Cryptography in the Digital Age

Originally published on lavkesh.com

---

The digital economy runs on cryptography, but few developers truly grasp its fundamentals. Without it, every purchase you make online would be visible to anyone intercepting your network traffic, and your bank account details, medical records, and private messages would be readable in plain text.

Cryptography isn't new; humans have been hiding secrets for thousands of years. However, we've moved from mechanical and mathematical tricks to algorithms backed by mathematics so complex that brute force becomes impossible.

Symmetric cryptography uses a single key for both encryption and decryption, but sharing the key securely is the problem. AES is the current standard, but it's only as secure as the key distribution method. Asymmetric cryptography solves this issue by providing a public key for encryption and a private key for decryption.

The catch is that asymmetric encryption is slow, so we usually combine both. We use asymmetric cryptography to securely share a symmetric key, then use the symmetric key for fast bulk encryption. This is how HTTPS works.

In practice the TLS handshake we see on the wire is a choreography of several cryptographic moves. A typical HTTPS connection on a modern browser will negotiate an ECDHE key exchange, which gives forward secrecy while keeping the asymmetric portion under 1 ms on a server with Intel AES‑NI and AVX‑512. The subsequent AES‑GCM bulk encryption runs at about 10 Gb/s per core in OpenSSL 3.2. When we measured a 1 Gbps link on a 4G LTE network, the total handshake latency hovered around 30 ms, dominated by round‑trip time rather than the crypto itself. If you fall back to RSA‑2048 for compatibility, the server side RSA private‑key operation can take 2-3 ms, which is noticeable when you scale to thousands of concurrent handshakes on a single VM.

Hash functions don't encrypt; they transform data into a fixed-length fingerprint. SHA-256 turns any input into a 256-bit hash, but finding two different inputs with the same hash is computationally impossible. Hashes verify file integrity and prove authenticity.

Digital signatures combine asymmetric encryption with hashing. I hash a document, encrypt the hash with my private key, and send both the document and encrypted hash. Anyone can verify I created it by decrypting the hash with my public key.

Managing certificates in production is where theory meets reality. Pull‑based tools like cert‑manager automate renewal from ACME providers, but you still have to decide between CRL polling and OCSP stapling. In our last rollout we discovered that an OCSP responder was timing out under load, adding an extra 200 ms to every new TLS session. The fix was to enable stapling on the load balancer and cache responses for five minutes, which cut the added latency to under 20 ms. We also rotate private keys every 90 days; the automation script we built in Go uses the crypto/x509 package to generate a fresh ECDSA‑P‑256 key and updates the keystore atomically, avoiding the brief window where an old key could be accepted.

Online banking, shopping, and cryptocurrencies like Bitcoin rely entirely on cryptography. Your credit card details are encrypted end-to-end, and the server proves its identity through certificates backed by cryptographic signatures.

Secure messaging apps like Signal or WhatsApp use end-to-end encryption, and national security and military communications depend on strong cryptography. Classified information is protected through encryption, and communications between secure facilities use cryptographically authenticated channels.

End‑to‑end encrypted messengers have to juggle key distribution, forward secrecy, and group state. Signal’s double‑ratchet algorithm forces a new Diffie‑Hellman exchange for each message, which keeps the compromise surface small but also means the server must store a per‑device state that can grow quickly. When we tried to scale a similar system to a million daily active users, the state table ballooned to 150 GB, and our Redis cluster started evicting keys during peak hours. The workaround was to batch state snapshots and prune keys older than two weeks, accepting a trade‑off that a very long‑lived conversation could lose perfect forward secrecy if a device rejoined after a purge.

However, current cryptography's strength relies on problems being computationally hard for classical computers. Factoring large numbers is hard, but quantum computers could potentially solve these problems quickly, which would break most cryptography in use today.

Researchers are developing post-quantum cryptography algorithms using problems that remain hard even for quantum computers. Lattice-based cryptography and code-based cryptography show promise, but transitioning the entire digital infrastructure from current algorithms to quantum-resistant ones is a massive undertaking.