Use Cases

How the primitives come together in production

The Learn catalog covers what each primitive is — RSA, AES, Diffie-Hellman, JWTs. This is the other half: the real systems built out of them, and the operational decisions that don't show up in a protocol spec. Each use case links back to the Learn modules that cover the underlying math, rather than re-explaining it.

Key Management

Envelope encryption: how a KMS actually protects your data

Every cloud KMS — AWS KMS, GCP Cloud KMS, Azure Key Vault, HashiCorp Vault — uses the same pattern to encrypt data without ever moving your master key. Here's why, and how it actually works.

20 min Key wrapping and key exchange: moving keys without ever exposing them

Envelope encryption covers wrapping a key with your own KMS. This is about the broader problem: getting a key from one system, person, or organization to another — without it ever existing in the clear outside a trust boundary.

18 min

PKI & Certificates

Running a PKI: how a certificate authority actually operates

The X.509 module covers what's inside one certificate and how a chain verifies. This is the other half: how an organization actually runs the CA hierarchy that issues, automates, and eventually retires millions of them.

20 min

Identity & Access

Federated identity: OAuth2, OIDC, and SAML, untangled

"Just use OAuth" conflates three different standards solving three different problems. Here's what each one actually does, how they relate to the JWTs you already know, and where passkeys fit in.

20 min