Security Concepts · Topic 4 of 7
Cryptography Components for Network Security
Learn hashing, symmetric and asymmetric encryption, PKI, TLS, QUIC, MASQUE, IPsec with NAT-T, pre-shared keys, certificates and post-quantum cryptography.
- 5 min
- Includes a diagram
- Hashing gives integrity, encryption gives confidentiality, and signatures give authentication.
- Symmetric encryption is fast for bulk data. Asymmetric is used for key exchange and signatures.
- A CA signs certificates, and PKI binds a public key to an identity.
What it is
Cryptography protects data with hashing, encryption and digital signatures, and PKI is the system that makes public keys trustworthy.
Each building block answers a different question. Hashing shows data was not changed, encryption keeps it secret, and certificates prove who owns a public key.
How it works
Protocols combine several primitives, so learn the primitives first.
Hashing
A hash function turns data of any size into a fixed length digest. A small change in the input produces a completely different digest, and the process cannot be reversed. SHA-256 is a common choice, while MD5 and SHA-1 are considered weak.
An HMAC adds a shared secret to the hash, so it proves both integrity and that the sender knew the key. Hashing alone does not give confidentiality.
Encryption
| Type | Keys | Typical use |
|---|---|---|
| Symmetric (AES) | One shared key | Bulk data, because it is fast |
| Asymmetric (RSA, ECDSA) | Public and private key pair | Key exchange, signatures, certificates |
Protocols use asymmetric methods to set up a session, and symmetric encryption to carry the data. Diffie-Hellman is a key exchange method that lets two peers build a shared secret over an untrusted path.
PKI and certificates
A public key infrastructure (PKI) binds a public key to an identity through a digital certificate. A certificate authority (CA) signs the certificate, and clients trust the CA root. A digital signature uses the private key, so anyone with the public key can verify who signed.
A certificate has a validity period and can be revoked, which clients check using a CRL or OCSP. Certificate based authentication is stronger than a shared password, because the private key never leaves its owner.
SSL, TLS and QUIC
SSL is the old protocol, now deprecated. TLS replaced it, and TLS 1.3 is the current version, with a shorter handshake and only modern ciphers.
QUIC is a transport protocol that runs over UDP and builds in TLS 1.3. It is the basis of HTTP/3. MASQUE is a set of methods for proxying UDP and IP traffic inside HTTP/3, so it can carry tunnelled traffic over QUIC.
IPsec
IPsec secures traffic at Layer 3. IKE negotiates the security associations, and ESP then protects the data with encryption and integrity.
| Item | Detail |
|---|---|
| IKE | UDP port 500 |
| ESP | IP protocol 50 |
| AH | IP protocol 51, integrity only, no encryption |
| NAT-T | UDP port 4500 |
NAT traversal (NAT-T) exists because ESP has no port numbers, so NAT and PAT devices struggle with it. When a NAT device is detected between the peers, ESP is wrapped in UDP port 4500 so that it passes through.
Peer authentication: pre-shared key or certificate
A pre-shared key (PSK) is a secret configured on both peers. It is simple, but it does not scale and a leaked key affects every site that uses it.
Certificates scale better and allow individual revocation. They need a PKI, which adds setup work. Large deployments often prefer certificates.
Post-quantum cryptography
A large quantum computer could break RSA, Diffie-Hellman and elliptic curve methods. Symmetric encryption and hashing are less affected, and larger key sizes help.
Post-quantum cryptography (PQC) uses new algorithms believed to resist quantum attack. NIST has standardised ML-KEM for key establishment and ML-DSA for signatures. A hybrid approach combines a classical and a PQC method, so security holds if either remains strong.
What to remember for the exam
Seven facts cover most questions on this topic.
- Hashing gives integrity, encryption gives confidentiality, and signatures give authentication.
- Symmetric encryption is fast for bulk data. Asymmetric is used for key exchange and signatures.
- A CA signs certificates, and PKI binds a public key to an identity.
- TLS replaced SSL. QUIC runs over UDP, uses TLS 1.3 and underlies HTTP/3.
- IKE uses UDP 500, and ESP is IP protocol 50.
- NAT-T encapsulates ESP in UDP 4500 when NAT is in the path.
- PQC counters quantum risk to public key methods. ML-KEM is for key establishment.
If a question mentions IPsec failing through a NAT device, think of NAT-T and UDP 4500.
Common mistakes
These four mistakes appear often.
Calling a hash encryption. A hash cannot be reversed and gives no confidentiality.
Assuming a PSK is as strong as certificates. A shared key is simple but harder to manage and revoke at scale.
Forgetting NAT problems with ESP. ESP has no port, so NAT-T is needed behind NAT or PAT.
Thinking quantum computers break all cryptography. The main risk is to public key algorithms, and symmetric ciphers are less affected.
Do not use MD5 or SHA-1 for new designs, and do not accept SSL or early TLS versions on modern systems.
Check yourself
Work through these three questions.
Which UDP port does NAT-T use, and why is it needed?
NAT-T uses UDP 4500 because ESP has no port numbers, so it is wrapped in UDP to cross NAT or PAT.
What is the difference between symmetric and asymmetric encryption?
Symmetric uses one shared key and is fast for bulk data, while asymmetric uses a key pair for key exchange and signatures.
Why is post-quantum cryptography needed?
A quantum computer could break RSA, Diffie-Hellman and elliptic curve methods, so new algorithms such as ML-KEM resist that attack.
Topic 4 of 7 in Security Concepts
Test yourself on Security Concepts
The full Cisco CCNP 350-701 SCOR question bank has 822 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.