Applied Cryptography and Authentication

Security properties and adversary models

Start by naming the required property and what the adversary can do. Confidentiality limits what an attacker learns about a message. Integrity detects unauthorized changes. Authentication connects a message or session to an expected party. These properties are related but not interchangeable. Security definitions often compare an attacker’s success with an ideal experiment and bound the additional advantage. A scheme can be secure in one model and fail in another, such as when attackers can submit chosen ciphertexts. Key compromise and endpoint compromise also change which guarantees remain meaningful.

References: COMP 2108 A — Fall 2026 course outline · Boneh and Shoup — A Graduate Course in Applied Cryptography

Symmetric encryption, nonces, and authenticated encryption

A symmetric scheme uses secret key material shared by communicating parties. A block cipher transforms fixed-size blocks; a mode describes how to use it for longer inputs. A stream construction combines plaintext with a pseudorandom stream. Reusing the same stream for two messages exposes the XOR of their plaintexts: C1 XOR C2 = P1 XOR P2. A nonce is generally required to follow the selected scheme’s uniqueness or randomness rule; it need not always be secret. Authenticated encryption combines confidentiality and integrity, while associated data is authenticated without being encrypted.

References: COMP 2108 A — Fall 2026 course outline · Boneh and Shoup — A Graduate Course in Applied Cryptography

Hashes, message authentication, and password storage

A cryptographic hash maps arbitrary-length input into a fixed-size digest. Collision resistance concerns finding two distinct inputs with the same digest; preimage resistance concerns recovering an input for a chosen digest. Neither turns an unkeyed hash into proof of a sender’s identity. A message authentication code uses a secret key and authenticates messages among key holders. Password storage is a different problem: salts prevent identical passwords from sharing the same stored representation, while a suitable password hashing construction makes guessing more expensive. Fast generic hashing alone does not provide that cost.

References: COMP 2108 A — Fall 2026 course outline · Boneh and Shoup — A Graduate Course in Applied Cryptography

Public keys, signatures, and trust

Public-key encryption permits encryption using a public key and decryption using the associated secret key. A digital signature permits verification using a public key, but verification is useful only when that key is bound to the intended identity. Encryption does not automatically authenticate the sender, and a signature does not hide the signed message. Key exchange creates shared secrets; authenticating the exchange is necessary to resist an active intermediary. Certificates, trusted key directories, and verified fingerprints are different ways to establish a key-to-identity relationship, with different operational assumptions.

References: COMP 2108 A — Fall 2026 course outline · Boneh and Shoup — A Graduate Course in Applied Cryptography

Entropy, randomness, and a worked guessing example

Entropy measures uncertainty under a probability model. A uniformly chosen six-digit decimal code has one million possibilities, giving about log2(1000000), or 19.9 bits, before attempts and other information are considered. Ten distinct guesses against one uniformly chosen code have success probability exactly 10/1000000. Human-chosen values are usually not uniform. Random-number generation must obtain appropriate unpredictability; a deterministic generator can expand a seed, but cannot create fresh uncertainty from a seed already known to the attacker.

References: COMP 2108 A — Fall 2026 course outline · Boneh and Shoup — A Graduate Course in Applied Cryptography

Protocol composition, secret sharing, and proofs

A protocol combines primitives with identities, messages, and state. Bind messages to their purpose and session so that a valid message cannot be replayed in a different context. A proof of knowledge demonstrates possession of a secret under a defined protocol without simply transmitting the secret; zero knowledge adds a separate privacy property. Threshold secret sharing distributes shares so that an authorized subset can reconstruct while smaller subsets learn nothing under the scheme’s assumptions. Correct primitives do not rescue a protocol with ambiguous identities, unchecked messages, or an unsafe key lifecycle.

References: COMP 2108 A — Fall 2026 course outline · Boneh and Shoup — A Graduate Course in Applied Cryptography

Practice & worked answers

Original exercises for this guide.

Public notes & references

Course sources establish the scope above. Reference materials support the explanations; linked lecture notes and books remain with their authors.

• COMP 2108 A — Fall 2026 course outline ↗Course scope · Fall 2026
• Boneh and Shoup — A Graduate Course in Applied Cryptography ↗Open author textbook · Version 0.5, 2020