<Mr. Dev/>
All notes

01 # RESEARCH

Exploring cryptographic protocols, key exchange and secure communication.

TECHNICAL NOTE

Protect the channel first. Never invent the cryptography.

TLS 1.3 with short-lived credentials is a sound default. mTLS fits service identities. Transport security and authorization should stay separate so a trusted connection does not become unlimited access.

COMMON USES

Public APIs

TLS at the edge, explicit OAuth or session authorization in the application, and strict request validation.

Service-to-service calls

mTLS when each workload needs a cryptographic identity and the network should not be trusted by default.

Sensitive payloads

Application-layer encryption only when data must remain protected beyond a terminated TLS connection.

QUESTIONS

Choices depend on context

01 # Key exchange

How should a session key be established?

Static RSA key transport

A server private key decrypts the session secret.

  • Older deployment pattern.
  • A leaked private key can expose recorded sessions.
  • Not available in TLS 1.3.

Ephemeral ECDHE

Both peers derive a fresh secret for each session.

  • Forward secrecy limits the blast radius of a key leak.
  • Efficient on modern hardware.
  • The TLS 1.3 baseline.

ConclusionTLS 1.3 with ephemeral key exchange is the better default. It also removes an unnecessary legacy choice.

02 # Service identity

What proves which service is calling?

Shared bearer secret

A single token or API key is copied into each caller.

  • Quick to bootstrap.
  • Hard to attribute or rotate safely.
  • A copied secret grants the same access everywhere.

mTLS plus scoped tokens

A certificate proves the workload and a short-lived token carries authorization.

  • Separates identity from permission.
  • Supports rotation and revocation.
  • Adds certificate lifecycle work.

ConclusionFor sensitive internal APIs, mTLS identifies the workload and a scoped token defines what it may do.

TAKEAWAY

Security depends on identity, key handling, transport, authorization, and operational discipline.

POINTS TO KEEP IN MIND

  • Keep private keys and tokens out of source code, logs, and container images.
  • Automate certificate renewal and alert well before expiry.
  • Use short-lived credentials and validate issuer, audience, expiry, and clock skew.
  • Threat-model the data path before adding application-layer encryption.