Java Crypto, secrets and dependencies
The rules that keep a service out of the news, most of which are about not writing anything yourself.
3 concepts · 9 interview questions
What this topic covers
Every concept in crypto, secrets and dependencies, and the questions each one gets asked as. Where a question links, it has a full write-up.
Hashing versus encryption
Hashing is one-way and used for verification; encryption is reversible and used for confidentiality. Choosing the wrong one is a design error you cannot patch later.
- When would you hash and when would you encrypt?
- What is the difference between symmetric and asymmetric encryption?
- Why should you never write your own crypto?
Secrets and keys
A secret in source control is compromised permanently, because history keeps it. Secrets belong in a store the application reads at startup.
- Where do secrets belong, and what do you do when one leaks?
- How do you rotate a key without downtime?
- What is at rest versus in transit encryption?
TLS and supply chain
Traffic between services is as much a target as traffic from users, and most of the code you ship was written by someone else.
- Should service-to-service traffic inside a private network use TLS?
- What was Log4Shell, and what did it teach?
- How do you reduce supply-chain risk in a Java service?