Sym/asym, hashing, TLS, PKI, JWT, key management, KMS/HSM, post-quantum, pitfalls.
Before starting, we run a 1-minute tech check — microphone, ambient noise, connection. If your setup isn't good enough, the test is fully refunded.
In 15 minutes, prove you can pick the right cipher, harden a JWT pipeline and manage keys with a KMS — the Plume Applied Cryptography badge makes your expertise undeniable.
The Applied Cryptography badge certifies your ability to design, implement and audit real-world cryptographic systems under professional constraints. The AI examiner probes eight core areas: symmetric encryption (AES-GCM, ChaCha20-Poly1305, nonce-misuse resistant modes like AES-GCM-SIV), asymmetric cryptography (RSA-OAEP, ECDSA, EdDSA, curve selection), password and data-at-rest security (Argon2id, bcrypt, scrypt parameter tuning), PKI and TLS certificate lifecycle (ACME, OCSP stapling, HSTS), JWT in production (HS256/RS256/EdDSA, short-TTL strategies, alg=none and key confusion pitfalls), key management with KMS and HSM (AWS KMS, HashiCorp Vault, Azure Key Vault, envelope encryption), classic crypto anti-patterns, and the post-quantum transition (ML-KEM, ML-DSA, hybrid schemes per NIST 2024 standards).
Unlike a LinkedIn skill endorsement or a multiple-choice quiz, a Plume oral forces you to narrate real projects, justify algorithm choices under follow-up questioning, and identify scenarios where adding encryption creates more risk than it removes. Claude Opus then reads the full transcript and produces a 0-100 score with a level (Novice, Proficient, Advanced, Expert) and a detailed breakdown of your strengths and gaps. You can't bluff your way through: the AI drills down wherever you generalize.
This badge is built for security engineers, senior back-end developers, cloud architects and DevSecOps consultants who need an objective proof of their cryptography depth before a technical interview, a consulting pitch or a promotion conversation. It's equally useful for hiring teams who want to filter candidates on applied crypto skills rather than self-reported familiarity.
Here are the concrete dimensions the AI examines during the 15-minute oral.
Choosing between AES-GCM, ChaCha20-Poly1305 and AES-CBC+HMAC based on context — nonce safety, performance on constrained hardware, and nonce-misuse resistant options like AES-GCM-SIV when IV uniqueness cannot be guaranteed.
Working knowledge of RSA-OAEP, ECDSA and EdDSA: curve selection (P-256, Curve25519), key sizes, PKCS#1 v1.5 vs PSS padding risks, and knowing when to use hybrid encryption versus pure asymmetric schemes.
Securing password storage with Argon2id, bcrypt or scrypt: cost/memory parameter tuning, salting, and clearly separating cryptographic hashing (SHA-256, BLAKE3) from key derivation functions like HKDF.
Setting up and operating a PKI: certificate issuance, rotation and revocation with Let's Encrypt, ACME automation, OCSP stapling, CRL distribution, certificate pinning tradeoffs, and HSTS preloading.
Production JWT architecture: picking HS256/RS256/EdDSA for the right reasons, managing exp/nbf claims, designing revocation strategies (blacklisting, short TTL, refresh token rotation), and neutralizing alg=none and key confusion attacks.
Integrating AWS KMS, HashiCorp Vault or Azure Key Vault into CI/CD pipelines and microservices: envelope encryption patterns, automatic key rotation, HKDF-based key derivation, and maintaining a full audit trail.
Spotting and fixing common mistakes: reused IVs/nonces, ECB mode block patterns, RSA without proper padding, unauthenticated encryption, timing side-channels, and the false security of Base64 encoding or simple XOR.
Strategic view of the NIST PQC transition: ML-KEM (formerly CRYSTALS-Kyber), ML-DSA (formerly CRYSTALS-Dilithium), classical+PQC hybrid schemes, crypto-agility design, and building a cryptographic inventory for existing systems under the 'harvest now, decrypt later' threat model.
Final scoring is performed by Claude (Anthropic), which reads back the full transcript and applies this weighted criteria grid.
The candidate names exact algorithms, justifies choices with concrete arguments (performance, nonce safety, attack resistance, hardware constraints) and avoids vague statements about 'using strong encryption'.
Examples are grounded in actual professional contexts: system architecture, business constraints, specific libraries or services used (OpenSSL, libsodium, AWS KMS), measurable outcomes and incidents handled.
Ability to identify classic anti-patterns (reused nonce, alg=none JWT, ECB mode, unauthenticated encryption) and explain the concrete exploitability and blast radius of each failure.
Understanding of the full certificate and key lifecycle: issuance, rotation, revocation, audit, and integration into automated DevSecOps processes such as ACME, Vault agent sidecar or KMS key policies.
Familiarity with NIST 2024 standards (ML-KEM, ML-DSA), awareness of the harvest-now-decrypt-later threat, and ability to sketch a migration strategy for a legacy system toward crypto-agile architecture.
A Plume session takes about 20 minutes, from tech check to badge delivery.
The AI verifies your mic and connection before starting. No software to install — everything runs in the browser. Make sure you're in a quiet room and your mic is working before you hit start.
You introduce yourself briefly and describe the most complex project where you designed or implemented applied cryptography. The AI listens without interrupting to calibrate your starting level.
The AI examiner works through your algorithm choices (AES-GCM vs ChaCha20, RSA vs EdDSA), your PKI and TLS management, your JWT setup in production, your KMS or HSM integration, pitfalls you've navigated, and your view on the post-quantum transition. It follows up on every vague answer to separate real experience from surface knowledge.
The AI presents one or two scenarios where encryption is the wrong answer or where a classic anti-pattern creates a real vulnerability. You identify the problem and walk through the fix.
Claude Opus analyses the transcript, calculates your score (0-100) and assigns your level. Your badge, detailed report and shareable URL appear instantly in your Plume dashboard.
Your score out of 100 translates into a level a recruiter can grasp at a glance.
You know the broad concepts — symmetric vs asymmetric, what a hash is — but struggle to justify a specific algorithm choice or explain why AES-CBC without a MAC is insecure. You haven't yet shipped a cryptographic mechanism to production.
You've used TLS, JWT or bcrypt in real projects, you understand PKI basics and avoid the most obvious anti-patterns. You can explain the difference between confidentiality and integrity, but key management with KMS or HSM is still new territory.
You size algorithms to the context (AES-GCM-SIV where nonce reuse is a risk, Argon2id with proper memory parameters, EdDSA for signatures), you integrate a KMS into a CI/CD pipeline, manage the full TLS certificate lifecycle, and catch JWT pitfalls before they reach production.
You design crypto-agile architectures, master envelope encryption and HKDF-based key derivation, build post-quantum hybrid schemes (ML-KEM + X25519), and can audit an existing codebase for timing side-channels, non-random nonces or weak key derivation. You're already thinking about harvest-now-decrypt-later.
No degree or years of experience required to take the badge. Here are the profiles it makes the most sense for.
You design or audit cryptographic implementations across web and mobile backends and want an objective score to support a promotion case or strengthen your OSCP/CISSP application with evidence of applied depth.
You handle data-at-rest encryption, JWT pipelines and KMS integrations but have never had an external validation of your crypto skills beyond code reviews from colleagues who trust you anyway.
You wire HashiCorp Vault, AWS KMS or Azure Key Vault into CI/CD pipelines and want to prove your understanding goes beyond copy-pasting documentation into Terraform modules.
You pitch to clients on security engagements and a verifiable cryptography badge makes your proposal stand out when the client's technical team is ready to probe your actual expertise.
You have a solid dev background and are specialising in cybersecurity. The badge tells you exactly where you stand on applied cryptography before you apply to your first security engineering role.
Where and how your Applied Cryptography badge will help you day to day.
You're interviewing for a security engineer role at a fintech. Your Advanced badge in Applied Cryptography convinces the technical panel that you can handle AES-GCM, PKI operations and production JWT management, skipping the basic whiteboard questions and getting straight to system design.
You're bidding on a contract to audit a bank's key management infrastructure. Your Plume score and detailed report replace a generic cover letter and give the CISO concrete evidence of your KMS, HSM and envelope encryption expertise before the first call.
You want to move from senior developer to security lead. Your badge gives your manager a concrete, readable artefact — a score, a level, a report — to support your promotion beyond 'trust me, I know crypto'.
You're planning to upskill in post-quantum cryptography (ML-KEM, ML-DSA) and want to know your baseline first. The Plume report pinpoints exactly which foundational gaps to close before you invest in an advanced PQC training course.
You're hiring a security engineer and want to screen on real cryptography skills rather than self-assessed familiarity. Asking candidates to take the Plume badge before the first interview saves you 45 minutes of basics and surfaces the strongest candidates faster.
You're a freelance security developer. The shareable Plume badge URL enriches your Toptal, LinkedIn or personal site profile with verifiable proof of TLS, JWT and KMS mastery, setting you apart from profiles that just list 'cryptography' as a skill with no evidence.
A few minutes to check you have everything you need.
At the end of your session you don't just get a score — here's everything that awaits you.
Get a precise score and a certified level (Novice to Expert) on your Applied Cryptography skills, computed by Claude Opus from the full analysis of your oral examination.
A full report breaks down your score across every criterion: algorithm precision, PKI and TLS management, JWT security, KMS and HSM integration, and post-quantum readiness. You know exactly what to work on next.
Your oral recording is stored privately in your Plume dashboard. Replay it to spot the moments you hesitated or over-generalised — the fastest way to prepare a sharper second attempt.
A verifiable URL is generated as soon as the analysis is complete. Drop it on your LinkedIn profile, your CV or a consulting proposal to back up your Applied Cryptography expertise with real proof.
Discover related skills you can validate with Plume.
A 15-min oral exam with an AI, a shareable badge for your recruiters.
Choose this badge · €19.99
