I've always been fascinated by the idea that a string of random-looking characters can hide something real — a password, a message, an identity. So I decided to spend some real hands-on time with cryptography: not just reading about it, but actually cracking hashes, exploring how AI is starting to change cryptanalysis, and thinking through what happens to encryption once quantum computers become practical.

This write-up walks through everything I explored — from classical ciphers like Caesar and Vigenère, to symmetric encryption (AES vs DES), to practical hash cracking with hashcat and john, and finally into asymmetric cryptography, RSA, and the NIST Post-Quantum Cryptography standards.

If you're getting into cybersecurity and want a practical feel for how this stuff actually works (not just textbook definitions), this should be a useful walkthrough.

Problem Statement

Encryption and hashing are everywhere — logins, banking, messaging — but most people (myself included, before this) treat them as a black box. I wanted to answer a few concrete questions:

  • How do classical ciphers actually work, and why are they broken so easily today?
  • What really separates a "secure" algorithm like AES from an obsolete one like DES?
  • Why do we salt passwords, and what does a salt actually prevent?
  • Can AI meaningfully speed up hash identification and cracking?
  • How does public/private key cryptography (RSA) work under the hood?
  • Why is quantum computing considered a real threat to today's encryption, and what is the industry doing about it?

To make this concrete, I set up a Kali Linux VM and worked through a batch of unknown hashes, identifying and cracking each one using real tools instead of just theory.

Step-by-Step Walkthrough

1. Setting Up the Environment

I used Kali Linux (in VirtualBox) with hashid, hashcat, and john the ripper — all pre-installed on Kali, plus the classic rockyou.txt wordlist.

First thing: the wordlist ships compressed and permission-locked, so it needs to be unzipped with elevated privileges:

cd /usr/share/wordlists
gunzip rockyou.txt.gz
Enter fullscreen mode Exit fullscreen mode

If you hit a Permission denied error (very common), just escalate first:

sudo su
gunzip rockyou.txt.gz
Enter fullscreen mode Exit fullscreen mode

2. Identifying Unknown Hash Types

Before you can crack a hash, you need to know what kind of hash it is. hashid is great for a quick first guess:

hashid '3580c9267518807d14803ab6821fa067b4dba1210a4148a243b9e9383bae6a1e'
Enter fullscreen mode Exit fullscreen mode

For trickier or more ambiguous hashes, I also cross-checked against an online hash identifier tool, which gave confidence scores and useful context (e.g. "this format is most commonly seen in Windows AD/NTDS dumps").

3. Cracking with Hashcat

Once I had a working hash-mode guess, I saved the hash to a file and ran it against rockyou.txt:

echo 'PASTE_HASH_HERE' > hash1.txt
hashcat -m 1400 -a 0 hash1.txt /usr/share/wordlists/rockyou.txt
Enter fullscreen mode Exit fullscreen mode
  • -m 1400 tells hashcat the hash type (in this case, SHA-256)
  • -a 0 means a straight dictionary attack

To see the cracked result:

hashcat -m 1400 --show hash1.txt
Enter fullscreen mode Exit fullscreen mode

I repeated this same process for several hashes of different types — SHA-256, SHA-512, and raw MD5 — just swapping the -m mode number to match each algorithm.

4. Cracking Salted / bcrypt Hashes with John the Ripper

Not every hash plays nicely with hashcat's default modes, especially bcrypt. For those, john handled it well:

john hash5.txt --wordlist=/usr/share/wordlists/rockyou.txt
Enter fullscreen mode Exit fullscreen mode

Bcrypt is intentionally slow (that's the point — it resists brute force), so this one took noticeably longer to crack than the SHA-based hashes. To reveal the result:

john hash5.txt --show
Enter fullscreen mode Exit fullscreen mode

5. Practicing on TryHackMe's "Crack the Hash" Room

To push further, I worked through TryHackMe's Crack the Hash room ( https://tryhackme.com/room/crackthehash ) , which throws a mix of easy and progressively harder hashes at you — including salted hashes where the salt is given separately and has to be appended/prepended correctly before cracking.

This part really reinforced why salting matters: without knowing the exact salt and how it's combined with the password, even a correct wordlist guess won't produce a matching hash.

Digging Into the Theory

Classical Ciphers: Caesar & Vigenère

The Caesar Cipher just shifts every letter by a fixed number of positions. With only 25 possible shifts, it's trivial to brute-force.

The Vigenère Cipher improves on this by using a repeating keyword, so each letter of the plaintext gets a different shift value. It resists simple brute force, but a technique called Kasiski examination can still recover the key length by spotting repeated patterns in the ciphertext — and from there, the cipher falls.

AES vs DES

DES AES
Key size 56-bit 128 / 192 / 256-bit
Status today Obsolete, crackable in hours Industry standard
Used for Legacy systems Government & modern encryption

DES simply wasn't built for today's compute power. AES, especially at 256-bit, remains effectively unbreakable with current classical hardware.

Why Salting Matters

Without a salt, two users with the password password123 end up with identical hashes — which is exactly what precomputed rainbow tables exploit. A salt is a random value mixed in before hashing, so identical passwords produce completely different hashes, forcing an attacker to crack each one individually.

Where AI Fits Into Cryptanalysis

This was the part I found most interesting. AI isn't replacing traditional tools like hashcat — it's making the guessing smarter:

  • Predicting likely hash algorithms from structure/length faster than rule-based identifiers
  • Learning patterns from leaked password datasets to generate more realistic candidate passwords (common substitutions, suffix patterns, etc.) instead of pure brute force
  • Speeding up the reconnaissance phase in CTF-style challenges by identifying cipher/encoding types automatically

I also drafted a reusable prompt template for using an LLM to systematically break a Caesar Cipher — trying all 25 shifts, evaluating which output reads as real English, and clearly stating the result:

You are a cryptanalysis expert. I have an intercepted message that appears
to be encoded using a Caesar Cipher.

Encrypted message: [CIPHERTEXT HERE]

Please do the following:
1. Try all 25 possible shift values (1 through 25).
2. Show the decrypted output for each shift.
3. Identify which shift produces readable English text.
4. State the correct shift value and the final plaintext.
5. Briefly explain how you identified the correct decryption.
Enter fullscreen mode Exit fullscreen mode

RSA and Public/Private Keys

RSA relies on a simple asymmetry in difficulty: multiplying two large primes is fast, but factoring the resulting product back into those primes is extremely hard. Anyone can encrypt a message with my public key, but only my private key can decrypt it — which is what makes secure communication over an untrusted channel possible in the first place.

The Quantum Threat

Two quantum algorithms change the picture:

  • Shor's Algorithm can factor large numbers exponentially faster than classical computers, which would break RSA outright if a sufficiently powerful quantum computer existed.
  • Grover's Algorithm effectively halves the strength of symmetric keys, so a 256-bit AES key would offer roughly the security of a 128-bit key against a quantum attacker.

That's why NIST ran a multi-year competition and, in 2024, finalized its first Post-Quantum Cryptography (PQC) standards — CRYSTALS-Kyber for key exchange/encryption and CRYSTALS-Dilithium (ML-DSA) for digital signatures, both based on lattice problems believed to resist quantum attacks.

How to Verify

If you want to reproduce any of this yourself:

  1. Spin up a Kali Linux VM (or use any distro with hashcat, john, and hashid installed).
  2. Download rockyou.txt and place it in /usr/share/wordlists/.
  3. Save a hash to a .txt file, identify its type with hashid, then run the matching hashcat -m <mode> command.
  4. Confirm the crack with hashcat --show or john --show.
  5. Try TryHackMe's Crack the Hash room yourself for a structured, escalating challenge set.

What I Learned

Working through this hands-on rather than just reading about it changed how I think about "secure" systems. A few things stuck with me:

  • Cryptography is only as strong as its weakest implementation detail (looking at you, missing salts).
  • Hash cracking is really a wordlist-and-rules problem — the algorithm matters less than how predictable the underlying password is.
  • AI's real value right now is in speeding up identification and guessing, not magically breaking strong encryption.
  • Post-quantum cryptography isn't science fiction planning anymore — NIST already has finalized standards, and the migration is already underway in parts of the industry.

Common Mistakes Table

Mistake Why It Happens Fix
Guessing the wrong hashcat mode (-m) Similar-length hashes (SHA-256 vs others) look alike Cross-check with a hash identifier tool before running hashcat
Forgetting to unzip/permission-fix rockyou.txt Wordlist ships compressed and root-owned on Kali sudo gunzip rockyou.txt.gz before first use
Ignoring salts on salted hashes Salt isn't hashed the same way in every format Check the exact salt placement (prefix/suffix) required by that hash type
Assuming AES-256 is "quantum-proof" AES resists Shor's Algorithm but not Grover's Understand Grover only weakens AES, it doesn't fully break it
Treating AI hash-cracking as magic AI still needs data patterns to learn from Use AI to speed up identification/guessing, not as a silver bullet

Conclusion

Cryptography sits at the foundation of almost everything we trust online, and there's a real gap between knowing the definitions and actually being able to identify, crack, and reason about these systems hands-on. This exercise pushed me to close some of that gap — and it also made the post-quantum conversation feel a lot less abstract. If you're working through similar material, I'd genuinely recommend setting up a lab and cracking a few hashes yourself rather than just reading the theory.