■ CYBERSECURITY
MASTER HANDBOOK
2026 EDITION
Advanced Reference for Graduate-Level Security Studies
Harvard & Stanford Graduate Security Program
Data Privacy · AES/RSA Encryption · Modern Cyber Threats
■ Practical Cryptography ■■ Zero-Trust Architecture
■ Case Studies 2026 ■ Exam Q&A Solutions
, CHAPTER 1 — FOUNDATIONS OF PRACTICAL
CRYPTOGRAPHY
Cryptography in 2026 has evolved beyond its classical roots into a discipline that underpins virtually every
layer of modern digital infrastructure. Understanding its mechanisms is no longer optional for security
professionals — it is foundational.
Symmetric Encryption: AES
The Advanced Encryption Standard (AES) remains the gold standard for bulk data encryption. Operating
on 128-bit blocks with key sizes of 128, 192, or 256 bits, AES employs a substitution-permutation network
across 10–14 rounds depending on key length.
The four core transformations per round are: SubBytes — applies a non-linear S-box transformation;
ShiftRows — cyclically shifts row bytes; MixColumns — performs matrix multiplication over GF(28); and
AddRoundKey — XORs the state with a derived subkey.
In practice, AES-256-GCM (Galois/Counter Mode) is preferred for authenticated encryption, providing
confidentiality and integrity verification simultaneously. Any implementation that separates these two
concerns introduces vulnerability windows.
Asymmetric Encryption: RSA and Its Successors
RSA relies on the computational difficulty of factoring large semiprime integers. Key generation: select
primes p and q, compute n = pq, derive φ(n) = (p−1)(q−1), select public exponent e (typically 65537),
compute private exponent d such that ed ≡ 1 (mod φ(n)).
RSA-2048 is approaching its security sunset. NIST finalized post-quantum cryptography standards in
2024; by 2026 organizations are migrating toward CRYSTALS-Kyber (key encapsulation) and
CRYSTALS-Dilithium (digital signatures) — both lattice-based schemes resistant to Shor's algorithm.
Hybrid Cryptosystems
TLS 1.3 uses asymmetric cryptography exclusively for key exchange (via ECDHE), then switches to
symmetric AES-GCM for session data. This hybrid approach combines key distribution advantages of
asymmetric systems with the performance benefits of symmetric encryption.
Hash Functions and Security Properties
SHA-3 (Keccak) has largely replaced SHA-2 in high-assurance environments due to its sponge
construction, resisting length-extension attacks inherent in Merkle–Damgård designs. For password
storage, Argon2id remains the recommended function — deliberately memory-hard and resistant to
GPU-accelerated brute-force attacks.
MASTER HANDBOOK
2026 EDITION
Advanced Reference for Graduate-Level Security Studies
Harvard & Stanford Graduate Security Program
Data Privacy · AES/RSA Encryption · Modern Cyber Threats
■ Practical Cryptography ■■ Zero-Trust Architecture
■ Case Studies 2026 ■ Exam Q&A Solutions
, CHAPTER 1 — FOUNDATIONS OF PRACTICAL
CRYPTOGRAPHY
Cryptography in 2026 has evolved beyond its classical roots into a discipline that underpins virtually every
layer of modern digital infrastructure. Understanding its mechanisms is no longer optional for security
professionals — it is foundational.
Symmetric Encryption: AES
The Advanced Encryption Standard (AES) remains the gold standard for bulk data encryption. Operating
on 128-bit blocks with key sizes of 128, 192, or 256 bits, AES employs a substitution-permutation network
across 10–14 rounds depending on key length.
The four core transformations per round are: SubBytes — applies a non-linear S-box transformation;
ShiftRows — cyclically shifts row bytes; MixColumns — performs matrix multiplication over GF(28); and
AddRoundKey — XORs the state with a derived subkey.
In practice, AES-256-GCM (Galois/Counter Mode) is preferred for authenticated encryption, providing
confidentiality and integrity verification simultaneously. Any implementation that separates these two
concerns introduces vulnerability windows.
Asymmetric Encryption: RSA and Its Successors
RSA relies on the computational difficulty of factoring large semiprime integers. Key generation: select
primes p and q, compute n = pq, derive φ(n) = (p−1)(q−1), select public exponent e (typically 65537),
compute private exponent d such that ed ≡ 1 (mod φ(n)).
RSA-2048 is approaching its security sunset. NIST finalized post-quantum cryptography standards in
2024; by 2026 organizations are migrating toward CRYSTALS-Kyber (key encapsulation) and
CRYSTALS-Dilithium (digital signatures) — both lattice-based schemes resistant to Shor's algorithm.
Hybrid Cryptosystems
TLS 1.3 uses asymmetric cryptography exclusively for key exchange (via ECDHE), then switches to
symmetric AES-GCM for session data. This hybrid approach combines key distribution advantages of
asymmetric systems with the performance benefits of symmetric encryption.
Hash Functions and Security Properties
SHA-3 (Keccak) has largely replaced SHA-2 in high-assurance environments due to its sponge
construction, resisting length-extension attacks inherent in Merkle–Damgård designs. For password
storage, Argon2id remains the recommended function — deliberately memory-hard and resistant to
GPU-accelerated brute-force attacks.
