Cryptography Guide for Admins

This is an original planning guide. It is not a vendor manual, an official standard, or legal advice. Example addresses use documentation ranges. Review every command before you paste it.

What an admin actually chooses

Cryptography on this desk is a choice of tools you can operate: a hash that fingerprints a file, a cipher that protects data you store, and a place the key lives that is not the ticket. It is not a tour of how to break a cipher, and it is not a reason to invent your own.

A hash is a fingerprint. The same file produces the same hash. A changed file produces a different one. SHA-256 is the ordinary choice when a vendor publishes a checksum. MD5 still shows up on old downloads and is a weak choice when someone might alter the file on purpose. Compare the hash to the value on the vendor's own site, not to a hash that arrived in the same folder as the file.

Encryption needs a key and a decision about who may decrypt. Disk encryption protects a stolen laptop. TLS protects a connection and belongs to the certificate guide. A password hashed for storage is not the same as a file encrypted for backup. Use the password hashing your platform already provides. Do not store passwords in a reversible cipher so you can email them back to people.

The algorithm selector and the hash generator on this site run in the browser. Paste a file you are allowed to fingerprint, or a placeholder. Do not paste a live password to see its hash and then put that hash in the ticket.

A lab checksum and a key that stays in the store

Download a lab file you trust, or create a small text file yourself. Compute SHA-256. Change one character. Compute it again. The two hashes differ. That is the whole lesson of a checksum. Write the algorithm name next to the expected hash in the ticket so the next person does not compare SHA-256 to MD5 and call it a failure.

For a secret the service must read, the value in the note is prompt-for-this. The real value is in the password store, and the file on disk is mode-limited to the service account. The permissions habit from the system desk applies. A world-readable key file is a published key.

If a product offers AES and a homemade scramble, choose AES or the product's current default that the vendor still supports. Write the mode the product uses if the form asks. Do not turn on a deprecated protocol because an old client asked for it in the same window.

Retirement is part of the choice. An algorithm you cannot explain to the person who will rotate it next year is an algorithm you do not adopt. The certificate guide is how a public key gets a name and an expiry. This page stops at the choice and the storage.

A change you can finish

The change is adopting one algorithm for one purpose, on one system, with the previous setting written down. A fleet-wide cipher change is a later window after one lab system matched.

Rollback is the previous algorithm or the previous key version, which you kept until the new one was proven. You do not delete the old key in the same minute you start using the new one.

Name the purpose: checksum, disk, password storage, or TLS. TLS continues on the certificate guide.
Pick the algorithm the vendor still documents for that purpose.
Fingerprint a lab file twice, once before a one-character change and once after.
Put prompt-for-this in every note. Put the real secret in the store.
Restrict the key file to the account that must read it.
Write the rollback as the previous setting.
Do not add a second algorithm in the same window.

Mistakes that outlive the command

cryptography for admins fails in the same few ways. Each one looks finished on the day you type it. The list is here so the ticket can forbid them before the window, not so you can recognise them in an incident review.

Inventing a cipher or a mode because the standard one felt slow.
Storing passwords so you can decrypt them and read them back.
Comparing a hash to a value that shipped beside the file.
Pasting a live password into the hash tool.
A world-readable private key.
Turning on an old protocol for one client and leaving it for everyone.
Deleting the old key before the new key is in use.
Calling a hash encryption.

Decisions to write down before the window

Decision 1 for cryptography for admins. The purpose is one of checksum, storage, password hashing, or TLS, and the ticket says which. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 2 for cryptography for admins. The algorithm is one the vendor currently documents. A deprecated protocol is a separate, refused decision. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 3 for cryptography for admins. Checksums are compared to the publisher's value. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 4 for cryptography for admins. Secrets in notes are prompt-for-this. The store holds the real value. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 5 for cryptography for admins. The key file is not readable by every user on the host. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 6 for cryptography for admins. The hash tool was given a file you may hold, not a password. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 7 for cryptography for admins. The old key or old setting remains until the new one is proven. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 8 for cryptography for admins. TLS certificate work is handed to the certificate guide. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 9 for cryptography for admins. Nobody wrote a custom scramble. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 10 for cryptography for admins. A second person can say what the key protects. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

The hour you stop

Write the hostname or the system name, the owner, and the clock time before you change anything for cryptography for admins. If the system is serving people and you do not have a spare, this hour is a plan, not a change. A plan you can read tomorrow is a success. A change you cannot undo is not.

Use a lab or a copy. The log line you test with is one you created, or one you are already allowed to hold. You do not point a tool at a network, a mailbox, or an account you do not administer. The tools on this site run in the browser. They do not log in, and they do not scan.

prompt-for-this is a reminder that a secret is missing. It is not a password, a token, or a key you save. The real secret stays in the password store. If a draft, a log, or a ticket still contains a live secret, stop and rotate it. Then delete the copy.

One change. A firewall, a detection, a DNS record, and a policy do not share a window. If two things move and the outcome is wrong, you will not know which one did it. The rollback is the previous value, written down while the system still works.

A second person reads the scope aloud: which host, which domain, which account. If they cannot find it in the ticket, the ticket is not ready. Silence is not agreement.

Documentation addresses stay in the lab. 192.0.2.0/24, 198.51.100.0/24, and 203.0.113.0/24 are not your production network. example.com is not your domain. Replace them before a real record or a real rule is published.

Do not allow every address because a test failed. A rule, a header, or a detection that matches the world is a draft you delete. Management stays on the prefix you named. A service port opens when the service is ready, for the clients you named.

Keep the previous file. A generator draft is not the previous file. The previous file is what you reload if the new one is wrong. You practised the reload on the lab, with a console or a second session open when the change can lock you out.

If a step fails twice, stop. The failure is the result. Adding a command from a forum beside a half-applied config produces a system nobody can explain. Rebuild the lab from the copy you kept.

When the checks pass, the next system waits until someone else can repeat the proof from the notes. cryptography for admins is done for this window when the proof is written, not when the tool printed a file.

This page is a planning guide. It is not legal advice, not an audit opinion, not a vendor manual, and not the text of a standard. If a lawyer, an auditor, or a regulator must see the decision, they see the ticket and the evidence, not this paragraph.

Hand the finished note to the neighbouring guide that owns the next step, and leave this system alone until that guide has its own window.

Cryptography checks before the choice is used in production

Check 1 in Cryptography checks before the choice is used in production. The purpose and the algorithm are written together. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 2 in Cryptography checks before the choice is used in production. A lab checksum changed when the file changed. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 3 in Cryptography checks before the choice is used in production. The expected hash came from the publisher when a download was involved. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 4 in Cryptography checks before the choice is used in production. No live password is in the ticket or the tool output you saved. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 5 in Cryptography checks before the choice is used in production. The key file mode matches the account that reads it. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 6 in Cryptography checks before the choice is used in production. prompt-for-this was not left as the real secret. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 7 in Cryptography checks before the choice is used in production. The previous setting is still available. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 8 in Cryptography checks before the choice is used in production. Deprecated protocols were not enabled. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 9 in Cryptography checks before the choice is used in production. The certificate guide owns any public certificate. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 10 in Cryptography checks before the choice is used in production. A second person can name the algorithm. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 11 in Cryptography checks before the choice is used in production. The browser tool did not send the file anywhere. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 12 in Cryptography checks before the choice is used in production. One system was changed, not the fleet. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 13 in Cryptography checks before the choice is used in production. The hostname in the prompt matches the hostname in the ticket for cryptography for admins. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 14 in Cryptography checks before the choice is used in production. The result line includes the time and the person, not only the command. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 15 in Cryptography checks before the choice is used in production. You can point at the rollback value without searching a chat history. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 16 in Cryptography checks before the choice is used in production. Done is a sentence a second person can repeat: the proof for cryptography for admins happened, and the next host is not started early. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Tools for this guide

These tools run in the browser on this site. They do not log into your machines.

Guides in this cluster

These supporting pages belong to this pillar. A published page is linked. The others are named until they are published.