Security Operations · Topic 10 of 10
Encryption Techniques
Encryption for CySA+: symmetric and asymmetric keys, hashing, digital signatures, PKI certificates, data at rest and in transit, TLS and key management.
- 5 min
- Symmetric encryption uses one shared key and is fast, while asymmetric uses a key pair and is slower.
- A hash is one way and checks integrity, while encryption is reversible and protects confidentiality.
- A digital signature gives integrity, authentication and non repudiation.
What it is
Encryption turns readable data (plaintext) into unreadable data (ciphertext) with an algorithm and a key. Only someone with the right key can reverse it. Hashing and digital signatures are related techniques that prove data was not changed and who produced it.
An analyst meets encryption as a control that protects data, as a scan finding when it is weak or missing, and as an obstacle, because encrypted traffic hides content from monitoring tools.
How it works
Symmetric and asymmetric encryption
Symmetric encryption uses one shared secret key to encrypt and decrypt. It is fast and suits large amounts of data, such as whole disks. The Advanced Encryption Standard (AES) is the common example. Its weakness is sharing the key safely.
Asymmetric encryption uses a key pair. The public key can be shared freely, and the private key must stay secret. Data encrypted with the public key can be decrypted only with the private key. It is slower, so it suits small items such as exchanging a session key. Rivest Shamir Adleman (RSA) and elliptic curve cryptography (ECC) are common examples.
| Feature | Symmetric | Asymmetric |
|---|---|---|
| Keys | One shared key | Public and private pair |
| Speed | Fast | Slower |
| Typical use | Bulk data, disk and database encryption | Key exchange, signatures, certificates |
| Main problem | Sharing the key safely | Protecting the private key and trusting the public key |
Hashing and digital signatures
A hash function turns any input into a fixed length fingerprint, such as a Secure Hash Algorithm 256 (SHA-256) value. It is one way, so the original cannot be recovered, and a tiny change in the input gives a completely different hash.
Hashes check integrity and are used to store passwords, ideally with a salt (random data added before hashing).
A digital signature is a hash of the data encrypted with the sender's private key. Anyone can verify it with the sender's public key. A valid signature shows that the data was not altered (integrity), who signed it (authentication) and that the signer cannot easily deny it (non repudiation).
PKI and certificates
A public key infrastructure (PKI) is the set of roles and rules that make public keys trustworthy. A certificate authority (CA) issues a certificate that binds a public key to an identity such as a website name, and signs it. A client trusts a certificate when it chains up to a CA that it already trusts.
A certificate that is expired, self signed, issued for a different name or revoked is a finding. Revocation status is published in a certificate revocation list (CRL) or answered by the Online Certificate Status Protocol (OCSP).
Data at rest and in transit
| State | Protection | Examples |
|---|---|---|
| At rest | Encryption of stored data | Full disk encryption, database and file encryption, encrypted backups |
| In transit | Encryption of data on the move | Transport Layer Security (TLS), virtual private network (VPN), Secure Shell (SSH) |
TLS secures web and many other connections. In the handshake the server proves its identity with a certificate, and the two sides agree on a session key. Asymmetric methods authenticate the server and help agree the key, and then fast symmetric encryption protects the data. Old versions such as TLS 1.0 are common scan findings.
Key management
Strong algorithms fail if keys are handled badly.
- Store keys apart from the data they protect, in a hardware security module (HSM) or a cloud key management service.
- Limit access to keys on a least privilege basis, and log their use.
- Rotate keys on a schedule and after suspected exposure, and destroy retired ones.
- Back up keys securely, because losing a key means losing the data.
Never leave private keys in source code or shared folders.
What to remember for the exam
- Symmetric encryption uses one shared key and is fast, while asymmetric uses a key pair and is slower.
- A hash is one way and checks integrity, while encryption is reversible and protects confidentiality.
- A digital signature gives integrity, authentication and non repudiation.
- A certificate authority signs certificates that bind a public key to an identity.
- Expired, self signed, mismatched or revoked certificates are findings.
- TLS protects data in transit by combining asymmetric authentication with symmetric bulk encryption.
- Key management covers secure storage, access control, backup, rotation and destruction.
When a question asks which type of encryption to use for a large volume of data, choose symmetric. When it asks about exchanging keys or proving identity, choose asymmetric.
Common mistakes
Calling hashing a form of encryption. A hash cannot be reversed, so it proves integrity but cannot protect data for later recovery.
Mixing up the keys. A signature is made with the private key and checked with the public key.
Thinking a padlock means a safe site. TLS shows only that the connection is encrypted and the certificate matches the name, and malicious sites can have valid certificates too.
Storing the key beside the data. A key kept next to the encrypted data or in source code gives little protection.
Check yourself
Why does TLS use both asymmetric and symmetric encryption?
Asymmetric methods authenticate the server and help agree a session key, and fast symmetric encryption then protects the bulk data.
What does a digital signature prove?
It shows that the data was not altered and that it was signed by the holder of the private key, so the signer cannot easily deny it.
Where should encryption keys be stored?
Apart from the data they protect, in a hardware security module or key management service, with limited access and logging.
Topic 10 of 10 in Security Operations
Test yourself on Security Operations
The full CompTIA CySA+ CS0-004 question bank has 654 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.