polyalphabetic cipher that held for three centuries and earned the nickname le chiffre indéchiffrable.
  5. 1863Kasiskipublishes how to find the length of a Vigenère key by looking for repetitions. the unbreakable one breaks.
  6. 1883Kerckhoffsstates the principle that separates the algorithm from the key, and becomes the rule the field still follows.
each bar is the gap to the next milestone. the gaps run to centuries because almost nothing was happening.

There is one thing the scytale, the Caesar cipher and the shuffled substitution have in common, and it explains why all of them fell: in all three, the secret was the method. Anyone who worked out how the cipher operated could read everything ever written with it, forever.

Al-Kindi and the birth of cryptanalysis

In the ninth century, in Baghdad, a man named Al-Kindi wrote the text that is, to me, the real landmark of this whole post.

His idea is almost embarrassingly simple. In any language, letters don't appear with equal frequency. In English, E and T are everywhere; Q and Z barely show up. Under a substitution, a letter changes clothes but doesn't change frequency. If E becomes Q, then Q will appear in the ciphertext exactly as abundantly as E did in the original.

So you don't need the key. You count the letters.

the cipher doesn't destroy the profile, it only moves it along. finding how far it moved is finding the key.

That sounds small and it's enormous. It's the first systematic attack in history: a procedure anyone can follow, that depends on neither luck nor insight, and that works against an entire family of ciphers instead of one specific message.

Before Al-Kindi, breaking a cipher was talent. After him, it was method.

That's the border this post is named after. The moment a repeatable procedure for attacking exists, a criterion for judging defence exists too: you can say one cipher is better than another, and say why. That's science. The rest was craft.

And Al-Kindi is where cryptography picked up the habit it still has: nobody believes in a cipher because it looks good. They believe it after competent people have tried to break it and failed.

Kerckhoffs: security lives in the key

The Vigenère cipher was the answer to frequency analysis, and it was a good answer. Instead of one substitution alphabet, several, rotating according to a keyword. The same plaintext letter becomes different letters in different positions, and the frequency profile flattens out. For three hundred years it was known as le chiffre indéchiffrable.

In 1863, Kasiski published how to find the length of the keyword by looking for repeated stretches in the ciphertext. Once you have the length, the Vigenère falls apart into several Caesars, and each one dies to frequency analysis. Unbreakable for three centuries, broken in one paper.

Twenty years later, a Dutchman named Auguste Kerckhoffs wrote the sentence that organised the entire field.

A cryptographic system must stay secure even if everything about it is public, except the key. If your security depends on the enemy not knowing how your system works, you don't have security. You have a deadline.

This is less obvious than it sounds today. Kerckhoffs was telling people to give up the most intuitive advantage there is, which is the enemy not knowing what you're doing. And his argument is purely practical: methods leak. People leave teams, equipment gets captured, code gets read. You can change a key in an afternoon; you can't change a method.

That's why the algorithms protecting your bank are published on the internet, with open specifications, and it isn't an oversight. It's the design.

And this is where the rule that closes this post comes from, the one about never inventing your own cryptography. It isn't the conservatism of a field. It's the direct consequence of Kerckhoffs: if security has to live in the key and not in the secrecy of the method, then the method needs to have been read by a lot of people. An algorithm nobody has examined isn't secret. It's just unknown.

one key, or two

Symmetric cryptography is the intuitive idea, the one you already had as a kid: both ends agree on a secret and use it to scramble and unscramble. One key, on both sides.

It's fast, and it's what protects the bulk of your data today: AES is symmetric. But it has a problem that sounds silly and is fatal: how do the two ends agree on the key? If I need a secure channel to send you the key, and the key is exactly what creates the secure channel, I'm walking in a circle.

Asymmetric cryptography breaks that circle. Instead of one key, a pair, bound by math: what one closes, only the other opens. One of them you publish to the entire world. The other never leaves your machine.

symmetric

  1. one key, both sideswhoever encrypts and whoever decrypts hold exactly the same secret.
  2. fast
  3. but how do you agree on it?

asymmetric

  1. a pair of keystwo keys bound by math: what one closes, only the other opens.
  2. one of them is public
  3. breaks the circle, and is slow
the same problem, solved two ways

The part that feels like magic is that publishing one key doesn't give away the other. That rests on math problems that are easy in one direction and absurdly hard in reverse: multiplying two huge primes is trivial, factoring the result back apart is not.

Except this idea is far newer than the rest of this post makes it sound.

Diffie-Hellman and RSA

For three thousand years, the answer to "how do the two ends agree on the key" was always the same: somebody carries it. A courier, a meeting, a briefcase. Cryptography protected the message and outsourced the key problem to logistics.

That worked because the users were governments and armies, and armies have couriers. Once civilian communication started to grow, it stopped working. You can't send a courier for every pair of people who might want to talk, and the number of keys you need grows with the square of the number of participants.

In 1976, Whitfield Diffie and Martin Hellman published a paper showing that two strangers can arrive at a shared secret by talking in public, in front of whoever is listening, without ever saying the secret out loud.

It's worth stopping on that, because it sounds impossible. It isn't a clever way of hiding the key while it's in transit. It's that the key is never sent. Each side combines what it received with something only it knows, and both arrive at the same result by different routes. Whoever listened to the whole conversation holds both public halves and still can't get there.

The following year, Ron Rivest, Adi Shamir and Leonard Adleman published RSA, which takes the next step: beyond agreeing on a key, you can have a permanent pair with one publishable half. That's what finally separates "who can write to me" from "who can read what was written to me".

You can watch it work with small numbers. Pick two primes, and both keys fall out of them:

two small primes
n = p·q
143
φ(n) = (p−1)(q−1)
120
public key (e, n)
(7, 143)
private key (d, n)
(103, 143)
encrypted m^e mod n
81
decrypted c^d mod n
42
RSA with primes small enough to hold in your head, and, for that exact reason, breakable by any computer in milliseconds. Real RSA uses numbers with hundreds of digits.

Two footnotes that I think are worth more than footnotes.

The first is that the British government already had this. James Ellis, Clifford Cocks and Malcolm Williamson reached the same ideas at GCHQ a few years earlier, and it stayed classified until 1997. Discovered first, useless for two decades, because nobody was allowed to use it.

The second is that RSA from 1977 is still standing in 2026. Forty-nine years of very good people trying to break it, in public, and what pushed key sizes up was hardware getting faster, not the math giving way. That's what "tested by time" means in practice.

the digital signature

There's a use of the key pair that almost never gets explained properly, and it's half the reason the internet works.

So far the pair has been used to hide: you encrypt with someone's public key, and only their private key opens it. Now reverse the order. Encrypt with your private key, and anyone can open it with your public one.

That sounds useless, because if anyone can open it there's no secret. And there isn't. There isn't meant to be. What it proves is authorship: if it opened with your public key, it can only have been closed with your private one, which only you hold.

the same key pair, reversed. one direction hides the content, the other proves who wrote it.

In practice nobody signs the whole message, because it would be slow. You sign its hash, small, fixed-size, and completely different if anyone touches a byte of the original. That's why signatures and hashes always travel together, and why a broken hash breaks the signatures with it.

And that's what a website's certificate does. It hides nothing. It's a statement signed by someone your browser already trusts, saying that this public key belongs to that domain. Encrypting perfectly with the wrong impostor is still a useless victory.

A1, A3 and the token

This section exists for a specific reason: this is what the class name-dropped without explaining, and it's the kind of thing that sounds like advanced cryptography when it isn't.

A1 and A3 are types of digital certificate under the Brazilian standard. The difference between them isn't the algorithm, isn't the key size, isn't the math. It's where the private key lives.

the same cryptography in both. what changes is whether the private key can leave the place it was born.

In A1, the private key is a file. You install it on the computer, and it can be copied, moved, backed up, attached to an email by mistake. It's convenient and it's fragile for the same reason.

In A3, the private key is generated inside a USB token or smartcard and never leaves. You don't send the key to the document; you send the document to the device, it signs internally and hands back only the signature. Even with the machine compromised, an attacker can request signatures while the token is plugged in, but can't walk away with the key.

It's the same difference between keeping your house key in your pocket and leaving it in a lock that only works while you're standing there.

And the "token" from the class, which turned up in the same sentence as though it were a third algorithm, is this: a piece of hardware. A possession factor, not a cryptographic primitive. Worse, the word is overloaded: an auth token in an API is something else entirely, a signed string the server issues. Same word, two worlds, and putting both in a list of acronyms is exactly how people learn it wrong.

a hash is not a cipher

This is where most people get lost, and the confusion has practical consequences.

Encrypting is a two-way street: there is a key that undoes it. Hashing is one-way. It takes input of any size and returns a fixed-size summary, and no key undoes it, because there is no information left to undo. When a site says it doesn't know your password, that's what it means: it stored the hash, not the password.

A good hash has a property that's easier to see than to explain. Change one letter of the input, just one, and the entire output becomes something else, with no resemblance to what came before. It's called the avalanche effect:

same text, one letter flipped: Cryptography

and the opposite of that, when a hash fails: two different PDFs with the same SHA-1, published in 2017 by Google and CWI. recorded values, the browser does not recompute SHA-1 here.

shattered-1.pdfshattered-2.pdf
38762cf7f55934b34d179ae6a4c80cadccbb7f0a
SHA-256 computed in your browser. change one letter and watch how much moves.

That's what stops anyone from creeping toward the answer by guided trial and error: there is no "almost right". Either it's the same hash, or there is no information at all in how wrong you were.

And this is where the acronyms finally earn their place, because hashing is somewhere things die. MD5 fell: practical collisions since 2004, two different inputs with the same summary, produced on purpose. SHA-1 fell in 2017, when researchers at Google and CWI published two different PDFs with the same SHA-1. Both still show up in production systems today. SHA-256 is the de facto standard now.

Password hashing is its own case: plain SHA-256 is too fast for it, and speed is exactly what helps whoever is guessing. Passwords need a deliberately slow, salted function: bcrypt, scrypt, Argon2, PBKDF2.

the padlock in the address bar

With keys and hashes in hand, TLS stops being an acronym and becomes a story with a beginning, a middle and an end. And it answers the question left hanging above: if asymmetric is slow and symmetric can't agree on a key, how does the internet work at all?

It works because the two take turns.

browserserverhello + my half of the keyhello + my halfcertificate + signaturedone, symmetric from here

the browser says which ciphers it speaks and already sends its public share of the key agreement.

the TLS 1.3 handshake, simplified: asymmetric hands the baton to symmetric and leaves the stage.

The detail that almost always disappears from the explanation: the shared secret never crosses the network. Each side sends one public half and computes the same result alone. Anyone listening on the wire sees both halves and cannot get to the result.

And the certificate has nothing to do with scrambling data. It answers a different question, which is "who am I talking to anyway". Encrypting flawlessly with the wrong impostor is a useless victory.

About "SSL": the name is dead. SSL 3.0 was retired in 2015, and what runs today is TLS, preferably 1.3. The nickname stuck out of inertia, like still calling a car a motorcar.

the wi-fi that fell four times

Wi-fi is the best cryptography case study there is, because its entire history is public and it repeats: someone publishes a standard, someone breaks it, the standard gets replaced.

  1. 1997WEPreused RC4's initialization vector. broken in 2001; today it falls in minutes.
  2. 2003WPAan emergency patch (TKIP) to run on hardware that already existed. it was always meant to be temporary.
  3. 2004WPA2real AES. it held for thirteen years, until KRACK in 2017 attacked the negotiation, not the cipher.
  4. 2006WPSthe easy-connect button. its eight-digit PIN could be guessed in halves, and it fell in 2011. turn it off.
  5. 2018WPA3replaces the negotiation with a handshake that leaks no material for offline attack. Dragonblood, in 2019, found implementation flaws, not flaws in the idea.
each bar is the gap to the next milestone.

Notice the pattern: WEP died because the math was wrong. WPA2 and WPA3 took their hits through implementation and negotiation. That's the most important distinction in this whole post, and it comes back at the end.

Turing, the hinge

Here the story turns, and it turns on a single point.

Enigma is the most retold piece of cryptography in computing, so I won't retell the film. But the mechanism of the attack is worth telling, because it's the part that matters for the rest of this section.

Enigma had a configuration space large enough to be infeasible to test one by one, even today. What Bletchley Park exploited wasn't brute force: it was structure. The machine had a property that looked harmless: no letter could ever encrypt to itself. Which means that if you guess a message contains a likely word, you can slide that word along the ciphertext and discard every position where some letter lines up with itself.

Those likely words were called cribs, and they came from habit: weather reports sent at the same hour, protocol greetings, messages that always ended the same way. The electromechanical bombe then tested configurations against what was left, and each logical contradiction eliminated a whole block of possibilities at once.

In other words: the full space was never tested. Statistical regularity and prior knowledge of the likely content were used to prune it down to something a machine of that era could walk through.

Hold on to that paragraph, because it comes back shortly under a different name.

And here is the coincidence that isn't one: the man who led that effort is the same man who, twelve years later, wrote "Computing Machinery and Intelligence", the paper that opens with "can machines think" and proposes the test that carries his name.

Cryptography and artificial intelligence came out of the same head, a few years apart.

And it isn't a biographical accident. Reread the description of the attack on Enigma with the vocabulary swapped: intractable search space, pruning by constraint, statistical structure of language, a hypothesis about likely content. That's a description of machine learning written thirty years before the term existed. Both fields were born from the same question: what can a machine infer from what it was never told.

After that they separated, and spent seventy years barely speaking.

cypherpunks, crypto wars and blockchain

There's a chunk of this history that rarely makes it into a class, and it's the chunk that explains why you have cryptography in your pocket.

Until the seventies, strong cryptography belonged to states. What Diffie, Hellman and RSA did was take it out of government hands and put it in a published paper, and the reaction was exactly what you'd expect.

In the United States, cryptography above a certain key size was classified as munitions for export purposes. The same list as tanks and missiles. Exporting software with strong cryptography was, in the letter of the law, arms trafficking.

In 1991, Phil Zimmermann released PGP, which handed military-grade cryptography to anyone with a computer. He spent three years under federal criminal investigation, because the program left the United States over the internet. The defence was a stroke of genius: the source code was published as a book, printed, by MIT Press. Exporting weapons is a crime; exporting a book is protected speech under the First Amendment. The case was dropped in 1996.

In the same spirit, people walked around in t-shirts printed with four lines of Perl implementing RSA, with a warning that the shirt was, technically, a controlled export munition. It was a joke and a real piece of litigation at the same time.

Behind all of this was a mailing list, started in 1992, where these people organised. Eric Hughes wrote the line in the group's manifesto that sums up the method: cypherpunks write code. The idea was that speech protects nobody and law changes with elections. What protects you is software that exists, runs, and is published.

  1. 1976Diffie-Hellmantwo strangers agree on a secret in public. cryptography leaves the state monopoly and enters a journal.
  2. 1977RSAthe permanent key pair. forty-nine years later, still standing.
  3. 1991PGPZimmermann publishes, and spends three years under federal investigation for exporting munitions.
  4. 1993cypherpunk manifestocypherpunks write code. the thesis that published software protects more than legislation does.
  5. 2001AESthe end of the argument: a standard chosen by a five-year public competition, with everyone attacking the candidates in the open.
  6. 2008Bitcoinhash, signature and proof of work assembled differently. no new primitive.
from the invention of public-key cryptography to the first mass application to come out of that culture.

Bitcoin is the one I find most interesting to look at from this angle, because it usually gets told as a technological rupture and it isn't. The 2008 paper invents no cryptography at all. You've seen hashing here, and digital signatures too, and proof of work dates to 1997, built to fight spam. The originality is entirely in the arrangement, in using those three pieces to settle the order of events with nobody at the centre.

Which is this post's rule showing up again by another route. The most disruptive thing applied cryptography has produced in two decades was built exclusively from old, audited parts. The people who invented new primitives inside blockchain projects, and there were plenty, supplied the examples of what not to do.

Hacker culture enters this story as the force that pushed cryptography out to the public, and its instinct is the same as Kerckhoffs's: open the code, publish the method, let the whole world try to break it. Coming from opposite directions, a nineteenth-century Dutch professor and an anarchist mailing list from the nineties, the two land on the same conclusion. A secret method is debt. Public scrutiny is the only asset.

the two priesthoods

This is where I get to what made me write.

Cryptography is not a topic inside information security, which is in turn a topic inside IT. It's an entire science, with its own math, its own conferences, and people who spend whole careers inside a single primitive. Using TLS is not knowing cryptography, the same way calling model.predict() is not knowing machine learning.

And the two fields, born together, now hold opposite cultures about time.

Cryptography has a rule everyone repeats: don't roll your own. A new algorithm is worth nothing for being elegant. It's worth something after years of competent people publicly trying to break it and failing. AES became the standard after a five-year open competition. Post-quantum cryptography took eight years of public process before it became a norm.

AI today publishes the paper in two weeks and ships it in the third.

I'm not saying one is right and the other is wrong. I'm saying both are depth, not surface, and only one of them is being treated as if it were surface.

where they meet again

And after seventy years, they have started touching again. On three fronts.

The first is the most concrete: deep learning became a side-channel attack tool. Instead of attacking the math of AES, you measure the chip's power consumption while it encrypts and train a network to infer the key from that trace. This is a mature area, with a reference dataset and its own metric, and the model's advantage is needing far fewer measurements than the old statistical methods.

The second is AI as the target: when you put a cipher inside a neural network, the network starts answering inputs the cipher would never accept, and that opens a door. EUROCRYPT 2026 carried exactly that kind of cryptanalysis of such constructions.

The third is the quantum clock. Shor's algorithm, from 1994, showed that a large enough quantum computer breaks RSA and elliptic curve, that is, nearly all asymmetric crypto in use. Nobody has that machine today, but the attack doesn't need it yet: it's enough to record today's encrypted traffic and wait. That's why migration has already started.

  1. 1994Shor's algorithmshows that a large enough quantum computer factors large numbers, taking RSA and elliptic curve down with it.
  2. 2016NIST opens the calla public process to pick the replacements. eight years of open analysis ahead.
  3. 2024-08the standards landML-KEM (FIPS 203) for key agreement, ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) for signatures.
  4. 2025-03HQC as backupa second key mechanism, on different math, so the bet isn't entirely on lattices.
  5. 2030a real deadlineCNSA 2.0 requires national security systems to have migrated, and NIST deprecates the 112-bit level.
  6. 2035disallowedwhatever stayed behind stops being accepted.
the post-quantum race: from the algorithm that created the problem to the deadlines already in force.

And the warning missing from nearly every headline: AI does not break AES. Nothing on those three fronts scratches the math of a modern cipher. What AI attacks is the implementation, the physical leak, and the border between model and cipher. It's the exact lesson of WPA2.

what I have broken myself

It would be bad form to write all of this without saying where I got it wrong myself. All four are from my own code, in production, and all four were fixed.

The first is my favourite because it's almost poetic. I had a constant declaring a fifteen-minute lifetime for the access token, sitting neatly at the top of the file. And it was never passed to the function that signed the token. The result was that tokens came out with no expiry field at all, meaning they never expired. The code said fifteen minutes. The system delivered eternity. Today it rejects any token that arrives without a deadline, instead of trusting that the deadline was set.

The second isn't cryptography, it's what surrounds it, and it's worse. I had a function checking a user's role before allowing an admin route. It was registered with the wrong framework scope, one word, and because of that it didn't apply outside the file where it was declared. Nine permission checks became decoration. Any authenticated user could reach admin routes. The code looked right, reviewed well, and did absolutely nothing.

The third is the opposite: it went well. I had a file download endpoint that was public and built its path by concatenating whatever came in the URL, no authentication, no signature, and no check that the path stayed inside the folder. Anyone who guessed a name downloaded the file, and a run of ../ escaped the folder entirely. The replacement was an HMAC-signed URL over the key and the deadline, constant-time comparison, and the path resolved and checked against the root. One detail I only understood while writing it: the signature is verified before the expiry, on purpose. If I checked validity first, the difference between "invalid signature" and "expired link" would tell anyone probing that their signature was good.

The fourth is the same HMAC with a different threat model: a payment webhook. The provider signs every notification, and my side recomputes the signature, compares in constant time, and rejects anything outside a five-minute window, so nobody can replay a captured legitimate notification. And the rule that's worth more than all the cryptography: the webhook body never decides anything. It's a nudge for me to go ask the provider's API for the status, which is the only source of truth.

Those four share one moral, and it's WPA2's moral: the math failed in none of them. What failed was everything around it: a constant that never reached its destination, one scope keyword, an unvalidated path, an order of checks. It's always the seam.

what I took from a bad class

That cryptography is a science of its own, and that this is no excuse for not understanding the basics. It's the reason to respect them.

I'm not going to become a cryptographer. Nobody needs to. But knowing what a key is, why a hash doesn't come back, and where asymmetric hands the baton to symmetric is the difference between using the tool and being used by it. And knowing there is an entire science behind it is what stops you from rolling your own, which is, in the end, the only rule cryptography really asks of those standing outside it.