HotRaccoon Labs

You're browsing as a guest. Lesson progress is session-only. Sign in to keep your work →

Welcome to the Cryptography Lab

This lab teaches you how the cryptography protecting your phone, your messages, and every website you visit actually works — visually, interactively, and in plain English. No maths degree needed.

13 interactive modulesFrom the absolute basics of encryption and classical ciphers all the way to quantum computers threatening RSA.

Visualise everythingWatch AES scramble your message in real time, see nonce reuse attacks unfold byte by byte, trace elliptic curve point multiplication.

Live crypto sandboxRun real SHA-256, HMAC-SHA256, and nonce-reuse demos in your browser using the Web Crypto API — no server involved.

Guided Path0/13 done

Fundamentals · Introduction

What is Cryptography?

Cryptography is the science of sending secret messages — and making sure they arrive unmodified. Before diving into AES, RSA, or elliptic curves, this module explains the core ideas every beginner needs: what encryption actually does, what a key is, who the players are, and what 'secure' really means.

Scene 0=Encrypt 1=Keys 2=Attackers0

Animation speed5

ELI5

Cryptography is the art of locking information so only the right person can unlock it. Imagine you write a letter and put it in a combination-lock box. You give your friend the combination. Anyone else who intercepts the box just sees a locked box — they can't read your letter. Encryption is the digital version of that box. The combination is the 'key'. The letter is the 'plaintext'. The locked box is the 'ciphertext'. Modern cryptography makes the lock so strong that not even the most powerful computers on Earth could crack it in a billion years.

How it works

Every cryptographic system involves three things: plaintext (your original message), a key (the secret that controls the lock), and ciphertext (the scrambled output). The key is everything — a perfectly designed cipher with a leaked key gives you nothing. Two families: Symmetric — both Alice and Bob use the SAME key (fast, used for bulk data). Asymmetric — Alice encrypts with Bob's PUBLIC key; only Bob's PRIVATE key can decrypt (used for key exchange and signatures). In practice, real systems combine both: asymmetric to establish a shared secret, then symmetric to encrypt all actual data.

Glossary

Plaintext: The original, readable message before encryption. Could be a text message, a photo, a bank transaction — anything.
Ciphertext: The scrambled, unreadable output after encryption. Looks like random noise to anyone without the key.
Key: A secret value that controls how encryption and decryption work. Like a combination lock code — the same algorithm (AES, RSA) can be locked or unlocked only by whoever knows the right key.
Symmetric encryption: Both sender and receiver use the SAME key. Fast — used for encrypting actual data (AES). Challenge: how do you securely share the key in the first place?
Asymmetric encryption: Two related keys: a PUBLIC key anyone can use to encrypt, and a PRIVATE key only the owner can use to decrypt. Solves the key-sharing problem. Slower — used for small things like key exchange and signatures (RSA, ECC).
Alice, Bob, Eve: The traditional cast. Alice sends a message to Bob. Eve is the passive eavesdropper trying to read it. Mallory is an active attacker who can modify messages in transit.
Confidentiality: Only the intended recipient can read the message. What encryption primarily provides.
Integrity: The message wasn't modified in transit. Provided by MACs and authenticated encryption (AEAD).
Authentication: Proof of who sent the message. Provided by digital signatures.

Where this shows up

🔒
HTTPS — the padlock in your browser
When you see a padlock icon, your browser has used asymmetric crypto (Diffie-Hellman) to agree on a shared key with the server, then symmetric crypto (AES-GCM) to encrypt all your data. An eavesdropper on the network sees encrypted noise.
📱
WhatsApp end-to-end encryption
Your message is encrypted on YOUR phone with a key that only the RECIPIENT'S phone has. WhatsApp's servers relay the locked box but can't read it. Even if their servers were hacked, the messages are unreadable.
🔑
Password managers
A password manager encrypts your vault with a key derived from your master password. The company stores only encrypted data — if their servers are breached, attackers get locked boxes they can't open.
✍️
Digital signatures on software
When you download Chrome or iOS, the file is signed with Google's/Apple's private key. Your device checks the signature with their public key. Any tampering during download makes the signature fail — protecting you from malware.

Furniture takeaway

The most important concept in this whole lab: security comes from the KEY, not the algorithm. AES is public knowledge — the algorithm is published and analysed by thousands of mathematicians. Its security comes entirely from the key being secret and random. Never try to keep the algorithm itself secret ('security by obscurity') — that has never worked.

Cryptography doesn't just hide information — it also proves information hasn't been tampered with (integrity), proves WHO sent it (authentication), and prevents someone from denying they sent it (non-repudiation). The three locked-box modules later in this lab tackle each of these properties.