Fundamentals of Encryption Technologies · Topic 2 of 2
Encryption and Hash Algorithms
Learn DES, 3DES, AES, SM4, RSA, DH, ECC and SM2, plus MD5, SHA-1, SHA-2, SM3 and HMAC, with the key and digest lengths the HCIA-Security exam tests.
- 5 min
- DES: 64 bit block, 56 bit effective key. AES: 128 bit block, 128, 192 or 256 bit key. SM4: 128 bit block and key.
- RSA does encryption and signatures; DH does key exchange only; DSA does signatures only.
- ECC and SM2 use elliptic curves and need much shorter keys than RSA for the same strength.
What it is
The exam expects you to sort algorithms into three families and know their key facts. Symmetric algorithms encrypt bulk data with one shared key. Asymmetric algorithms use a key pair for key exchange, signatures and small data.
Hash algorithms are not encryption at all. They turn data of any length into a short fixed-length digest that cannot be reversed, which is used to check integrity.
How it works
Block and stream ciphers
Symmetric algorithms come in two kinds. A block cipher encrypts fixed-size blocks, such as 64 or 128 bits at a time. A stream cipher encrypts data one bit or byte at a time using a key stream, and RC4 is the classic example.
Symmetric algorithms
| Algorithm | Block size | Key length | Notes |
|---|---|---|---|
| DES | 64 bits | 64 bits, of which 56 are effective (8 parity bits) | 16 rounds; easy to brute force today |
| 3DES | 64 bits | 168 bits with three keys (112 bits with two) | Runs DES three times (encrypt, decrypt, encrypt); slow |
| AES | 128 bits | 128, 192 or 256 bits | Rijndael algorithm, 10, 12 or 14 rounds; US standard since 2001 |
| SM1 | 128 bits | 128 bits | Chinese algorithm, not public, built into hardware chips |
| SM4 | 128 bits | 128 bits | Chinese public block cipher, 32 rounds, used in wireless and VPN products |
| RC4 | Stream | Variable | Stream cipher, now considered weak |
DES and 3DES are kept on devices for compatibility, but Huawei documentation flags DES and 3DES as insecure. Choose AES (or SM4 where Chinese algorithms are required) for new configurations.
Asymmetric algorithms
| Algorithm | Based on | Used for |
|---|---|---|
| RSA | Difficulty of factoring large integers | Encryption and digital signatures; 2048 bits or longer recommended |
| DH | Discrete logarithm problem | Key exchange only, not encryption or signatures |
| DSA | Discrete logarithm problem | Digital signatures only |
| ECC | Elliptic curve discrete logarithm | Signatures and key exchange with much shorter keys |
| SM2 | Elliptic curve (Chinese standard, 256 bit) | Signatures, key exchange and encryption |
DH lets two parties compute the same secret key while sending only public values. An eavesdropper who sees those values cannot work out the secret. DH alone does not authenticate the peers, so it is open to a man in the middle unless the exchange is authenticated, for example by a pre-shared key or certificate in IKE.
DH strength is chosen by the DH group. Group 2 uses a 1024 bit modulus, group 5 a 1536 bit modulus and group 14 a 2048 bit modulus; groups 19 and 20 use elliptic curves. Both IPsec peers must use the same group.
ECC gives the same strength as RSA with far shorter keys. A 256 bit ECC key is roughly as strong as a 3072 bit RSA key, which saves processing on firewalls and mobile devices.
Hash algorithms
A hash function has four properties the exam likes to test:
- Fixed output length, whatever the input size.
- One way: you cannot recover the input from the digest.
- Collision resistant: it is infeasible to find two inputs with the same digest.
- Avalanche effect: changing one bit of input changes the digest completely.
| Algorithm | Digest length | Status |
|---|---|---|
| MD5 | 128 bits | Collisions found; do not use for security |
| SHA-1 | 160 bits | Collisions demonstrated; being phased out |
| SHA-2 (SHA-224, SHA-256, SHA-384, SHA-512) | 224, 256, 384 or 512 bits | Recommended |
| SM3 | 256 bits | Chinese standard hash |
SHA-2 names carry the digest length, so SHA-256 gives 256 bits. SHA-1 gives 160 bits.
HMAC
A plain hash proves that data has not changed, but anyone can recompute it after changing the data. HMAC mixes a shared secret key into the hash, so only a holder of the key can produce the right value.
HMAC therefore gives integrity and data origin authentication. IPsec uses it in algorithms such as HMAC-SHA2-256 for both AH and ESP.
A worked example
An administrator downloads a firewall software image and the website lists its SHA-256 value. After the download, the administrator computes the SHA-256 digest of the file.
If the values match, the file is intact. A single changed bit would give a completely different digest.
How the exam asks about this
- "Which of the following are symmetric encryption algorithms?" → DES, 3DES, AES and SM4 (not RSA, DH or SHA).
- "What is the digest length of SHA-1?" → 160 bits.
- "Which algorithm is used only to negotiate a shared key and cannot encrypt data?" → DH.
What to remember for the exam
- DES: 64 bit block, 56 bit effective key. AES: 128 bit block, 128, 192 or 256 bit key. SM4: 128 bit block and key.
- RSA does encryption and signatures; DH does key exchange only; DSA does signatures only.
- ECC and SM2 use elliptic curves and need much shorter keys than RSA for the same strength.
- MD5 128 bits, SHA-1 160 bits, SHA-256 256 bits, SM3 256 bits.
- A hash is one way and has a fixed length; HMAC adds a key for origin authentication.
A hash is not encryption. It cannot be decrypted, so "MD5 encrypts the password and the device decrypts it" is always a wrong statement.
Common mistakes
Putting DH among encryption algorithms. DH is asymmetric, but it only agrees on a shared key. The data is then encrypted with a symmetric algorithm such as AES.
Counting the DES key as 64 bits. The key field is 64 bits, but 8 of them are parity bits. The effective key length is 56 bits.
Treating a longer digest as encryption strength. Digest length measures collision resistance of a hash. It says nothing about confidentiality, because a hash hides nothing that needs decrypting.
Check yourself
Which Chinese algorithm is a 256 bit hash?
SM3. SM4 is the block cipher and SM2 is the elliptic curve public key algorithm.
Why is AES preferred to 3DES?
AES has a 128 bit block and keys up to 256 bits and runs much faster, while 3DES uses a 64 bit block and runs DES three times.
What does HMAC add to a plain hash?
A shared secret key, so the digest proves both that the data is unchanged and that it came from a key holder.
Topic 2 of 2 in Fundamentals of Encryption Technologies
Test yourself on Fundamentals of Encryption Technologies
The full Huawei HCIA-Security H12-711 question bank has 600 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Huawei. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.