NIX // Architecture Cheatsheet

Authenticated Encryption with Associated Data (AEAD)

Keys: 128, 192, 256 bits. (256-bit recommended for long-term data; post-quantum safe).

Galois/Counter Mode provides both confidentiality (via CTR mode) and integrity (via GHASH polynomial MAC). It is highly parallelizable and hardware-accelerated (AES-NI), making it significantly faster and safer than AES-CBC. Appends a 128-bit authentication tag.

Requires an Initialization Vector (IV). The NIST-recommended optimal IV length is strictly 96 bits (12 bytes) to avoid additional internal GHASH processing overhead.

Deterministic One-Way Hash Function

SHA-256 (32 bytes), SHA-384 (48 bytes), SHA-512 (64 bytes)

Mathematically infeasible to reverse (preimage resistance) or find two inputs producing the same output (collision resistance). Used for file integrity, digital signature digests, and blockchain proof-of-work.

SHA-2 is vulnerable to Length Extension Attacks. Never use Hash(Secret || Message) for authentication; use HMAC instead.

Elliptic Curve Digital Signature Algorithm

NIST P-256 (secp256r1), secp256k1 (Bitcoin), Curve25519 (Ed25519)

Used to prove authenticity and non-repudiation. The owner Signs a payload (usually a SHA-256 digest of the message) using their Private Key. Anyone can Verify the signature using the exposed Public Key. Standard for JWTs (ES256), software updates, and blockchains.

ECDSA requires generating a random integer (nonce k) for every signature.

Elliptic Curve Diffie-Hellman (Ephemeral)

Allows two parties to negotiate a shared symmetric secret over a fully public, monitored channel. Party A mixes their Private Key with Party B's Public Key. Party B does the inverse. The resulting math yields the exact same shared secret.

Always use the Ephemeral (ECDHE) variant. By generating a fresh, temporary key pair for each session, you guarantee Perfect Forward Secrecy (PFS). If a long-term private key is compromised in the future, past traffic cannot be decrypted.

Hash-based Message Authentication Code (RFC 2104)

Provides both data integrity and authenticity. Uses a shared secret key combined with a cryptographic hash function (e.g., HMAC-SHA256) via a two-pass structure: H(Key ^ opad || H(Key ^ ipad || Message)). Immune to length extension attacks.

Used heavily for validating API webhooks, generating stateless session tokens, and preventing parameter tampering.

Public-Key Cryptography System

Keys: 2048 or 4096 bits. (2048 is minimum safe, 4096 recommended for extended life).

Relies on the mathematical difficulty of factoring the product of two extremely large prime numbers. Supports both Encryption (Public Key encrypts, Private Key decrypts) and Digital Signatures (Private Key signs, Public Key verifies).

RSA is computationally expensive and has strict payload size limits. CRITICAL WARNING: Never use RSA for bulk data encryption. Instead, use RSA to securely transmit an AES-GCM symmetric key (Key Wrapping), and then encrypt the actual data using that fast symmetric key. Always use RSA-OAEP padding for encryption to prevent Chosen Ciphertext Attacks.

Public Key Infrastructure (RFC 5280)

Certificates bind a Public Key to a specific identity (e.g., a domain name). A Certificate Authority (CA) digitally signs the certificate, proving they validated the identity.

Trust is established via the Certificate Chain. Your OS/Browser hardcodes "Root CAs". A Root CA signs an Intermediate CA, which signs the end-server certificate. If any link in the chain breaks, or if the certificate expires, or if the SHA-256 fingerprint doesn't match the signature, the TLS handshake fails.

Dictionary Attacks & Rainbow Tables: Systematically hashing every word in a dictionary list to crack a stolen hash database. Defense: Prevented by using memory-hard KDFs (Argon2id) combined with a unique, cryptographically random Salt for every user, which completely invalidates precomputed Rainbow Tables.

The Birthday Paradox: The probability of finding two different inputs that produce the exact same hash. Because of probability mechanics, you only need to hash roughly 2^(N/2) inputs to find a collision in an N-bit hash, dramatically reducing the mathematical security of the hash function by half.

Least Significant Bit (LSB) Encoding

Cryptography hides the meaning of a message. Steganography hides the existence of the message entirely.

By modifying the Least Significant Bit of the Red, Green, and Blue channels of an image pixel, you can embed an encrypted binary payload without visibly altering the image to the human eye. Defense: Statistical analysis (Steganalysis) can detect unnatural LSB distributions.