Intro

# ===== The values =====
# - Confidentiality: only intended readers can see the message
# - Integrity:       the message has not been altered
# - Authenticity:    the sender is who they claim to be
# - Non-repudiation: a sender cannot later deny sending it

# ===== The primitives you will reach for =====
# Hash:              SHA-256, SHA-512, BLAKE2/3 (one-way digest)
# Password hash:     Argon2id, scrypt, bcrypt (slow on purpose)
# MAC:               HMAC-SHA-256 (integrity for messages)
# Symmetric AEAD:    AES-GCM, ChaCha20-Poly1305 (encrypt + authenticate)
# Asymmetric:        Ed25519, X25519, RSA (sign / verify / key exchange)
# Random:            CSPRNG (OS-provided), never Math.random()

# ===== Tiny examples =====
# Node:
import { createHash, randomBytes, createHmac, scryptSync, createCipheriv } from 'node:crypto';

const digest = createHash('sha256').update('hello').digest('hex');
const key    = randomBytes(32);
const mac    = createHmac('sha256', key).update('msg').digest('hex');

# Encrypt with AES-256-GCM (AEAD):
const nonce = randomBytes(12);
const c = createCipheriv('aes-256-gcm', key, nonce);
const ct = Buffer.concat([c.update('secret', 'utf8'), c.final()]);
const tag = c.getAuthTag();

# Password hashing (use argon2 or node:crypto.scrypt):
const hash = scryptSync('user-password', randomBytes(16), 64);

# ===== When crypto wins =====
# - Storage of secrets (envelope encryption + KMS)
# - Transport security (TLS 1.3)
# - Signed artifacts (deploys, software updates)
# - Authenticated messages (HMAC on webhooks)

# ===== When crypto hurts =====
# - When access control would have sufficed (and added less risk)
# - DIY implementations (always)
# - Keys without a rotation + recovery plan

# ===== Patterns to internalise =====
# - AEAD by default (AES-GCM, ChaCha20-Poly1305)
# - KMS-wrapped data keys; never store raw keys
# - Constant-time comparisons for MAC/HMAC verification
# - Document key rotation BEFORE go-live

# ===== Pitfalls =====
# - ECB / unauthenticated CBC modes
# - Reusing nonces with the same key (GCM collapses catastrophically)
# - Comparing MACs with == (timing side-channel)
# - Rolling your own primitives
# - Storing passwords with MD5/SHA-1 (use a password hash family)

// Crypto for app devs: pick safe primitives, use vetted libraries, never
// hand-roll an algorithm. Almost every CVE in this space is misuse, not breakage.