Skip to content
1Claw Academy
← Curriculum
Beginner

Security Foundations

The cryptography and access-control ideas everything else rests on. No 1Claw yet.

By the end of this track

You’ll be able to explain envelope encryption, hardware roots of trust, policy models, and threshold cryptography — and say why each one exists.

19 lessons~45 min57 questions
Start → What a secret is, and why secrets leak
  1. 1What a secret is, and why secrets leakDefine the thing you are protecting, and learn the four ways credentials actually escape in practice.
  2. 2Symmetric encryption and the envelope patternUnderstand why systems wrap a data key with a key-encryption key instead of encrypting everything with one master key.
  3. 3Lab: build envelope encryption by handLabDo the KEK and DEK dance yourself with openssl, then destroy a key and watch the data become unreadable.
  4. 4Public-key cryptography and digital signaturesSeparate the key that proves identity from the key that verifies it, and see why signing is not encryption.
  5. 5Lab: sign, verify, then tamperLabGenerate an Ed25519 keypair, sign a message, verify it with the public key alone, and watch one changed character destroy the signature.
  6. 6HSMs, KMS, and hardware roots of trustLearn what it means for a key to be non-exportable, and why that changes the shape of an attack.
  7. 7Authentication vs authorization: JWTs, OAuth2, and OIDCSeparate who you are from what you may do, and read a token well enough to know what it actually proves.
  8. 8Lab: read a token, then replay itLabDecode a JWT with nothing but base64, then mint one for another service and watch a naive verifier accept it.
  9. 9Lab: leak a secret with a stopwatchLabMeasure a real side channel. Compare a token the obvious way, watch the clock reveal how much of it you guessed right, then fix it in one line.
  10. 10Access control models and policy enginesCompare RBAC, ABAC, and policy-as-code, and understand why deny-by-default is the only safe starting point.
  11. 11RBAC and why roles stop scalingDesign roles properly, recognise role explosion before it happens, and understand why RBAC alone fails for agents.
  12. 12Lab: build a policy engine and break itLabImplement deny-by-default with priorities in fifteen lines, then watch a deny rule silently do nothing.
  13. 13Threshold cryptography: Shamir and MPCSplit trust so that no single party, including your own provider, ever holds a complete key.
  14. 14Lab: split a secret three waysLabImplement Shamir sharing in twenty lines, reconstruct from any two of three shares, then see for yourself that one share reveals nothing.
  15. 15Trusted Execution EnvironmentsProtect data while it is being used, not just at rest and in transit, and know what attestation does and does not prove.
  16. 16Defense in depth and the weakest linkLayer controls so that no single failure is fatal, and learn which classic principles actually earn their place.
  17. 17Threat modelling with STRIDEUse a checklist that has survived thirty years to find the threats you would otherwise have to be lucky to think of.
  18. 18Zero trust and least privilegeAssemble the previous lessons into an architecture that assumes compromise rather than hoping to prevent it.
  19. 19Lab: read 1Claw's real signing keysLabFetch 1Claw's live JWKS and OIDC discovery document, with no account and no key of your own, and see the public-key lessons in the actual product.