From random numbers, hash functions, symmetric and public-key encryption to passwords, TLS, database encryption, JWT, OAuth and SSH, then all of it together on this very site. Every post has small experiments run for real, with measurements.
What security protects, what each of cryptography's three tools is for, why you don't hide the algorithm, and an experiment that predicts every output of random after seeing 624 numbers. The first post of the security series.
The three properties of a hash function, why MD5 and SHA-1 were retired, collisions arriving early by the birthday paradox, measuring hash speeds, forging a sha256(key + data) signature with a length-extension attack, and comparisons that don't leak timing.
If the database leaks, are the passwords still safe? Rainbow tables and salts, measuring SHA-256 at 4.3 million hashes/second against Argon2id at 44/second, estimating cracking time, a sign-in that doesn't reveal whether an email exists, and today's password policy.
How to share a secret with a server you've never met. RSA and Diffie-Hellman by hand with small numbers, measuring RSA against Ed25519 for signing and verifying, equivalent key sizes, and the ML-KEM viet.sarl already uses against quantum computers.
TLS 1.3 combines hashing, symmetric encryption, key agreement and signatures into one handshake. Reading viet.sarl's real certificate chain, Let's Encrypt and ACME, Certificate Transparency, forward secrecy, HSTS, and the two TLS legs behind Cloudflare.
What each layer of encryption (disk, database, single column) stops and doesn't stop. Envelope encryption with a KMS, key rotation, blind indexes for lookups, an experiment encrypting an email column in SQLite, and why SQL injection still reads encrypted data.
OAuth is for authorization, OpenID Connect for authentication. Walking the authorization code flow with PKCE through viet.sarl's real code, the role of state, the kinds of token, why the implicit flow was dropped, and a small simulated authorization server showing what PKCE protects.
An SSH connection combines key exchange, a host key and a user signature. Looking at a real connection to GitHub using mlkem768x25519, known_hosts and trust on first use, ed25519 against RSA keys, ssh-agent, and a checklist for hardening a server.
A threat model for viet.sarl, a walk through every layer (Cloudflare, TLS, Caddy, cookies, tokens, Argon2id, OAuth, admin permissions, SQLite, SSH, secrets), common web vulnerabilities and how this site blocks them, what's still missing, and a checklist.