Real-World Cryptography Projects

# CHAPTER 19

Real-World Cryptography Projects #

1. Introduction #

Understanding cryptographic theory is essential, but employers hire engineers who can write code and build secure systems. The fastest way to transition from a beginner to a professional is to build a portfolio of hands-on projects demonstrating that you can correctly implement encryption, hashing, and authentication without introducing vulnerabilities. In this chapter, we will outline five practical, real-world cryptography projects that you can build locally to prove your technical competence to hiring managers.

2. Learning Objectives #

By the end of this chapter, you will be able to:

• Build a secure command-line file encryption tool.

• Implement a robust password hashing and verification system.

• Deploy a web server and manually configure TLS/HTTPS.

• Develop a stateless authentication API using JSON Web Tokens (JWT).

• Understand how to document technical projects for a professional portfolio.

3. Project 1: Secure File Encryption CLI (Developer) #

The Goal: Prove you understand Symmetric Cryptography and Key Derivation. The Architecture:

1. 1. The Language: Choose Python or Node.js.

1. 2. The Library: Import a proven cryptography library (e.g., cryptography.fernet in Python or crypto in Node). *Do not write the math yourself.*

1. 3. The Workflow:

• Write a script that asks the user for a password and points to a .txt file.

• Use a Key Derivation Function (like PBKDF2) to securely convert the user's password into a strong AES-256 Symmetric Key.

• Encrypt the file and output a .enc file.

1. 4. The Proof: Create a video demonstrating the script encrypting a plaintext file into unreadable gibberish, and then successfully decrypting it *only* when the correct password is provided.

4. Project 2: Password Hashing System (Backend Developer) #

The Goal: Prove you understand Salting, Key Stretching, and database security. The Architecture:

1. 1. The Language: PHP, Python (Flask/Django), or Node.js (Express).

1. 2. The Algorithm: Use Bcrypt or Argon2. Do NOT use MD5 or SHA-256.

1. 3. The Workflow:

• Create a simple HTML "Registration" form.

• When the user submits a password, hash it using Bcrypt (which automatically handles the Salt).

• Save the hash to a local SQLite database.

• Create a "Login" form. When the user logs in, use the library's verify function to compare the plaintext input against the stored hash.

1. 4. The Proof: Take a screenshot of the SQLite database showing that the passwords are stored as massive, salted Bcrypt strings, not plaintext.

5. Project 3: HTTPS-Enabled Web Server (SysAdmin / DevOps) #

The Goal: Prove you understand Public Key Infrastructure (PKI) and TLS configuration. The Architecture:

1. 1. The Server: Spin up a Linux Virtual Machine and install the Nginx or Apache web server.

1. 2. The Certificate: Use the openssl command-line tool to generate a Private Key and a Self-Signed Digital Certificate.

1. 3. The Configuration: Edit the Nginx configuration file. Tell the server to listen on Port 443 (HTTPS), point it to your new Certificate and Private Key files, and configure it to redirect Port 80 traffic to Port 443.

1. 4. The Proof: Open a web browser and navigate to your local server using https://. Screenshot the browser's certificate viewer showing your custom Self-Signed certificate details.

6. Project 4: JWT Authentication API (AppSec / Backend) #

The Goal: Prove you understand Stateless Authentication and Digital Signatures. The Architecture:

1. 1. The Framework: Use Node.js (Express) or Python (FastAPI).

1. 2. The Library: Use a standard JWT library (e.g., jsonwebtoken in Node).

1. 3. The Workflow:

• Create a /login API endpoint. Upon successful login, the server generates a JWT, digitally signs it using a secret HMAC key, sets an expiration of 15 minutes, and returns the token to the client.

• Create a /protected_data API endpoint. This endpoint must check for the Authorization: Bearer <token> header, verify the cryptographic signature, and reject the request if the signature is invalid or the token is expired.

1. 4. The Proof: Use Postman or curl to demonstrate the API workflow. Show a successful request with a valid token, and show a 401 Unauthorized error when you intentionally modify the token payload.

7. Project 5: Asymmetric Secure Messaging Demo (Advanced) #

The Goal: Prove you understand Public/Private Key pairs and Hybrid Cryptography. The Architecture:

1. 1. The Concept: Write a Python script simulating two users, Alice and Bob.

1. 2. The Keys: The script generates an RSA Public/Private key pair for Alice, and a pair for Bob.

1. 3. The Message: Alice wants to send "Hello Bob."

1. 4. The Workflow: Alice's code encrypts the message using *Bob's Public Key*. The encrypted message is printed to the screen. Bob's code takes the encrypted message and decrypts it using *Bob's Private Key*, printing the original text.

1. 5. The Proof: Upload the heavily commented source code to GitHub, explicitly explaining in the README why Alice cannot use her own Public Key to encrypt the message to Bob.

8. How to Document Your Portfolio #

A GitHub repository with a single script is not a portfolio. You must write detailed engineering documents (READMEs) for each project.

• The "Why": Don't just paste code. Explain *why* you chose Bcrypt over SHA-256 for Project 2. Explain *why* you used Asymmetric encryption in Project 5.

• Security Callouts: Add a section detailing the security limitations of your project (e.g., "Note: The JWT secret key in this demo is hardcoded for simplicity. In production, it must be stored in a KMS or environment variable.") This proves professional maturity.

9. Summary #

In Chapter 19, we transitioned from academic theory to hands-on engineering. We mapped out five robust, professional-grade projects encompassing the core pillars of modern cryptography: Symmetric file encryption, secure salted password hashing, TLS server configuration, stateless JWT authentication, and Asymmetric message exchange. By executing and meticulously documenting these projects, you transform abstract mathematical concepts into tangible proof of capability, preparing yourself for the rigors of the cybersecurity job market.

10. Next Chapter Recommendation #

Your skills are sharp, and your portfolio is built. It is time to secure the job. Proceed to the final chapter: Chapter 20: Cryptography Interview Questions and Career Roadmap.