Skip to content

Instantly share code, notes, and snippets.

@MangaD

MangaD/SecurityCourse.md

Created January 15, 2026 17:32
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save MangaD/8930cef55514f8d2833575aed1628a33 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save MangaD/8930cef55514f8d2833575aed1628a33 to your computer and use it in GitHub Desktop.
Download ZIP
🔒 THE COMPLETE SECURITY COURSE
Raw
SecurityCourse.md

🔒 THE COMPLETE SECURITY COURSE (FULL EDITION)

CC0

Disclaimer: ChatGPT generated document.

Everything from cryptographic primitives → protocols → system design → modern security architecture

Here is the full, long-form, structured, end-to-end course on all major security concepts, from cryptography to TLS/IPsec/QUIC/WireGuard, to authentication, E2EE, hardware security, network design, protocols, threat modeling, and attacker mindset. This is a full multi-module curriculum, written at a graduate / security engineer level, but without assuming prior crypto expertise. It is intentionally long, dense, and complete.

📘 PART 1 — Cryptography Foundations (The Building Blocks)

Cryptography provides the primitives used everywhere else (TLS, IPsec, SSH, WireGuard, E2EE, Kerberos, OAuth, etc). We divide primitives into:

1.1 Symmetric-Key Cryptography

1.1.1 Block Ciphers

Used for encrypted storage, VPNs, TLS.

  • AES (128/192/256-bit) — global standard
  • 3DES — deprecated
  • IDEA — old
  • Camellia — some Asia deployments

Modes of Operation

  • GCM — AEAD (encryption + integrity), modern
  • CBC — old, padding oracles
  • CTR — stream mode
  • OCB — efficient but license issues historically
  • XTS-AES — disks / filesystems

1.1.2 Stream Ciphers

  • ChaCha20 — extremely fast, mobile-friendly
  • Salsa20
  • RC4 — insecure

1.1.3 Message Authentication Codes (MACs)

Integrity-only:

  • HMAC-SHA256
  • Poly1305 (used in ChaCha20-Poly1305)

1.2 Asymmetric Cryptography

Key Exchange

  • Diffie–Hellman (DH)
  • Elliptic Curve Diffie–Hellman (ECDH)
    • X25519 (modern)
    • P-256, P-384

Digital Signatures

  • Ed25519 — fastest modern signature
  • ECDSA — what TLS uses traditionally
  • RSA-PSS — secure RSA signature scheme

1.3 Hash Functions

  • SHA-2 (SHA-256, SHA-512)
  • SHA-3 (Keccak)
  • BLAKE2, BLAKE3
  • SipHash (DoS-resistant hashing for hash maps)

Purposes:

  • Key derivation
  • Password hashing
  • Signature schemes
  • Data integrity

1.4 Password Hashing

  • Argon2id
  • PBKDF2
  • scrypt
  • bcrypt

1.5 Randomness

Secure RNG sources:

  • /dev/urandom
  • CSPRNG provided by OS
  • RDRAND/RDSEED (with reservation)

1.6 Post-Quantum Cryptography

Relevant for TLS, VPNs, messaging.

NIST PQC finalists

  • Kyber — key exchange
  • Dilithium — signatures
  • Falcon
  • SPHINCS+ (hash-based)

📘 PART 2 — Authentication & Identity

2.1 General Forms of Authentication

  • Knowledge (passwords)
  • Possession (token, phone)
  • Inherence (biometrics)
  • Location (network segment)

Multi-factor Authentication (MFA)

  • SMS (weak)
  • TOTP (Google Authenticator)
  • Push apps
  • WebAuthn/FIDO2 (strong)

2.2 Cryptographic Authentication

Pre-Shared Keys (PSK)

Used in Wi-Fi, some VPNs.

Certificates & PKI

  • X.509
  • RSA/ECDSA keys
  • Certificate Authorities
  • Certificate chains
  • Revocation (CRL, OCSP)

2.3 Web Authentication

  • OAuth 2.0
  • OpenID Connect (OIDC)
  • JWT tokens
  • SAML (enterprise SSO)
  • FIDO2/WebAuthn (passwordless)

2.4 Enterprise Authentication

  • Kerberos
  • LDAP
  • RADIUS / TACACS+
  • Active Directory

📘 PART 3 — Network Security Protocols

This is where TLS, IPsec, WireGuard, SSH, QUIC live.

3.1 TLS (Transport Layer Security)

TLS provides:

  • Confidentiality
  • Integrity
  • Authentication

TLS 1.3 features

  • Mandatory forward secrecy
  • AEAD ciphers only (AES-GCM, ChaCha20-Poly1305)
  • 1-RTT handshake
  • 0-RTT early data
  • Session tickets
  • ECDHE-only key exchange

Handshake Flow

  1. ClientHello (supported algorithms)
  2. ServerHello (chosen algorithms)
  3. Certificate (server identity)
  4. ECDHE key exchange
  5. Finished messages
  6. Encrypted Application Data

Uses

  • HTTPS
  • HTTP/2 & HTTP/3
  • SMTP submission
  • API traffic
  • MQTT
  • Mobile apps

3.2 IPsec

Security at the network layer.

IPsec modes

  • Tunnel mode (site-to-site VPN)
  • Transport mode (host-to-host)

Protocols

  • ESP (encrypt+integrity)
  • AH (integrity only)

IKEv2 — negotiation protocol

Negotiates:

  • crypto parameters
  • DH groups
  • IP addressing
  • child SA keys

Use cases

  • Corporate VPNs
  • Datacenter-to-datacenter
  • IPv6 security

3.3 WireGuard

A modern, simple Layer-3 VPN:

  • ~4,000 LOC
  • Uses NoiseIK pattern
  • Curve25519, ChaCha20, Poly1305
  • Extremely fast
  • Easy config

Replaces a lot of IPsec usage.

3.4 SSH

Secure shell protocol:

  • Authentication (password, public key)
  • Integrity
  • Confidentiality

SSH is also used for:

  • Tunnels
  • Git transport
  • Remote command execution

Authentication model: TOFU (Trust On First Use).

3.5 QUIC + HTTP/3

A transport protocol that replaces TCP+TLS:

  • User-space, no kernel TCP modification
  • Multiplexed streams
  • Congestion control
  • Mandatory TLS 1.3
  • Resistant to ossification

QUIC is the modern internet transport.

3.6 DTLS

Datagram TLS — TLS over UDP.

Used in:

  • VoIP/SIP
  • WebRTC
  • Real-time gaming

3.7 MACsec (802.1AE)

Layer-2 Ethernet frame protection:

  • Extremely low latency
  • Used in datacenters

3.8 Routing & DNS security

  • DNSSEC
  • DANE (TLS certs via DNSSEC)
  • RPKI (BGP route validation)

📘 PART 4 — Application-Layer Security & E2EE

4.1 End-to-End Encryption (E2EE)

App-layer encryption where servers cannot decrypt user data.

Major protocols

  • Signal Double Ratchet
  • WhatsApp encryption (Signal-based)
  • iMessage (custom)
  • Matrix Olm/Megolm
  • MLS (IETF Messaging Layer Security) — next-gen group E2EE

4.2 Email Security

  • PGP/OpenPGP — E2EE email
  • S/MIME — X.509-based
  • DKIM, SPF, DMARC — not E2EE, domain-level auth only

4.3 File Encryption

  • LUKS (Linux full-disk encryption)
  • BitLocker
  • FileVault
  • Cryptomator
  • VeraCrypt

📘 PART 5 — Hardware Security

5.1 Trusted Hardware

TPM / fTPM

Used for:

  • Secure boot
  • Key storage
  • Measured boot
  • BitLocker

Security Keys

  • Yubikey
  • Nitrokey
  • Feitian keys Used with:
  • SSH
  • WebAuthn
  • GPG

Secure Enclaves

  • Intel SGX
  • AMD SEV
  • ARM TrustZone
  • Apple Secure Enclave

5.2 Side-Channel Attacks

Categories:

  • Timing attacks
  • Power analysis (DPA)
  • Electromagnetic leaks
  • Cache attacks (Spectre/Meltdown)
  • Rowhammer
  • Fault injection

📘 PART 6 — Network Security Architecture

6.1 Firewalls

  • Stateless (ACL-based)
  • Stateful
  • Application-layer firewalls
  • WAF (Web Application Firewall)

6.2 Zero Trust Networking (ZTN)

Principles:

  • No trusted internal network
  • Every request authenticated
  • Device posture verification
  • Mutual TLS everywhere

Implementations:

  • Google BeyondCorp
  • Cloudflare Zero Trust
  • Istio mTLS

6.3 Network Intrusion Detection/Prevention

  • Snort
  • Suricata
  • Zeek
  • Wazuh

Signatures, anomaly detection, heuristics.

6.4 Segmentation & Microsegmentation

  • Network zones
  • VLANs
  • Kubernetes network policies

6.5 DDoS Mitigation

Techniques:

  • Rate limiting
  • SYN cookies
  • Cloudflare/Akamai scrubbing
  • Anycast networks
  • BBR congestion control

📘 PART 7 — Secure Software Engineering

7.1 Secure Coding Practices

  • Input validation
  • Avoid raw pointers (C++)
  • Avoid buffer overflows
  • Use span & safe containers
  • Avoid undefined behavior
  • Constant-time crypto operations

7.2 Memory Safety

  • ASLR
  • Stack canaries
  • DEP / NX bit
  • Safe languages (Rust)

7.3 Supply Chain Security

  • SBOM (Software Bill of Materials)
  • Code signing
  • Reproducible builds
  • Package auditing

7.4 Secure Deployment & DevOps

  • Secrets management (Vault, KMS)
  • Least privilege
  • Rotate keys
  • CI/CD signing
  • Docker image hardening

📘 PART 8 — Threat Modeling & Attacker Mindset

8.1 Threat Modeling Frameworks

  • STRIDE
  • DREAD
  • PASTA
  • MITRE ATT&CK

8.2 Types of Attackers

  • Script kiddies
  • Hacktivists
  • Criminals
  • Insiders
  • Nation-states

8.3 Common Attack Classes

  • MITM
  • Replay attacks
  • Downgrade attacks
  • Credential stuffing
  • SQL injection
  • XSS
  • CSRF
  • SSRF
  • RCE
  • Supply chain compromise

8.4 Attack Surfaces

  • Application API
  • Web UI
  • Network infrastructure
  • Cryptographic keys
  • Cloud IAM
  • Containers/kubernetes

📘 PART 9 — Modern Security Trends & Future Directions

9.1 Post-Quantum Migration

  • PQC in TLS
  • Hybrid ECDH + Kyber
  • PQ VPNs

9.2 Fully Homomorphic Encryption (FHE)

Allows computation on encrypted data.

9.3 Secure Multi-Party Computation

Collaborative private computing.

9.4 Differential Privacy

Used by Google, Apple, Census data.

9.5 Privacy-Preserving Machine Learning

Federated learning, encrypted gradients.

📘 PART 10 — Put It All Together (Practical Learning Path)

If you want to learn everything properly, this is the order:

10.1 Cryptography Foundations

  • Symmetric crypto (AES, ChaCha20)
  • Hashing & MACs
  • Public-key crypto
  • ECC (X25519, Ed25519)
  • Randomness
  • Post-quantum basics

10.2 TLS and Web Security

  • TLS 1.3 handshake
  • Certificates
  • HTTP security (HSTS, CSP, HPKP)
  • mTLS

10.3 VPNs

  • IPsec
  • WireGuard
  • OpenVPN
  • MACsec

10.4 E2EE Protocols

  • Signal protocol
  • MLS
  • PGP
  • S/MIME

10.5 Identity Systems

  • OAuth2
  • JWT/OIDC
  • FIDO2
  • Kerberos

10.6 Secure Software Development

  • Memory safety
  • Input validation
  • Cryptographic key handling
  • CI/CD secret storage

10.7 Systems/HW Security

  • TPM
  • Secure enclaves
  • Side channels

10.8 Threat Modeling

  • STRIDE
  • MITRE ATT&CK
  • Practical attacker thinking

What would you like next?

I can generate:

✔ A deep dive into any section (TLS, IPsec, WireGuard, QUIC, OAuth, crypto, etc.)

✔ A full textbook-style chapter on any topic

✔ Practical labs/exercises

✔ A cheat-sheet

✔ A curriculum with reading materials

✔ A visual map/diagram of all security concepts

Tell me which direction you want to go next and how deep you want it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment