Part I · How it works

11. How cryptography works

1. 11.1Hashes, encryption and signaturesA hash turns any data into a short fingerprint (SHA-256: 32 bytes). Same input, same hash; you can't go back, nor find two inputs with the same hash.
2. 11.2Public-key cryptographyA key pair: the private key stays secret, the public one can go anywhere. What one does, only the other can check or undo.
3. 11.3Certificates: how HTTPS proves who it isA certificate says "this public key belongs to example.com", signed by a certificate authority (CA). Your system trusts 100 to 150 root CAs.
4. 11.4Random numbers: /dev/urandom and entropyKeys, tokens and session IDs need numbers nobody can predict. The kernel provides them: getrandom(), /dev/urandom.
5. 11.5Disk encryption: LUKS and the TPMLUKS encrypts a whole partition: without the key, a stolen disk or laptop gives nothing. Once unlocked, files are readable as usual.