3. Boolean Algebra & Logic

Level: Beginner You'll use this for: every if statement, firewall rule, SQL WHERE clause, and digital circuit ever built.

Truth tables

XOR ("exactly one is true") is the odd one out and deserves special attention: it's the building block of parity checks, checksums, and the one-time pad cipher (Ch. 24) — because X ⊕ K ⊕ K = X (XOR-ing twice with the same key returns the original).

How to evaluate a compound expression by hand

For a multi-variable expression like NOT(A AND B) OR C, build the truth table one operator at a time, innermost first — exactly how a computer evaluates it, following operator precedence (NOT binds tightest, then AND, then OR):

A B C | A AND B | NOT(A AND B) | NOT(A AND B) OR C
0 0 0 |    0     |      1       |         1
0 0 1 |    0     |      1       |         1
0 1 0 |    0     |      1       |         1
0 1 1 |    0     |      1       |         1
1 0 0 |    0     |      1       |         1
1 0 1 |    0     |      1       |         1
1 1 0 |    1     |      0       |         0
1 1 1 |    1     |      0       |         1

Each row plugs A, B, C into the inner expression first (column 4: A AND B), then applies the next operator to that result (column 5), then the last one (column 6) — a compound boolean expression is just several truth-table lookups chained together, evaluated left-to-right by precedence.

De Morgan's laws

¬(A ∧ B) = ¬A ∨ ¬B
¬(A ∨ B) = ¬A ∧ ¬B

Why it matters: these let you simplify/rewrite conditions correctly. !(is_admin && is_active) is the same as !is_admin || !is_active — a transformation you'll do constantly when negating guard clauses, and get wrong constantly if you don't know the law (a classic source of authorization bugs — accidentally granting access because a negation was distributed incorrectly).

ALLOW if:  (src_ip IN trusted_range) AND (dest_port == 443) AND NOT (src_ip IN blocklist)

Bitwise flags

READ, WRITE, EXECUTE = 0b100, 0b010, 0b001   # 4, 2, 1
perms = READ | WRITE          # 0b110 = 6  (like chmod 6xx)
can_write = bool(perms & WRITE)   # True
perms_no_write = perms & ~WRITE   # clear the WRITE bit

Working the bit arithmetic by hand, one column at a time — OR sets a bit if either input has it, AND keeps a bit only where both inputs have it:

  READ    = 100
  WRITE   = 010
  OR:       ---
  perms   = 110   (6)   <- each column: 1 if either input bit is 1

  perms   = 110
  WRITE   = 010
  AND:      ---
  result  = 010   (2, nonzero -> truthy -> can_write = True)
             <- each column: 1 only if BOTH input bits are 1

  ~WRITE (flip every bit of 010, in an 8-bit view) = 11111101
  perms      = 00000110
  AND:         --------
  result     = 00000100   (4 = READ only -> WRITE bit cleared)

This is literally how Unix file permissions, HTTP method flags, and capability systems (Linux CAP_*) are implemented — a permission set is a bitmask, and checking/granting/revoking permissions is AND/OR/NOT/XOR.

Real-life engineering ties

• SWE: SQL WHERE clause optimization, guard-clause refactors, feature flag combination logic.
• Network: subnet mask arithmetic is bitwise AND (Ch. 25); ACL/firewall rule evaluation.
• Security: access-control logic (RBAC/ABAC rule engines), WAF rule chains, and — critically — auditing boolean logic for that one OR that should have been AND is one of the most common real-world authorization vulnerabilities (broken access control, OWASP #1).

More real-life examples:

• Unix file permissions (chmod 754) are three 3-bit boolean masks (rwx) combined with OR when granting and AND/NOT when checking — the exact bitwise-flag mechanism from this chapter, running on every file access on every Linux/macOS machine.
• AWS IAM and most cloud policy engines evaluate access as boolean expressions with an explicit precedence rule ("an explicit Deny always overrides an Allow") — misunderstanding this precedence is a common source of real cloud misconfiguration incidents.
• A CPU's Arithmetic Logic Unit (ALU) is physically built from AND/OR/ XOR/NOT logic gates — every instruction a processor executes ultimately reduces to the truth tables in this chapter.
• CORS preflight logic in browsers, and WAF rule engines (e.g., ModSecurity, Cloudflare rules), evaluate requests through chained boolean conditions — a misplaced OR in one of these rule sets is a real, recurring class of security misconfiguration.

Common mistake

Operator precedence: A OR B AND C parses as A OR (B AND C), not (A OR B) AND C. Always parenthesize explicitly in security-critical logic — an unparenthesized boolean expression is a real, recurring CVE root cause.