Use cryptography correctly: pick the right primitives, manage keys and certificates, run a PKI, and avoid the implementation mistakes that quietly break security.
Estimated time: 15–27 months · At about 10 hours a week.
Learning path
Click a topic to see what to learn and where. Mark topics as you go; your progress is saved in this browser only.
Match primitives to confidentiality, integrity and authentication.
Use authenticated encryption and proper password hashing.
Spot common cryptographic misuse.
Hands-on projects and labs
Encrypt and authenticate a message with AES-GCM in a language of your choice.
Break a deliberately weak scheme, such as ECB or a reused nonce, in a lab.
Done when you can…
Explain the goals of cryptography and which primitive serves each.
Write code that encrypts and authenticates data correctly.
Beginner
What cryptography provides
Confidentiality, integrity, authentication and non-repudiation are the goals. Match the primitive to the goal; encryption alone does not give you integrity.
Application secrets and keys need a vault, short lifetimes and audited access, not config files and environment variables. Integrate it into pipelines.
Learn to review how crypto is used: key handling, modes, randomness, certificate validation and library misuse. Most bugs are in the usage, not the maths.
Zero-knowledge proofs, homomorphic encryption and secure multiparty computation enable new use cases. Know what is practical and what is still research.
Applied cryptography is about using crypto correctly rather than inventing it. Most real failures are not broken algorithms but misused ones: wrong modes, reused nonces, bad key handling and unvalidated certificates.
The field covers the core primitives, the protocols built from them such as TLS, the public key infrastructure that manages trust, and the key management that holds it all together. It is foundational to almost every other security domain.
Why it matters
Cryptography protects nearly everything: traffic, stored data, identities and signatures. Teams need people who can apply it correctly and spot the subtle misuse that undermines it, without needing to be research cryptographers.
Typical job roles
Mid-levelSecurity engineer (crypto focus)Applies cryptography correctly in systems.
Mid-levelPKI engineerRuns certificate authorities and key infrastructure.
SeniorCryptography engineerDesigns and reviews cryptographic systems.
SeniorSecurity architectSets cryptographic standards across the organisation.
Prerequisites
Comfort with basic maths and binary data.
How networks and TLS fit together at a high level.
NIST Cybersecurity Framework (CSF) 2.0A common way to describe and improve an organisation's security, organised as Govern, Identify, Protect, Detect, Respond and Recover.