Essential Security Principles · Topic 5 of 5
Encryption, Hashing, Certificates and PKI
Learn symmetric and asymmetric encryption, hashing, digital certificates, PKI, strong and weak algorithms, data states and encrypted protocols.
- 5 min
- Symmetric encryption uses one shared key and is fast.
- Asymmetric encryption uses a public and private key pair.
- Hashing is one way and checks integrity, but it does not hide data.
What it is
Encryption turns readable data into unreadable data so that only the right people can use it.
Plain readable data is called plaintext, and the scrambled result is called ciphertext. A key is the secret value that locks and unlocks the data.
This page covers the two kinds of encryption, hashing, certificates and the public key infrastructure that manages them, and the protocols that rely on all of these.
How it works
Different tools protect different goals, so you must match the tool to the need.
Symmetric and asymmetric encryption
| Type | Keys | Strengths | Weaknesses |
|---|---|---|---|
| Symmetric | One shared secret key for both locking and unlocking | Fast, good for large amounts of data | Both sides must share the key safely |
| Asymmetric | A key pair, one public and one private | Solves key sharing, supports digital signatures | Slower |
AES is the common symmetric algorithm. RSA is a well known asymmetric algorithm.
With asymmetric encryption, data locked with the public key can only be unlocked with the matching private key. The public key can be shared openly, but the private key must stay secret.
In practice the two work together. Asymmetric methods are used to agree on a shared key, and then fast symmetric encryption protects the bulk of the data.
Hashing
A hash function turns any amount of data into a fixed length value called a hash or digest. It is one way, so you cannot turn the hash back into the data.
A good hash changes completely when even one character of the input changes. This makes hashing ideal for checking integrity, for example confirming that a downloaded file was not altered. It is also used to store passwords safely.
Hashing is not encryption, because there is no key and no way to reverse it. SHA-256 is a strong hash. MD5 and SHA-1 are older hashes that are considered weak.
Digital signatures, certificates and PKI
A digital signature proves who sent a message and that it was not changed. The sender signs with their private key, and anyone can check the signature with the public key.
A digital certificate links a public key to an identity, such as a website. It is issued and signed by a trusted certificate authority (CA). When your browser trusts the CA, it can trust the certificate.
Public key infrastructure (PKI) is the whole system that creates, distributes, stores and revokes certificates. It includes certificate authorities, the certificates themselves, and the rules for managing keys. A certificate that is expired, revoked or issued to a different name should not be trusted.
Strong and weak algorithms
Strong algorithms are widely tested and use long keys. Weak ones have known flaws or keys that are too short.
| Weak or outdated | Stronger choice |
|---|---|
| DES and 3DES | AES |
| MD5 and SHA-1 | SHA-256 or stronger |
| Very short RSA keys | Longer RSA keys |
| SSL and early TLS | Current TLS |
Avoid inventing your own algorithm. Standard, public algorithms are trusted because experts have tried to break them.
States of data and protocols
Data exists in three states, and each needs suitable protection.
| State | Meaning | Typical protection |
|---|---|---|
| In transit | Moving across a network | TLS, VPN |
| At rest | Stored on a disk or in a database | Disk or file encryption |
| In use | Being processed in memory | Access control, secure application design |
Common protocols that use encryption include:
- HTTPS, which is HTTP protected by TLS
- SSH, for secure remote command line access, replacing Telnet
- SFTP, for secure file transfer, replacing FTP
- IPsec and TLS based VPNs
- WPA2 and WPA3 for wireless networks
What to remember for the exam
Seven facts cover most questions on this topic.
- Symmetric encryption uses one shared key and is fast.
- Asymmetric encryption uses a public and private key pair.
- Hashing is one way and checks integrity, but it does not hide data.
- A certificate authority signs certificates that link a public key to an identity.
- PKI is the system for issuing, managing and revoking certificates.
- MD5, SHA-1 and DES are weak, and AES and SHA-256 are strong.
- Data in transit, at rest and in use each need protection, and HTTPS, SSH and VPNs protect data in transit.
Hash for integrity, symmetric for speed, asymmetric for key exchange and signatures.
Common mistakes
These four errors are common.
Calling hashing a form of encryption. A hash cannot be reversed and uses no key.
Sharing the private key. Only the public key is shared. The private key must stay secret.
Trusting any certificate. Check that the certificate is valid, unexpired, and issued by a trusted authority for the right name.
Ignoring data at rest. A lost laptop exposes everything on it unless the disk is encrypted.
Telnet and FTP send data, including passwords, in plaintext. Use SSH and SFTP or another encrypted option instead.
Check yourself
Work through these three questions.
What is the main difference between symmetric and asymmetric encryption?
Symmetric encryption uses one shared key. Asymmetric encryption uses a public and private key pair.
Why is hashing used to check integrity?
A hash is a fixed length value that changes completely if the data changes, so a different hash shows the data was altered.
What does a certificate authority do?
It signs digital certificates that link a public key to an identity, so others can trust that identity.
Topic 5 of 5 in Essential Security Principles
Test yourself on Essential Security Principles
The full Cisco CCST 100-160 Cybersecurity question bank has 864 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.