Contents · Security from Zero

Part 0 — Start here (read this first)

0.1 Who this is for · 0.2 The learning flow · 0.3 The roadmap · 0.4 Build your lab · 0.5 The little bit of maths you need · 0.6 Ethics and the law · 0.7 How not to get stuck · 0.8 The series: OS → networking → security → HTTPS

Part 1 — Foundations

What "security" actually means
Thinking like an attacker
The vocabulary that trips everyone up
Our running example: the SecureShop application

Part 2 — Encoding: the thing that is not security 5. How text becomes bytes 6. Base64, hex, and URL encoding — and why none of them protect anything 7. Unicode, normalisation, and the bugs they cause

Part 3 — Hashing: fingerprints for data 8. What a hash function is 9. The real hash functions, and which ones are broken 10. Password storage is a completely different problem 11. HMAC: proving a message wasn't tampered with

Part 4 — Symmetric encryption 12. The idea, and what "perfect secrecy" costs 13. Block ciphers and AES 14. Modes of operation (and why ECB is a meme) 15. AEAD: encryption and authentication together 16. Hands-on: symmetric encryption with OpenSSL

Part 5 — Asymmetric (public-key) cryptography 17. The key distribution problem 18. Diffie–Hellman: agreeing a secret in public 19. RSA, from first principles 20. Elliptic curves: same security, smaller keys 21. Digital signatures 22. Hands-on: keys, signing, and verifying with OpenSSL

Part 6 — Post-quantum cryptography 23. Why a quantum computer breaks today's crypto 24. Harvest now, decrypt later 25. The NIST standards: ML-KEM, ML-DSA, SLH-DSA, HQC 26. Hybrid mode, and how to actually migrate

Part 7 — TLS and HTTPS 27. What TLS gives you (and what it doesn't) 28. The handshake, step by step 29. Certificates and the PKI 30. Trust in practice: CT, revocation, ACME 31. Configuring TLS properly 32. Project: run your own certificate authority

Part 8 — SSH 33. How SSH works 34. Keys, agents, and config 35. Hardening SSH 36. Tunnels and port forwarding

Part 9 — Network security 37. Attacks on the network 38. Firewalls and segmentation 39. VPNs: IPsec and WireGuard 40. DDoS and rate limiting

Part 10 — Web and HTTP security 41. How the web decides what to trust (origins, SOP, cookies, CORS) 42. Injection: when data becomes code 43. Cross-site scripting (XSS) 44. Request forgery: CSRF, SSRF, clickjacking 45. Broken access control 46. Authentication, sessions, and federated identity (JWT, OAuth, OIDC) 47. Supply chain and the code you didn't write 48. Hands-on: testing a web application

Part 11 — Operating securely 49. Secrets management 50. Logging, detection, and monitoring 51. Incident response 52. Threat modeling and secure design

Part 12 — Projects 53. Project 1: your own CA, plus mutual TLS 54. Project 2: harden a server end to end 55. Project 3: break and fix a vulnerable application 56. Project 4: a post-quantum readiness audit

Part 13 — Where to go next 57. Honest gaps, and a six-month plan 58. Specialisations, certifications, and staying current

Appendices

A. Glossary (plain language)
B. The OpenSSL cookbook
C. Command cheat sheet
D. What to use in 2026 (algorithm reference)
E. Reading list and how the facts here were checked
F. Answers to "Check yourself"