Skip to content
AI Security

Stripe Cryptography, PKI & TLS interview questions

Cryptography, PKI & TLS is a core part of the Stripe AI Security Engineer loop. Hashes, MACs, authenticated encryption, public-key cryptography and signatures, how TLS 1.3 works, certificates and chains of trust, Certificate Transparency, mutual TLS, and key management with KMS and HSMs, through to protecting model weights. Questions tagged to Stripe come first. After them, the top-voted questions from the Cryptography, PKI & TLS track. Each answer reasons the way a senior security engineer would in front of a panel: attacker, asset, control, and where the control breaks.

WHAT STRIPE LOOKS FOR HERE · Application security. See the full Stripe interview process →

Cryptography, PKI & TLS questions tagged to Stripe

1 questions · 0 unlocked for you
Open full answer →

More Cryptography, PKI & TLS questions for Stripe's loop

Sorted by reader votes. These are not tagged to Stripe; they cover the cryptography, pki & tls ground its AI Security Engineer loop is known to test.

15 questions · 5 unlocked for you
Open full answer →
Open full answer →
Open full answer →
Open full answer →
Open full answer →
Open full answer →
Open full answer →
Open full answer →
Open full answer →
Open full answer →
Open full answer →
Open full answer →
Open full answer →
Open full answer →
Open full answer →

Concepts behind Stripe's Cryptography, PKI & TLS round

The background these answers assume. Introductory lessons are free; advanced ones need Premium.

Foundational
Hashes, MACs and Digital SignaturesA hash turns any input into a fixed fingerprint, but anyone can recompute it, so it proves nothing on its own. A MAC adds a shared secret key, so only key holders can produce a valid tag. A digital signature uses a private key that only the signer holds and a public key anyone can use to verify, which adds non-repudiation. Choosing between them is a question of who holds which key.
Foundational
Symmetric Encryption and AEADSymmetric encryption uses one secret key to encrypt and decrypt. On its own it hides content but does not detect tampering, which has caused real attacks. Authenticated encryption with associated data (AEAD), such as AES-GCM or ChaCha20-Poly1305, encrypts and attaches a tag that makes any modification fail to decrypt. Its one hard rule is that a nonce must never repeat under the same key.
Core
Sign in
Public-Key Cryptography and Key ExchangePublic-key cryptography gives each party a key pair: a public key that can be shared and a private key that never leaves its owner. It enables signatures and key exchange, which lets two parties who have never met agree on a shared secret over an observed network. Protocols use it to set up a session and then switch to fast symmetric encryption. Its weak point is knowing whose public key you have, and its long-term threat is quantum computing.
Foundational
How TLS 1.3 WorksTLS 1.3 sets up an encrypted, authenticated connection in one round trip. The client and server run an ephemeral Diffie-Hellman exchange to agree on fresh keys, the server proves its identity by signing the handshake with the private key behind its certificate, and both sides confirm with a MAC over everything exchanged. After that, data flows under AEAD encryption. TLS protects data in transit between two endpoints; it does not protect the endpoints, the data at rest, or decide who is allowed to do what.
Foundational
PKI and Certificate ChainsPublic key infrastructure answers the question signatures leave open: how do you know a public key belongs to who it claims? A certificate binds a name to a public key and is signed by a certificate authority. Clients trust a small set of root authorities and validate a chain from the server's certificate up to one of them, checking signatures, dates, names and constraints at each step. Certificate Transparency logs make mis-issued certificates detectable.
Foundational
Certificate Revocation and Certificate Transparency in DepthRevocation tells clients to stop trusting a certificate before it expires; Certificate Transparency makes every publicly trusted certificate visible. In 2026 browsers do not ask CAs online: Firefox checks a local CRLite filter covering all revocations, Chrome uses a small CRLSet, and many non-browser clients check nothing, so lifetime is often the real limit. CT logs are Merkle trees: an inclusion proof for a two-billion-entry log is 31 hashes. Monitors and witnesses make logs honest, and CT has exposed mis-issuance repeatedly, but only when someone watches.
Core
Sign in
Hardware Roots of Trust and Key CustodyTPMs support platform identity and measured boot; TEEs, secure enclaves and HSMs can protect non-exportable keys and enforce usage policies. Their guarantees depend on the hardware, configuration and attacker access. Separate resistance to key extraction from authority to use a key. Add narrow caller permissions, authentication or approval where needed, and operation logs. Attestation lets a verifier evaluate key provenance and measured platform state against policy.
Explore the full curriculum →
STRIPE CRYPTOGRAPHY, PKI & TLS FAQ
What Cryptography, PKI & TLS questions does Stripe ask in interviews?▲

Stripe's AI Security Engineer loop draws cryptography, pki & tls questions such as "What does a MAC prove, what does a signature prove, and why can a MAC not give non-repudiation?", "Explain encoding, encryption, hashing and signing, and when you would use each.", "Symmetric versus asymmetric cryptography: when is each used, and why do real protocols use both?". Hashes, MACs, authenticated encryption, public-key cryptography and signatures, how TLS 1.3 works, certificates and chains of trust, Certificate Transparency, mutual TLS, and key management with KMS and HSMs, through to protecting model weights. Every question in the topic is listed below from easiest to hardest, each with a worked answer.

How should I prepare for the Stripe Cryptography, PKI & TLS round?▼
Does Stripe hire security engineers?▼
What is the Stripe security engineer interview process?▼

Other Stripe interview rounds

The other tracks Stripe's AI Security Engineer loop tests.

Stripe application security→Stripe identity access→Stripe llm app security→Stripe security foundations→

Prep the whole Stripe AI Security Engineer loop

Cryptography, PKI & TLS is one round. Unlock every answer across Stripe's full loop with Premium. Free questions in every track let you try the depth first.

Every worked answer in all 17 topics, every lesson in every course, the full concept curriculum, the complete practice-test bank, and the downloadable security field guides.

6 months · One payment · No auto-renewal

Unlock all answers · $25Full Stripe interview guide

Independent and not affiliated with Stripe. All trademarks belong to their owners.