Network Perimeter Protection · Topic 2 of 6
Cryptography and Network Security Protocols
Review symmetric, asymmetric and hashing techniques, algorithms and sizes (AES, RSA, SHA), and secure protocols like TLS, IPsec and SSH with their ports.
- 5 min
- Symmetric is fast with one key, asymmetric uses a key pair, hashing has no key.
- AES with 128, 192 or 256 bit keys is the standard symmetric choice.
- RSA is asymmetric, and Diffie-Hellman agrees keys but does not encrypt.
What it is
Cryptography protects data so that only the right people can read it (confidentiality), so that changes are noticed (integrity) and so that the sender can be identified (authenticity and non repudiation). Network security protocols apply these techniques to traffic in transit.
The exam asks you to match an algorithm to its type and size, and to match a protocol to its job and port.
How it works
Cryptographic techniques
| Technique | Key | Use |
|---|---|---|
| Symmetric encryption | One shared secret key | Fast bulk encryption of data |
| Asymmetric encryption | Public and private key pair | Key exchange, signatures, certificates |
| Hashing | No key | Integrity check. A fixed length digest that cannot be reversed. |
| Digital signature | Sender's private key signs a hash | Authenticity, integrity, non repudiation |
| HMAC | Hash plus shared key | Integrity and authenticity of a message |
| Key exchange | Diffie-Hellman or similar | Agree a shared key over an open network |
Real protocols use a hybrid approach: asymmetric methods set up the session and exchange a symmetric key, then the fast symmetric cipher encrypts the data.
Public key infrastructure (PKI) uses a certificate authority to sign certificates that bind a public key to an identity. Key management covers generation, secure storage, rotation, backup and destruction. A leaked key breaks everything, however strong the algorithm.
Algorithms and sizes
| Algorithm | Type | Key or output size |
|---|---|---|
| DES | Symmetric block | 56 bit key, 64 bit block. Obsolete. |
| 3DES | Symmetric block | 168 bit key (about 112 bits of strength). Deprecated. |
| AES | Symmetric block | 128, 192 or 256 bit key, 128 bit block. The standard choice. |
| Blowfish | Symmetric block | 32 to 448 bit key, 64 bit block |
| Twofish | Symmetric block | Up to 256 bit key, 128 bit block |
| RC4 | Symmetric stream | Variable key. Weak, avoid. |
| RSA | Asymmetric | 2048 bit keys or larger recommended |
| Diffie-Hellman | Key exchange | Agrees a secret, does not encrypt data itself |
| ECC | Asymmetric | Short keys, such as 256 bit, for strength similar to larger RSA |
| DSA | Asymmetric | Digital signatures only |
| MD5 | Hash | 128 bit digest. Broken for security use. |
| SHA-1 | Hash | 160 bit digest. Deprecated. |
| SHA-2 | Hash | 224, 256, 384 or 512 bit digests |
| SHA-3 | Hash | Newer standard family |
A block cipher works on fixed size blocks, and a stream cipher works on a continuous stream. Salting a password before hashing stops precomputed rainbow table attacks.
Network security protocols
| Protocol | Job | Port or number |
|---|---|---|
| TLS (successor of SSL) | Encrypts application traffic. TLS 1.3 is current. | HTTPS 443 |
| IPsec | Encrypts and authenticates IP packets. Used in VPNs. | IKE UDP 500, NAT traversal UDP 4500 |
| IPsec AH | Integrity and authentication, no encryption | IP protocol 51 |
| IPsec ESP | Encryption plus integrity | IP protocol 50 |
| SSH | Secure remote shell and tunnels, replaces Telnet | TCP 22 |
| SFTP | File transfer over SSH | TCP 22 |
| FTPS | FTP protected with TLS | 990 (implicit), 21 (explicit) |
| HTTPS | HTTP over TLS | TCP 443 |
| SNMPv3 | Network management with authentication and encryption | UDP 161 |
| DNSSEC | Signs DNS data so answers can be validated | UDP and TCP 53 |
| LDAPS | Directory over TLS | 636 |
| S/MIME and PGP | Email message protection | Application level |
| Kerberos | Ticket based authentication | 88 |
| WPA2 and WPA3 | Wireless encryption | Wi-Fi |
IPsec modes: transport mode protects the payload of the original packet, and tunnel mode wraps the whole original packet in a new one, as site to site VPNs do. IKE negotiates the security associations and keys.
Weak and plaintext protocols to replace: Telnet (23), FTP (21), HTTP (80), SNMPv1 and v2c, SSLv3 and early TLS.
A worked example
A branch office connects to headquarters over the internet. The network team builds an IPsec tunnel mode VPN with ESP using AES, authenticated by certificates, and they disable Telnet in favor of SSH for router management.
If someone captures the traffic, they see only ciphertext between the two gateway addresses. Management sessions to the routers are also encrypted, so passwords are not exposed.
How the exam asks about this
- "Which algorithm uses a 56 bit key and is no longer considered secure?" → DES.
- "Which IPsec protocol provides encryption?" → ESP.
- "Which protocol replaces Telnet for secure remote administration?" → SSH.
What to remember for the exam
- Symmetric is fast with one key, asymmetric uses a key pair, hashing has no key.
- AES with 128, 192 or 256 bit keys is the standard symmetric choice.
- RSA is asymmetric, and Diffie-Hellman agrees keys but does not encrypt.
- MD5 and SHA-1 are not suitable for new security uses, so SHA-2 or SHA-3 are preferred.
- SSH is port 22, HTTPS is 443, IKE is UDP 500, ESP is protocol 50 and AH is 51.
A hash is not encryption. It cannot be decrypted, so "decrypting a hash" is the wrong idea. Weak passwords are found by guessing, not by reversing.
Common mistakes
Using the wrong key. To encrypt for someone you use their public key. To sign, you use your own private key.
Treating HTTPS as full protection. TLS protects the channel, but the destination server can still be malicious or vulnerable.
Mixing AH and ESP. AH authenticates but does not hide content, and ESP can do both.
Check yourself
What does a digital signature give you?
Authenticity, integrity and non repudiation, created with the sender's private key.
Which IPsec mode is used for site to site VPN gateways?
Tunnel mode.
Why use salt when hashing passwords?
It makes identical passwords hash differently and defeats rainbow tables.
Topic 2 of 6 in Network Perimeter Protection
Test yourself on Network Perimeter Protection
The full EC-Council 312-38 question bank has 800 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.