Security · Topic 3 of 5
Encryption, Certificates and Password Complexity
Learn how encryption protects data in transit and at rest, symmetric and asymmetric keys, what certificates prove, and what makes a password strong.
- 4 min
- Encryption turns plain text into cipher text using a key.
- Data in transit and data at rest can both be encrypted.
- Symmetric encryption uses one shared key and is fast. Asymmetric encryption uses a public and private key pair.
What it is
Encryption, certificates and strong passwords are three tools that protect data and prove identity.
Encryption scrambles data so that only someone with the right key can read it. A certificate is a digital document that proves who owns a public key. A complex password is hard for an attacker to guess.
Together, they protect secrets in transit, show that a website is genuine, and keep accounts safe.
How it works
Encryption protects the data, certificates give trust in the keys, and passwords guard the accounts.
Encryption
Data before encryption is called plain text. After encryption it is cipher text, which looks like random characters. A key is a secret value used to lock and unlock the data.
Encryption protects data in two places. Data in transit moves across a network, for example in HTTPS or a VPN. Data at rest is stored, for example on a laptop disk or a phone.
Symmetric and asymmetric encryption
| Type | Keys | Strength and use |
|---|---|---|
| Symmetric | One shared key locks and unlocks | Fast, so it is used for the bulk of the data. AES is a well known example |
| Asymmetric | A pair of keys, public and private | Slower, so it is used to share keys and prove identity. RSA is a well known example |
With asymmetric encryption, data locked with the public key can be unlocked only with the matching private key. The public key can be shared freely. The private key must stay secret.
In practice, the two types work together. A connection uses asymmetric methods to agree on a key, and then uses symmetric encryption for the traffic.
Hashing
A hash turns data into a short fixed length value. It cannot be turned back into the original data.
If the data changes at all, the hash changes, so hashes are used to check integrity. Systems also store hashes of passwords, instead of the passwords themselves.
Certificates
A digital certificate links a public key to an identity, such as a website name. It is signed by a trusted certificate authority, or CA.
When you open an HTTPS website, the site sends its certificate. Your browser checks that a trusted CA signed it, that the name matches, and that it has not expired. If all is well, the browser shows the padlock and sets up the encrypted connection.
A certificate that fails these checks produces a warning. A self signed certificate is one that a device signed for itself. It gives encryption but no proof from a trusted authority, so browsers warn about it.
Password complexity
A strong password is hard to guess. Good passwords:
- are long, because every extra character makes guessing harder;
- mix upper and lower case letters, numbers and symbols;
- avoid names, dates and common words;
- are different for every account.
A password manager can create and store a different strong password for each account. Many systems also lock an account after several wrong attempts, which slows down guessing.
Default passwords on new devices, such as routers and cameras, are widely known. Change them first.
What to remember for the exam
Seven facts cover most questions on this topic.
- Encryption turns plain text into cipher text using a key.
- Data in transit and data at rest can both be encrypted.
- Symmetric encryption uses one shared key and is fast. Asymmetric encryption uses a public and private key pair.
- A hash is a one way value used to check integrity.
- A certificate links a public key to an identity and is signed by a certificate authority.
- A browser checks the signature, the name and the expiry date of a certificate.
- Strong passwords are long, mixed, unique and not based on common words.
Keep the private key private and share the public key. If a question says the key must stay secret, it means the private key.
Common mistakes
These four errors appear again and again.
Mixing up the two keys. The public key can be shared. The private key must not be.
Thinking a hash can be reversed. A hash is one way.
Ignoring a certificate warning. It may mean the site is not what it claims to be.
Reusing one password everywhere. If one site is breached, every account that shares the password is at risk.
A padlock shows that the connection is encrypted. It does not prove that the website owner is trustworthy.
Check yourself
Work through these three questions.
What is the difference between symmetric and asymmetric encryption?
Symmetric encryption uses one shared key. Asymmetric encryption uses a public and private key pair.
What does a digital certificate prove?
It links a public key to an identity, and a trusted certificate authority has signed it.
Which qualities make a password strong?
A strong password is long, mixes character types, avoids common words and is unique to each account.
Topic 3 of 5 in Security
Test yourself on Security
The full Cisco CCST 100-150 Networking question bank has 749 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.