General Security Concepts · Topic 5 of 7
Encryption and Key Management
Compare symmetric and asymmetric encryption, key exchange, encryption levels, and key tools such as TPM, HSM, KMS and secure enclaves for Security+.
- 5 min
- Symmetric uses one key and is fast. Asymmetric uses a key pair and is slower.
- AES is the symmetric standard, and RSA and ECC are asymmetric algorithms.
- Encrypt with the recipient's public key, and the recipient decrypts with the private key.
What it is
Encryption turns readable data (plaintext) into unreadable data (ciphertext) with an algorithm and a key. Only someone with the right key can reverse it.
Two families exist. Symmetric encryption uses the same key to lock and unlock. Asymmetric encryption uses a mathematically linked pair: a public key that can be shared and a private key that is kept secret.
How it works
Symmetric and asymmetric compared
| Feature | Symmetric | Asymmetric |
|---|---|---|
| Keys | One shared secret key | Public and private key pair |
| Speed | Fast, suited to large data | Slower, suited to small data |
| Main problem | Sharing the key safely | Performance |
| Examples | Advanced Encryption Standard (AES) | Rivest Shamir Adleman (RSA), elliptic curve cryptography (ECC) |
| Typical use | Disk, file and bulk traffic encryption | Key exchange, digital signatures, certificates |
AES is the standard symmetric algorithm and supports 128, 192 and 256 bit keys. The Data Encryption Standard (DES) and Triple DES (3DES) are older and should not be chosen for new systems. ECC gives comparable strength with shorter keys than RSA, which suits phones and other small devices.
Using both together
Real protocols combine the two. Transport Layer Security (TLS) uses asymmetric methods to agree on a session key, and then encrypts the actual traffic with a fast symmetric cipher.
A key exchange method such as Diffie Hellman lets two parties build a shared secret over an open network. When fresh temporary keys are used for each session, an old recorded session cannot be decrypted later if a long term key leaks. This property is called perfect forward secrecy.
Levels of encryption
Encryption can be applied at several points.
| Level | What is protected |
|---|---|
| Full disk | Everything on a drive, including the operating system |
| Partition or volume | One section of a disk |
| File | Single files or folders |
| Database | Whole database or specific records and columns |
| Transport or communication | Data in motion, as in TLS or a virtual private network (VPN) |
Full disk encryption protects a lost laptop but does not protect files once the system is unlocked and running. File and database encryption protect against someone who gets past the login, depending on who holds the keys.
Tools for holding keys
| Tool | What it does |
|---|---|
| Trusted Platform Module (TPM) | A chip on a device that stores keys and checks that the boot process has not been changed |
| Hardware security module (HSM) | A tamper resistant device or appliance that generates, stores and uses keys for many applications |
| Key management system (KMS) | A service that creates, rotates, stores and retires keys centrally |
| Secure enclave | An isolated area of a processor where sensitive operations run apart from the main operating system |
A TPM belongs to one device. An HSM is shared infrastructure for servers and certificate authorities, and it is a stronger fit when keys are high value.
Key management
Good practice covers the full life of a key: generation, storage, distribution, rotation, revocation and destruction. Keys should not be stored next to the data they protect. Key escrow places a copy with a trusted third party so that data can be recovered if the owner loses the key.
What to remember for the exam
- Symmetric uses one key and is fast. Asymmetric uses a key pair and is slower.
- AES is the symmetric standard, and RSA and ECC are asymmetric algorithms.
- Encrypt with the recipient's public key, and the recipient decrypts with the private key.
- Hybrid designs such as TLS use asymmetric methods to share a key, then symmetric encryption for the data.
- Perfect forward secrecy depends on temporary session keys.
- TPM is a chip in a device. HSM is a dedicated hardware device for key operations.
- A KMS manages key lifecycle. A secure enclave isolates sensitive processing.
- Full disk encryption mainly protects data at rest when a device is powered off or stolen.
When the scenario is "protect a laptop if it is stolen", full disk encryption backed by a TPM is the usual answer.
Common mistakes
Saying asymmetric is always better. It is slower, so it is used for key exchange and signatures, and symmetric ciphers handle bulk data.
Mixing up which key does what. For confidentiality, the sender uses the recipient's public key. Using the private key to sign is a different use.
Treating a TPM and an HSM as the same. A TPM is tied to one machine, while an HSM serves many systems and offers stronger physical protection.
Believing encryption makes a weak password safe. If the key is guessable or stored with the data, the protection fails.
Ignoring key rotation. Long lived keys give an attacker more time to break or steal them.
Losing a key without a recovery plan means losing the data. Plan for escrow or backup of keys before encrypting important data.
Check yourself
Which kind of encryption is used for bulk data in a TLS session?
Symmetric encryption, using a session key that was agreed through asymmetric methods.
What is the difference between a TPM and an HSM?
A TPM is a chip bound to a single device. An HSM is a dedicated, tamper resistant device that manages keys for many applications.
What does perfect forward secrecy protect against?
It stops an attacker from decrypting old recorded sessions after a long term key is stolen.
Topic 5 of 7 in General Security Concepts
Test yourself on General Security Concepts
The full CompTIA Security+ SY0-701 question bank has 848 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.