Protocols & Cryptography

How the Internet Keeps Your Data Safe (And How Professionals Protect It)

Every time you open a banking app, pay through UPI, log into your college portal or send a WhatsApp message, something invisible happens. Your data is wrapped in layers of mathematics, agreed-upon rules and verified identities before it travels across a network that you do not control.

Those rules are protocols. That mathematics is cryptography. Together, they are the foundation of almost everything we call “secure” online.

If you are a student in Greater Noida, a fresher exploring Noida’s IT sector, or a working professional in Delhi NCR planning a move into security, this module is where cyber security becomes technical in the best sense. You stop memorising attack names and start understanding why systems are safe or unsafe.

This guide covers six pillars of the Protocols & Cryptography module:

1. HTTPS, FTPS, TLS 1.2/1.3 and TCP/IP
2. Protocol analysis with Wireshark, tcpdump and Scapy
3. Symmetric and asymmetric encryption
4. AES, RSA, ECC and hash functions
5. PKI, SSL/TLS and IPsec
6. Firewalls, IDS/IPS, VPNs and wireless security

---

Why Protocols and Cryptography Matter for Your Career

Many security roles, from SOC analyst to penetration tester to cloud security engineer, rest on one skill: understanding how data actually moves and how it is protected.

• A SOC analyst reads packet captures and logs to decide whether traffic is malicious.
• A penetration tester exploits weak protocol configurations and poor cryptographic choices.
• A cloud security engineer configures TLS, key management and VPN tunnels every day.
• A GRC consultant checks whether encryption meets standards such as PCI-DSS, ISO 27001 and India’s DPDP Act, 2023.

Someone who truly understands protocols and cryptography can learn any new tool quickly, because tools change but fundamentals do not.

---

Chapter 1: HTTPS, FTPS, TLS 1.2/1.3 and TCP/IP

The foundation: TCP/IP

Before anything can be secured, it has to be delivered. The TCP/IP model organises network communication into four layers:

IP moves packets from one address to another. TCP adds reliability: it establishes a connection through a three-way handshake (SYN, SYN-ACK, ACK), numbers the data, retransmits what is lost and closes the session cleanly. UDP skips these guarantees for speed, which suits DNS, streaming and gaming.

Here is the key security insight: TCP/IP was designed for connectivity, not secrecy. Plain HTTP, FTP and Telnet send everything, including passwords, in readable text. Anyone who can see the traffic can read it. That is why security protocols were layered on top.

HTTP vs HTTPS

HTTP is the language of the web. HTTPS is simply HTTP carried inside a TLS (Transport Layer Security) tunnel. It gives you three guarantees:

• Confidentiality: third parties cannot read the content
• Integrity: the data cannot be altered unnoticed
• Authentication: you are talking to the real server, not an impostor

FTP, FTPS and SFTP: a common confusion

• FTP transfers files with no encryption at all.
• FTPS is FTP protected with TLS.
• SFTP is a different protocol that runs over SSH. Despite the similar name, it is not FTP at all.

In interviews and real projects, people often mix these up. Knowing the difference immediately shows depth.

TLS 1.2 vs TLS 1.3

TLS evolved from the older SSL protocol. SSL 2.0 and 3.0 are long obsolete, and TLS 1.0 and 1.1 were formally deprecated by the IETF in 2021. Today the two versions that matter are:

TLS 1.2 is still widely deployed. It is secure when configured properly, but it allows many cipher options, some of which are weak.

TLS 1.3 (standardised in 2018) is faster and safer:

• One round trip for the handshake (instead of two), so pages load quicker
• Removed legacy algorithms such as RC4, static RSA key exchange, CBC-mode ciphers and weak hashes
• Forward secrecy by default, using ephemeral key exchange, so a stolen server key cannot decrypt past recorded sessions
• Encrypted handshake messages, leaking less metadata
• Optional 0-RTT resumption for speed (with replay-attack trade-offs to understand)

A simplified TLS 1.3 handshake

1. The client sends supported cipher suites and a key share.
2. The server responds with its chosen cipher, its key share and its certificate.
3. Both sides derive the same session keys independently.
4. The server proves its identity, and encrypted application data begins to flow.

Notice the pattern: asymmetric cryptography sets up trust and shares a secret, then symmetric cryptography encrypts the actual data fast. Chapters 3 to 5 explain why.

Real-world note: HTTP/3

Modern browsers also use HTTP/3, which runs over QUIC (built on UDP) and integrates TLS 1.3 directly. It is a good example of how protocols keep evolving while encryption becomes the default, not an option.

Practical skills: checking a site’s TLS configuration, spotting weak cipher suites, understanding certificate warnings and configuring secure web servers.

---

Chapter 2: Protocol Analysis with Wireshark, tcpdump and Scapy

Reading about protocols is one thing. Seeing packets with your own eyes is where understanding becomes permanent.

Wireshark

Wireshark is the world’s most popular graphical packet analyser. It captures traffic and decodes hundreds of protocols layer by layer. Typical uses:

• Watching a TCP three-way handshake in real time
• Following a TCP stream to reconstruct a conversation
• Inspecting a TLS handshake (Client Hello, Server Hello, certificate exchange)
• Spotting DNS queries and suspicious domains
• Detecting cleartext credentials in old protocols such as HTTP, FTP or Telnet
• Investigating malware beaconing (regular outbound connections to a command server)

Display filters you will use constantly:

• ip.addr == 192.168.1.10 to isolate a host
• tcp.port == 443 to view HTTPS traffic
• dns to see name lookups
• http.request to view web requests
• tcp.flags.syn == 1 to find connection attempts, useful for spotting scans

tcpdump

tcpdump is the command-line equivalent, lightweight, scriptable and available on almost every Linux server. When you are logged into a remote machine with no graphical interface, tcpdump is often your only option.

Common patterns include capturing on a particular interface, filtering by host or port, and saving to a .pcap file so you can analyse it later in Wireshark. Professionals often capture with tcpdump on the server and analyse with Wireshark on their laptop.

Scapy

Scapy is a powerful Python library for crafting, sending, sniffing and dissecting packets. While Wireshark and tcpdump observe, Scapy lets you build traffic. In authorised lab settings, it is used to:

• Create custom packets to understand how protocols behave
• Write simple scanners or sniffers
• Test how a firewall or IDS reacts to unusual traffic
• Automate analysis of large .pcap files

This is exactly why Python is so valuable in security. Learners who pair this module with Python Programming can move from running tools to building their own.

What analysts look for

• Unusual volume of traffic to a single destination
• Repeated failed connections (scans or brute force)
• Unexpected protocols (e.g., DNS traffic carrying large data, which may indicate tunnelling)
• Cleartext sensitive data
• Certificate anomalies in TLS handshakes

Ethics reminder: Capture and analyse traffic only on networks and systems you own or have written permission to test. Unauthorised sniffing is illegal under India’s IT Act, 2000.

---

Chapter 3: Symmetric and Asymmetric Encryption

Why encryption exists

Encryption converts readable plaintext into unreadable ciphertext using an algorithm and a key. Anyone without the key sees only noise. A core principle, known as Kerckhoffs’s principle, says a system should stay secure even if everything about it is public except the key. That is why strong algorithms are open and heavily scrutinised.

Symmetric encryption: one shared key

The same key encrypts and decrypts.

Strengths: very fast, ideal for large amounts of data such as files, disks and network sessions.
Weakness: the key distribution problem. How do two parties agree on a secret key if they have never met and the network is hostile?

Common examples: AES, ChaCha20 (also widely used, especially on mobile).

Asymmetric encryption: a key pair

Each party has a public key (shared openly) and a private key (kept secret). What one key locks, only the other can unlock.

• Encryption: encrypt with the recipient’s public key, and only their private key can decrypt.
• Digital signatures: sign with your private key, and anyone can verify using your public key, proving authenticity and integrity.

Strengths: solves key distribution and enables digital signatures.
Weakness: much slower than symmetric encryption.

Common examples: RSA, ECC, Diffie-Hellman key exchange.

Side-by-side comparison

Hybrid encryption: the best of both

Real systems rarely use only one. HTTPS, VPNs, secure email and messaging apps all use hybrid encryption: asymmetric methods authenticate the parties and agree on a key, then symmetric encryption protects the data. This is exactly what the TLS handshake in Chapter 1 does.

Encryption states

• Data at rest: disk encryption, encrypted databases and backups
• Data in transit: TLS, IPsec, SSH
• Data in use: emerging approaches such as confidential computing

A complete security design addresses all three.

Common mistakes professionals must avoid

• Writing your own cryptographic algorithm (almost always a bad idea)
• Hard-coding keys in source code or public repositories
• Using ECB mode, which leaks patterns
• Confusing encoding (Base64) with encryption. Base64 is not security.
• Ignoring key management, which is the hardest part in practice

---

Chapter 4: AES, RSA, ECC and Hash Functions

AES: the global standard for symmetric encryption

The Advanced Encryption Standard (AES) was selected by NIST in 2001 and is used everywhere: Wi-Fi, VPNs, disk encryption, cloud storage and banking systems.

• Block size: 128 bits
• Key sizes: 128, 192 or 256 bits
• Structure: multiple rounds of substitution, permutation and mixing

Modes of operation matter as much as the cipher itself:

• ECB: insecure for most uses (identical blocks produce identical ciphertext)
• CBC: older, requires careful padding handling
• CTR: turns AES into a stream cipher
• GCM: provides authenticated encryption, meaning confidentiality and integrity together. It is the modern default, including in TLS 1.3.

RSA: the classic public-key algorithm

RSA (named after Rivest, Shamir and Adleman) relies on the difficulty of factoring the product of two very large prime numbers. It supports both encryption and digital signatures.

• 2048-bit keys are the common minimum today; 3072-bit or larger is used for longer-term protection.
• RSA is computationally heavy, so it is mainly used for key exchange and signatures, not bulk data.
• Always use proper padding schemes (OAEP for encryption, PSS for signatures). “Textbook RSA” is unsafe.

ECC: more security with smaller keys

Elliptic Curve Cryptography achieves comparable security to RSA with far shorter keys. A 256-bit ECC key offers security roughly comparable to a 3072-bit RSA key. That means faster operations, less bandwidth and lower power use, which is ideal for mobile devices, IoT and TLS.

Popular choices include NIST P-256 and Curve25519, with ECDSA and Ed25519 for signatures and ECDH for key exchange.

Hash functions: digital fingerprints

A cryptographic hash function turns any input into a fixed-length output (a digest). Good hashes have these properties:

• Deterministic: the same input always gives the same output
• One-way: you cannot reverse the digest to find the input
• Avalanche effect: a tiny change in input completely changes the output
• Collision-resistant: it is infeasible to find two inputs with the same hash

Where hashes are used: file integrity checks, digital signatures, blockchain, certificate fingerprints and password storage.

Password hashing needs special algorithms

Fast hashes like SHA-256 are too fast for passwords, because attackers can try billions of guesses per second. Systems should use slow, purpose-built password hashing such as bcrypt, scrypt, Argon2 or PBKDF2, with a unique salt per user. This is one of the most common real-world cryptographic failures in breached databases.

HMAC and digital signatures

• HMAC combines a hash with a secret key to verify message integrity and authenticity.
• Digital signatures combine hashing with asymmetric cryptography, so a signer proves identity and the recipient detects tampering.

The post-quantum horizon

Large quantum computers, if built at scale, could break RSA and ECC. Because attackers may already be “harvesting now, decrypting later,” governments and industry are preparing. In 2024, NIST finalised its first post-quantum cryptography standards (including ML-KEM for key exchange and ML-DSA for signatures), and migration planning has begun across the industry. Understanding this transition is quickly becoming a valuable skill.

---

Chapter 5: PKI, SSL/TLS and IPsec

The trust problem

Public-key cryptography raises a question: how do you know a public key really belongs to the website or person you think it does? An attacker could simply hand you their own key. Public Key Infrastructure (PKI) solves this.

What is PKI?

PKI is the system of people, policies and technology that issues, manages and verifies digital certificates.

Core components:

• Certificate Authority (CA): a trusted entity that signs certificates
• Registration Authority (RA): verifies identity before issuance
• Digital certificate (X.509): binds a public key to an identity (such as a domain name)
• Certificate chain: root CA, then intermediate CA, then the server certificate
• Revocation mechanisms: CRL and OCSP, to cancel compromised certificates
• Trust stores: lists of trusted root CAs built into browsers and operating systems

How certificate validation works

When your browser connects to a site over HTTPS, it checks that:

1. The certificate is signed by a trusted CA (via the chain)
2. The certificate has not expired or been revoked
3. The domain name matches the certificate
4. The server can prove it holds the private key

If any check fails, you see a browser warning, and understanding why that warning appears is a core skill.

Certificate types

• DV (Domain Validated): proves control of a domain, issued quickly
• OV (Organisation Validated): includes organisation verification
• EV (Extended Validation): strictest vetting
• Wildcard and multi-domain (SAN): cover multiple subdomains or domains

Certificate lifecycle management is getting stricter

Certificate lifetimes are shrinking. The CA/Browser Forum has approved a phased reduction in maximum public TLS certificate validity, heading toward 47 days by 2029. This makes automation (for example, through the ACME protocol used by Let’s Encrypt) essential rather than optional. Expired certificates are a classic cause of outages, and automation skills are in demand.

PKI attacks and failures

• CA compromise: a trusted CA tricked or breached into issuing fraudulent certificates (this has happened historically)
• Stolen private keys
• Weak or expired certificates
• Misconfigured validation, where applications skip certificate checks
• Self-signed certificates trusted blindly

IPsec: security at the network layer

While TLS secures a specific application connection, IPsec protects traffic at the IP layer, so every application using the tunnel is covered automatically. It is the backbone of many site-to-site VPNs and enterprise remote access.

Main components:

• AH (Authentication Header): integrity and authentication (no encryption)
• ESP (Encapsulating Security Payload): encryption, integrity and authentication. This is the most commonly used.
• IKE / IKEv2 (Internet Key Exchange): negotiates keys and security associations

Two modes:

TLS vs IPsec at a glance

Neither is “better.” They solve different problems, and mature networks often use both.

---

Chapter 6: Firewalls, IDS/IPS, VPNs and Wireless Security

Encryption protects data in motion. Network defences decide what is allowed to move at all, and notice when something goes wrong.

Firewalls

A firewall enforces rules about which traffic may enter or leave a network.

Generations and types:

• Packet-filtering firewall: checks IP, port and protocol only
• Stateful inspection firewall: tracks connection state, so it can allow replies to legitimate outbound requests
• Proxy / application-layer firewall: inspects application data
• Next-Generation Firewall (NGFW): adds deep packet inspection, application awareness, user identity and integrated threat prevention
• Web Application Firewall (WAF): protects web apps from attacks such as SQL injection and cross-site scripting

Best practices: default-deny rules, least privilege, network segmentation (DMZ, internal zones), regular rule review and logging. Many breaches happen not because a firewall is missing but because its rules grew messy over years.

IDS and IPS

Detection methods:

• Signature-based: matches known attack patterns. Accurate for known threats, blind to new ones.
• Anomaly-based: flags deviation from normal behaviour. Can catch new attacks but produces more false positives.
• Behaviour and AI-assisted detection: increasingly used in modern platforms

Placement: NIDS/NIPS monitor network traffic. HIDS/HIPS run on individual hosts.

Popular open-source tools: Snort and Suricata (signature-based network IDS/IPS) and Zeek (deep network traffic analysis and logging). Learning these gives you hands-on SOC-relevant skills.

A key challenge is alert fatigue: too many noisy alerts hide the real ones. Tuning rules is a core professional skill.

VPNs

A Virtual Private Network creates an encrypted tunnel across an untrusted network such as the internet or public Wi-Fi.

Types:

• Remote access VPN: an employee connects securely to the office network
• Site-to-site VPN: two office networks are linked permanently
• Protocols: IPsec/IKEv2, OpenVPN (TLS-based) and WireGuard (modern, lightweight, fast)

Know the limits: a VPN protects traffic between you and the VPN endpoint. It does not make you anonymous, stop malware or secure a compromised device. Modern organisations increasingly move toward zero-trust network access (ZTNA), where every request is verified instead of trusting anyone “inside the VPN.”

Wireless security

Wi-Fi broadcasts through the air, so anyone nearby can capture the signal. Encryption is therefore essential.

Common wireless threats:

• Evil twin / rogue access points imitating real networks
• Deauthentication attacks that disconnect users
• Weak passphrases cracked offline from captured handshakes
• WPS misuse in poorly configured routers
• Man-in-the-middle on open public Wi-Fi

Enterprise best practices: WPA2/WPA3-Enterprise with 802.1X authentication, network segmentation for guest and IoT devices, rogue AP detection and disabling WPS.

Defence in depth: putting it together

No single control is enough. A well-designed environment layers them:

1. Perimeter: firewalls and WAF
2. Network: segmentation, IDS/IPS, VPN
3. Transport: TLS and IPsec everywhere
4. Data: strong encryption and key management
5. Endpoint: EDR and patching
6. People and process: training, monitoring, incident response

---

Industry View: Where These Skills Are Used

Trending skills for 2026 and beyond:

• Cloud security and cloud key management (AWS KMS, Azure Key Vault)
• Zero-trust architecture
• Post-quantum cryptography readiness
• DevSecOps and secure coding practices
• Network detection and response (NDR)
• AI-assisted threat detection, and securing AI systems themselves

To see how AI is reshaping network defence, from anomaly detection to automated threat hunting, explore our Artificial Intelligence Training Course in Greater Noida.

---

Hands-On Practice Ideas for Beginners

Theory sticks when you practise. Try these in a safe, legal lab (your own virtual machines):

1. Capture a TLS handshake in Wireshark and identify the Client Hello and certificate.
2. Compare HTTP and HTTPS traffic and observe what is readable and what is not.
3. Generate AES-encrypted files with OpenSSL and test what happens with a wrong key.
4. Create a self-signed certificate and see how browsers react to it.
5. Hash two nearly identical files and observe the avalanche effect.
6. Build a small packet sniffer with Scapy.
7. Set up Suricata or Snort and trigger a test alert.
8. Configure a WireGuard or IPsec VPN between two virtual machines.

Document each exercise with screenshots and notes. This becomes a portfolio that employers value.

---

Career Roadmap: From Learner to Job-Ready

1. Build fundamentals: networking (TCP/IP, DNS, HTTP), Linux and Windows basics.
2. Learn protocols and cryptography: the topics in this module.
3. Practise analysis: Wireshark, tcpdump and log investigation.
4. Add scripting: Python for automation and tool-building.
5. Specialise: SOC/blue team, penetration testing, cloud security, network security or GRC.
6. Get certified: options such as CompTIA Security+, CEH, CCNA Security-related paths, CISSP (with experience) and cloud security certifications.
7. Show your work: a GitHub profile, lab write-ups and clear explanations of what you built.

Pro tip: If you can explain, in simple language, what happens between typing a URL and seeing a secure page, you can handle a large share of entry-level security interview questions.

---

Why Learn Cyber Security in Greater Noida?

Greater Noida and the wider Delhi NCR region are a serious technology and education hub. Learners from Knowledge Park I, II and III, Alpha, Beta and Gamma sectors, Pari Chowk, Gaur City and Greater Noida West are connected to Noida’s Sector 62, Sector 125 and Sector 135 IT clusters, and to opportunities in Gurugram, Ghaziabad and Delhi.

Local advantages include:

• Proximity to IT parks, MNCs and data-driven companies across Noida and NCR
• A large student community from nearby universities and engineering colleges
• Metro, Aqua Line and road connectivity that makes regular classroom learning practical
• A growing startup ecosystem hungry for security-aware engineers

Whether you stay in Greater Noida West, Alpha 1, Beta 2, Omicron, Delta, Noida Sector 62, Indirapuram or Ghaziabad, choosing a training institute that blends concepts with lab practice can speed up your journey into the industry.

---

Learn It All at TUX Academy, Greater Noida

If this guide made you think, “I want to learn this properly, with labs,” TUX Academy offers industry-aligned programmes built around practical skills:

🔐 Cyber Security Training in Greater Noida
Cover protocols, encryption, PKI, packet analysis, network defence and more, with hands-on practice that prepares you for real security roles.

🐍 Python Programming Training in Greater Noida
Python powers tools like Scapy and most security automation. A solid foundation makes you faster and more employable.

🤖 Artificial Intelligence Training in Greater Noida
Understand how AI is changing both cyber attacks and defence, and prepare for the next decade of technology.

What to expect from a good learning environment:

• Structured, module-wise curriculum
• Lab-based, practical sessions
• Resume, interview and certification guidance
• Support in building a real project portfolio

🌐 Explore courses: tuxacademy.org

Book a free demo class or counselling session today and take the first step toward a high-demand security career.

---

Frequently Asked Questions (FAQs)

1. What topics are covered in the Protocols & Cryptography module?
It covers HTTPS, FTPS, TLS 1.2/1.3 and TCP/IP; protocol analysis with Wireshark, tcpdump and Scapy; symmetric and asymmetric encryption; AES, RSA, ECC and hash functions; PKI, SSL/TLS and IPsec; and firewalls, IDS/IPS, VPNs and wireless security.

2. What is the difference between symmetric and asymmetric encryption?
Symmetric encryption uses one shared key and is fast, so it is used for bulk data. Asymmetric encryption uses a public and private key pair, solving key distribution and enabling digital signatures, but it is slower. Most secure systems, such as HTTPS, combine both.

3. Is SSL still used today?
The name “SSL” is still commonly used, but the old SSL protocols are obsolete and insecure. Modern “SSL certificates” actually secure connections using TLS, mainly TLS 1.2 and 1.3.

4. What is the difference between IDS and IPS?
An IDS detects and alerts on suspicious activity. An IPS sits inline and can block threats automatically.

5. Which is better: AES or RSA?
They do different jobs. AES encrypts data quickly using a shared key, while RSA is used for key exchange and digital signatures. Systems usually use both together.

6. Do I need to be good at maths to learn cryptography?
Not for a career in security operations or implementation. You need to understand concepts, correct usage and common pitfalls. Deep mathematics is mainly for those who design new algorithms.

7. Why is Python useful for protocol analysis?
Libraries such as Scapy let you craft, send and analyse packets, and Python automates log and traffic analysis, saving huge amounts of manual effort.

8. Is Wireshark legal to use?
Wireshark itself is legal. Capturing traffic on networks or devices you do not own or have permission to monitor is not. Always practise in authorised lab environments.

9. Can freshers and non-IT students join cyber security training?
Yes. With structured learning and consistent practice, learners from varied backgrounds can build a career.

10. Where can I find cyber security training near Noida and Greater Noida?
You can explore the cyber security course at TUX Academy in Greater Noida and book a demo class to check whether it fits your goals.

---

Conclusion: Secure Communication Is a Skill, Not a Setting

The internet was built to connect, and then rebuilt, layer by layer, to protect. TCP/IP delivers the data, TLS shields it, AES encrypts it, RSA and ECC establish trust, PKI proves identity, hashes guarantee integrity, IPsec and VPNs extend protection across networks, and firewalls and IDS/IPS stand guard.

Professionals who understand how these pieces fit together are the ones who can design secure systems, investigate incidents and speak confidently in interviews. That depth is what employers across Greater Noida, Noida and Delhi NCR are searching for.

Ready to begin? Explore our Cyber Security Training in Greater Noida, strengthen your skills with Python Programming, and stay ahead with Artificial Intelligence.

---

Disclaimer: This article is for educational purposes only. Practise security testing, packet capture and penetration testing only in environments you own or are explicitly authorised to test.