CompTIA Security+ Preparation · lesson 5 of 45 · 25 min
What Is Cryptography?
Cryptography is the science of transforming information so that only authorized parties can read it. It is the foundation of nearly every security control that protects data in transit and at rest — from HTTPS to full-disk encryption to digital signatures.
The Security+ exam tests cryptography concepts heavily. You need to understand the difference between symmetric and asymmetric encryption, common algorithms, hashing, PKI, and how these are applied in real protocols like TLS.
Core cryptographic goals
Confidentiality — only authorized parties can read the data (encryption).Integrity — data has not been altered (hashing, MACs).Authentication — verifying identity (digital signatures, certificates).Non-repudiation — a sender cannot deny sending a message (digital signatures).
Symmetric vs Asymmetric Encryption
How TLS uses both
TLS (HTTPS) uses asymmetric encryption during the handshake to securely exchange a symmetric session key. All subsequent data is encrypted with the fast symmetric key. This hybrid approach gets the best of both worlds.
Common Algorithms
Hashing
A hash function takes input of any size and produces a fixed-size output (digest). Hash functions are one-way — you cannot reverse a hash to get the original input. They are used to verify integrity.
Properties of a secure hash function:
- Deterministic — same input always produces same output.
- Avalanche effect — a tiny change in input produces a completely different hash.
- Collision resistant — it should be computationally infeasible to find two inputs with the same hash.
- Pre-image resistant — given a hash, you cannot find the original input. Password hashing
Passwords should never be stored in plaintext or with reversible encryption. They should be hashed with a salted algorithm like bcrypt, scrypt, or Argon2. A salt is a random value added before hashing to prevent rainbow table attacks.
Digital Signatures and PKI
A digital signature uses asymmetric cryptography to provide authentication and non-repudiation. The sender hashes the message, then encrypts the hash with their private key. The recipient decrypts with the sender’s public key and compares hashes.
A Public Key Infrastructure (PKI) is the system of policies, hardware, software, and procedures needed to create, manage, distribute, and revoke digital certificates. Key components:
Flashcard Drill
AES Advanced Encryption Standard — symmetric block cipher; current standard. Use AES-256. RSA Asymmetric algorithm using large prime factorization; used for key exchange and digital signatures. ECC Elliptic Curve Cryptography — asymmetric; smaller keys than RSA for equivalent security. SHA-256 Secure Hash Algorithm producing a 256-bit digest; current standard for integrity. HMAC Hash-based Message Authentication Code — combines a hash with a secret key for integrity + authentication. Salt Random value added to a password before hashing to prevent rainbow table attacks. Digital signature Hash of a message encrypted with the sender’s private key — provides authentication and non-repudiation. Certificate Authority (CA) Trusted entity that issues and signs digital certificates in a PKI. X.509 Standard format for digital certificates used in PKI and TLS. Diffie-Hellman Key exchange protocol allowing two parties to establish a shared secret over an insecure channel.
Scenario Practice
Choosing an Algorithm
Use RSA-2048 for both storage and transmission — it is the most secure. Use AES-256 for storage; use ECC + ECDH for the TLS handshake to establish a session key. Use MD5 for storage — it is fast. Use 3DES for everything — it is a proven standard. 1 AES-256 is the right choice for bulk data encryption (storage). ECC is preferred over RSA on mobile because it achieves equivalent security with smaller keys and less computation. MD5 is broken. 3DES is legacy.
The Compromised Certificate
Issue new certificates to all affected users. Revoke the intermediate CA certificate and publish an updated CRL / OCSP response. Change the root CA key. Notify users by email and wait for certificates to expire naturally. 1 The compromised intermediate CA certificate must be revoked immediately. The CA publishes an updated CRL and OCSP response so relying parties stop trusting certificates signed by the compromised intermediate CA.
Knowledge Check
Cryptography — 10 Questions
Which encryption type uses a single shared key for both encryption and decryption?
- Asymmetric
- Symmetric
- Hashing
- Steganography
Answer: Symmetric
Symmetric encryption uses one shared secret key for both operations.
TLS uses asymmetric encryption during the handshake primarily to:
- Encrypt all web traffic
- Securely exchange a symmetric session key
- Hash passwords
- Sign web pages
- Answer: Securely exchange a symmetric session key
Asymmetric encryption solves the key distribution problem — it securely delivers the symmetric key that encrypts the actual session.
MD5 is considered a secure hashing algorithm suitable for password storage.
- True
- False
Answer: False
MD5 is cryptographically broken — collisions can be generated quickly. Never use it for security purposes.
Which property of a hash function means a small change in input produces a completely different hash?
- Collision resistance
- Pre-image resistance
- Avalanche effect
- Determinism
Answer: Avalanche effect
The avalanche effect means even a 1-bit change in input produces a completely different hash output.
A random value added to a password before hashing to prevent rainbow table attacks is called a _____.
Answer: salt
A salt is a unique random value added to each password before hashing, making precomputed rainbow table attacks infeasible.
ECC is preferred over RSA on mobile devices because:
- ECC is symmetric
- ECC achieves equivalent security with smaller keys
- ECC is faster for bulk encryption
- ECC does not require a key pair
- Answer: ECC achieves equivalent security with smaller keys
A 256-bit ECC key provides roughly the same security as a 3072-bit RSA key — far less computation for mobile hardware.
Which of the following are components of a PKI? (Select all that apply)
- Certificate Authority
- OCSP
- AES
- X.509 certificate
- Diffie-Hellman
Answer: Certificate Authority
OCSP
X.509 certificate PKI components include the CA, OCSP (revocation checking), and X.509 certificates. AES is a symmetric cipher; DH is a key exchange protocol — neither is a PKI component.
A digital signature provides which two security properties?
- Confidentiality and integrity
- Authentication and non-repudiation
- Availability and integrity
- Confidentiality and availability
Answer: Authentication and non-repudiation
Digital signatures verify who sent the message (authentication) and prevent the sender from denying it (non-repudiation).
Diffie-Hellman allows two parties to establish a shared secret over an insecure channel without ever transmitting the secret itself.
- True
- False
Answer: True
DH uses mathematical operations so both parties independently compute the same shared secret — the secret never travels over the network.
Which mechanism provides real-time certificate revocation status checking?
- CRL
- OCSP
- PKI
- HMAC
Answer: OCSP
OCSP (Online Certificate Status Protocol) provides real-time revocation checking. CRLs are periodic lists that may be outdated.
Try it: Symmetric, asymmetric or hashing?
Previous lesson: Change management and configuration management in security
Back to CompTIA Security+ Preparation
Next lesson: PKI: certificates, CAs, CRLs, OCSP, certificate types and use cases