CryptoVerse
Eight interactive tools that show how cryptography protects data and communication. See each mechanism at work, experiment with it, understand what happened and connect it to real IT situations.
Each tool follows the same cycle
- Visualise: see the mechanism, step by step.
- Experiment: change inputs, introduce errors, attack it.
- Explain: key ideas, misconceptions and limits.
- Apply: where you meet it in real IT, plus challenges.
Colour code used everywhere: public private shared secret hash / tag / signature attacker
The learning journey
Each tool also works on its own.How it all comes together: visiting an HTTPS website
When you open https:// in a browser, several of these mechanisms work together. This is a simplified view of TLS 1.3, the protocol behind the padlock.
| # | What happens | Why | Tool |
|---|---|---|---|
| 1 | Browser and server agree on a shared secret with an ephemeral Diffie-Hellman exchange (ECDHE). | The secret is never sent over the network. | 6. Diffie-Hellman |
| 2 | The server sends its certificate chain. The browser checks it up to a trusted root CA. | Proves that the public key really belongs to the website's name. | 8. Certificates and PKI |
| 3 | The server signs the handshake with the private key matching its certificate. | Proves the server holds that private key; stops a man in the middle. | 7. Digital signatures |
| 4 | Session keys are derived from the shared secret, using HMAC-based functions over hashes of the handshake. | Fresh keys for each connection; any change to the handshake is detected. | 1. Hashing, 2. HMAC |
| 5 | All page data is encrypted with authenticated symmetric encryption (for example AES-GCM). | Fast, confidential and tamper-evident. | 3. Symmetric encryption |
Older TLS versions could instead protect the session key with the server's RSA public key, which is the idea shown in 5. Hybrid encryption and 4. Asymmetric encryption. TLS 1.3 no longer does this.
Which mechanism gives which protection?
| Mechanism | Confidentiality nobody else can read | Integrity change is detected | Authenticity who produced it | Non-repudiation sender cannot deny |
|---|---|---|---|---|
| Hash (alone) | ✖ No | ⚠ Only if the hash comes from a trusted source | ✖ No | ✖ No |
| HMAC | ✖ No | ✔ Yes | ✔ Someone with the shared key | ✖ No |
| Symmetric encryption (AES-GCM) | ✔ Yes | ✔ Yes (authenticated) | ✔ Someone with the shared key | ✖ No |
| Asymmetric encryption | ✔ Yes | ✖ Not by itself | ✖ Anyone can use a public key | ✖ No |
| Digital signature | ✖ No | ✔ Yes | ✔ The private-key holder | ⚠ Yes, if the key is protected and bound to an identity |