Cryptography · Topic 1 of 3
Cryptography Concepts and Encryption Algorithms
Learn symmetric and asymmetric encryption, hashing and digital signatures, with key sizes for DES, 3DES, AES, RSA, ECC, MD5 and SHA, for CEH v13.
- 5 min
- Symmetric: one shared key, fast. Asymmetric: key pair, slower.
- AES uses 128, 192 or 256 bit keys in 128 bit blocks.
- RSA, DSA, ECC and Diffie-Hellman are asymmetric. Diffie-Hellman is for key exchange.
What it is
Cryptography is the practice of protecting information so that only the intended parties can read or change it. It provides confidentiality, integrity, authentication and non-repudiation.
This page covers the core concepts and the main algorithms: symmetric ciphers, asymmetric ciphers, hash functions and digital signatures. The exam asks you to match an algorithm to its type, key size or purpose.
How it works
Core concepts
| Term | Meaning |
|---|---|
| Plaintext and ciphertext | Readable data and its encrypted form |
| Cipher | The algorithm that encrypts and decrypts |
| Key | The secret value that controls the cipher |
| Stream cipher | Encrypts data one bit or byte at a time (RC4) |
| Block cipher | Encrypts fixed size blocks (AES, DES) |
| Substitution and transposition | Replacing symbols, and rearranging their order |
| Confidentiality | Only authorized parties can read the data |
| Integrity | The data was not changed |
| Authentication | The sender or system is who it claims to be |
| Non-repudiation | The sender cannot deny the action later |
| Key escrow | A copy of a key held by a trusted third party for recovery |
Kerckhoffs's principle states that a system should stay secure even if everything except the key is public. This is why standard, published algorithms are preferred over secret ones.
Symmetric encryption
One shared secret key encrypts and decrypts. It is fast and suits bulk data, but the key must be shared securely.
| Algorithm | Block or stream | Key size | Notes |
|---|---|---|---|
| DES | Block, 64 bits | 56 bits | Obsolete. Brute forced easily. |
| 3DES | Block, 64 bits | 168 bit key (112 bits effective strength) | Applies DES three times. Being retired. |
| AES | Block, 128 bits | 128, 192 or 256 bits | The current standard, also called Rijndael |
| Blowfish | Block, 64 bits | 32 to 448 bits | Fast, public domain |
| Twofish | Block, 128 bits | Up to 256 bits | Successor to Blowfish |
| RC4 | Stream | 40 to 2048 bits | Deprecated because of biases |
| RC5 | Block | Variable | Variable block size, key size and rounds |
| IDEA | Block, 64 bits | 128 bits | Used in older PGP versions |
Asymmetric encryption
A pair of keys is used. The public key can be shared, and the private key is kept secret. Data encrypted with the public key is decrypted only with the private key. It solves key distribution, but is slower, so it is often used to protect a symmetric session key.
| Algorithm | Purpose | Notes |
|---|---|---|
| RSA | Encryption and signatures | Based on the difficulty of factoring the product of two large primes. 2048 bits or more is recommended. |
| Diffie-Hellman | Key exchange | Two parties agree on a shared secret over an open channel. Does not encrypt data itself. |
| DSA | Signatures | Digital Signature Algorithm |
| ECC | Encryption, signatures, key exchange | Elliptic curve cryptography. Shorter keys for the same strength. |
| ElGamal | Encryption and signatures | Based on discrete logarithms |
Hash functions
A hash function turns data of any size into a fixed length value. It is one way, so the original cannot be recovered, and a small change gives a very different hash. Hashes check integrity and store passwords.
| Hash | Output size | Status |
|---|---|---|
| MD5 | 128 bits | Broken for collisions, avoid for security |
| SHA-1 | 160 bits | Deprecated because collisions are practical |
| SHA-2 | 224, 256, 384 or 512 bits | Current standard |
| SHA-3 | 224 to 512 bits | Latest standard, built on a different design (Keccak) |
A HMAC combines a hash with a secret key to provide integrity and authentication. A salt is random data added before hashing a password, so equal passwords give different hashes.
Digital signatures
A signature is made by hashing the message and encrypting the hash with the sender's private key. Anyone can check it with the sender's public key. It gives integrity, authentication and non-repudiation, but not confidentiality.
A worked example
Alice wants to send Bob a large file privately. She encrypts the file with a fresh AES key, because symmetric encryption is fast. She then encrypts that AES key with Bob's public RSA key and sends both.
Bob uses his private key to recover the AES key, and then decrypts the file. This hybrid design combines the speed of symmetric encryption with the key distribution of asymmetric encryption. If Alice also signs a hash of the file with her private key, Bob can confirm who sent it and that it was not changed.
How the exam asks about this
- "Which symmetric algorithm uses a 56 bit key?" → DES.
- "Which key does a recipient use to verify a digital signature?" → The sender's public key.
- "What is the output size of SHA-256?" → 256 bits.
What to remember for the exam
- Symmetric: one shared key, fast. Asymmetric: key pair, slower.
- AES uses 128, 192 or 256 bit keys in 128 bit blocks.
- RSA, DSA, ECC and Diffie-Hellman are asymmetric. Diffie-Hellman is for key exchange.
- MD5 is 128 bits, SHA-1 is 160 bits, SHA-256 is 256 bits.
- A signature uses the sender's private key to sign and the public key to verify.
Hashing is not encryption. A hash cannot be reversed, so a question that asks for a way to recover original data from a hash is a trap.
Common mistakes
Encrypting with the private key for confidentiality. Confidentiality uses the recipient's public key, and signing uses the sender's private key.
Calling 3DES a 168 bit secure cipher. Its effective strength is lower, and it is being retired.
Expecting a hash to protect confidentiality. It protects integrity only.
Check yourself
Which key encrypts a message so only Bob can read it?
Bob's public key.
What is a salt used for?
It makes equal passwords produce different hashes and defeats precomputed tables.
Why do systems combine symmetric and asymmetric encryption?
Symmetric encryption is fast for data, and asymmetric encryption safely shares the symmetric key.
Topic 1 of 3 in Cryptography
Test yourself on Cryptography
The full EC-Council 312-50 question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.