Free readiness test
Home / Courses / Cryptography & PKI

Cryptography & PKI free online course

Symmetric vs asymmetric crypto, hashing, TLS, certificates and the move to post-quantum.

IntermediateFreeOnline · self-paced
🔐
Protect · IntermediateCryptography & PKI
3lessons
1hands-on lab
4questions
10flashcards
  1. Learn
  2. Lab
  3. Assess
  4. Certificate
🏅
Maps to Security+, CISSP D3Free to start · certificate on completion

What you'll learn

Lessons

1Core primitives

  • Symmetric (AES-GCM, ChaCha20): one shared key, fast, for bulk data.
  • Asymmetric (RSA, ECC): key pairs, for key exchange and signatures.
  • Hashing (SHA-256, SHA-3): one-way integrity check.
  • Password hashing: Argon2id, scrypt or bcrypt with salt, never plain SHA.

2TLS and certificates

TLS 1.3 uses ephemeral (EC)DHE for forward secrecy. Certificates bind a public key to a name and are signed by a CA. Monitor Certificate Transparency logs for unexpected certs on your domains; in Oct 2026 compromised country-code registries were used to obtain fraudulent certificates.

3Post-quantum readiness

NIST finalized ML-KEM (FIPS 203), ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) in 2024. Build a crypto inventory, prefer hybrid key exchange where supported, and prioritize long-lived secrets ("harvest now, decrypt later").

Hands-on lab: Inspect TLS and hashes with OpenSSL

  1. Run openssl s_client -connect example.com:443 -tls1_3 and note the cipher suite.
  2. Run openssl x509 -noout -text on the saved cert; read issuer, SAN and validity.
  3. Hash a file: sha256sum file.txt; change one byte and hash again.
  4. Search crt.sh for your own domain and review issued certificates.

Outcome: You can verify certificates and integrity yourself.

Practice questions

Which is best for storing passwords?

Answer: Argon2id. Slow, salted, memory-hard password hashing.

Forward secrecy in TLS comes from…

Answer: Ephemeral DH key exchange. Session keys can't be recovered from the long-term key.

ML-KEM is a…

Answer: Post-quantum key encapsulation mechanism. FIPS 203 KEM.

The full graded assessment (4 questions, pass mark 70%) is in the platform.

Key terms

AES-GCM
Authenticated symmetric encryption mode providing confidentiality and integrity.
Forward secrecy
Session keys can't be recovered even if the long-term private key is later stolen.
Salt
Random value added to a password before hashing to defeat precomputed tables.
Argon2id
Memory-hard password hashing algorithm recommended for new systems.
HMAC
Keyed hash used to verify integrity and authenticity of a message.
Digital signature
Proves origin and integrity using a private key; verified with the public key.
PKI
Public Key Infrastructure: CAs, certificates and revocation that bind keys to identities.
Certificate Transparency
Public append-only logs of issued TLS certificates.
HSM
Hardware Security Module: tamper-resistant device for key storage and crypto operations.
ML-KEM
NIST post-quantum key encapsulation standard (FIPS 203).

See the full cyber security glossary →

Official references

Related courses

🌐FREE

Network Security

Protocols, segmentation, firewalls, IDS/IPS and how to read traffic like an analyst.

Beginner–Intermediate4 lessons · lab · 5 Qs
🔑FREE

Identity & Access Management

Authentication, MFA, SSO, privileged access and the identity attacks defenders see most.

Intermediate4 lessons · lab · 5 Qs
☁️FREE

Cloud Security

Shared responsibility, cloud identity, misconfigurations, CSPM and workload protection on Azure, AWS and GCP.

Intermediate4 lessons · lab · 5 Qs