Blog

How HMAC works — the inner/outer hash construction, ipad/opad, key handling — why hash(key‖message) is insecure, and where HMAC is used (JWT, TLS, API signing).

How BLAKE2 and BLAKE3 work — the ChaCha-based compression function, keyed and tree hashing, and why BLAKE3 is faster than MD5 while staying cryptographically strong.

How PBKDF2 and scrypt work — iterated HMAC, salts and iteration counts, scrypt's memory-hard ROMix — and when to use each key derivation function for passwords and keys.

How the NTLM hash works — MD4 of the UTF-16LE password, no salt, no iterations — why NTLM hashes crack fast, pass-the-hash, and how NTLMv2 authentication differs.

How CRC32 and checksums like Adler-32 work — polynomial division over GF(2), generator polynomials, burst-error detection — and why they must never be used for security.