Protection of Information Assets · Topic 4 of 8
Data Encryption and Public Key Infrastructure
Symmetric and asymmetric encryption, hashing, digital signatures, key management, and certificate and registration authorities, CRL and OCSP in a PKI.
- 4 min
- Includes a diagram
- Symmetric: one key, fast; asymmetric: key pair, slow, solves key distribution.
- Encrypt with the recipient's public key; sign with the sender's private key.
- Hashing gives integrity; signatures add authenticity and non-repudiation.
What it is
Encryption transforms readable data into ciphertext that only holders of the right key can read, protecting confidentiality at rest and in transit. Hashing and digital signatures protect integrity and prove origin. A public key infrastructure (PKI) issues and manages the digital certificates that bind public keys to identities, so people and systems can trust them.
How it works
Symmetric and asymmetric encryption
| Symmetric | Asymmetric | |
|---|---|---|
| Keys | One shared secret key | A key pair: public and private |
| Speed | Fast; suits bulk data | Slow; suits small data and key exchange |
| Main problem | Securely sharing the key | Trusting that a public key belongs to its owner |
| Examples | AES | RSA, elliptic curve cryptography |
In practice they are combined: asymmetric encryption exchanges a symmetric session key, which then encrypts the data. TLS works this way.
Which key does what
| Goal | Key used |
|---|---|
| Confidentiality to a recipient | Encrypt with the recipient's public key; only their private key decrypts |
| Digital signature (authenticity, integrity, non-repudiation) | Sign the message hash with the sender's private key; anyone verifies with the sender's public key |
Hashing
A hash function such as SHA-256 produces a fixed-length value from any input. It is one-way, and any change to the input changes the hash. Hashes detect alteration and protect stored passwords (with a salt). A hash alone does not prove who created the data; a digital signature does.
Key management
Encryption is only as strong as key management: generate keys securely, store them protected (for example in a hardware security module), restrict and log access, rotate them, back them up securely and destroy them when retired. Keys should not be stored alongside the data they protect.
Where encryption is used
- Data at rest: full-disk, database, file and backup encryption.
- Data in transit: TLS for web and APIs, VPNs, encrypted email.
- Data in use: emerging techniques; usually protected by access control.
PKI components
| Component | Role |
|---|---|
| Certificate authority (CA) | Issues and signs digital certificates, vouching that a public key belongs to a subject |
| Registration authority (RA) | Verifies the identity of requesters before the CA issues a certificate |
| Digital certificate (X.509) | Holds the subject's identity, public key, validity period and the CA's signature |
| Certificate revocation list (CRL) | Published list of revoked certificates |
| Online Certificate Status Protocol (OCSP) | Real-time check of a certificate's status |
| Certification practice statement (CPS) | Describes how the CA operates |
A certificate is revoked when its private key is compromised, its holder leaves, or its details change. Systems must check revocation, or a revoked certificate is still trusted.
If a question asks how a recipient verifies who signed a message, the answer is the sender's public key, confirmed through the sender's certificate issued by a trusted CA.
How the exam asks about this
- "Which key encrypts a message so only the recipient can read it?" The recipient's public key.
- "What provides non-repudiation?" A digital signature created with the sender's private key.
- "Which PKI component verifies identity before issuance?" The registration authority.
What to remember for the exam
- Symmetric: one key, fast; asymmetric: key pair, slow, solves key distribution.
- Encrypt with the recipient's public key; sign with the sender's private key.
- Hashing gives integrity; signatures add authenticity and non-repudiation.
- Protect, rotate and separate keys from data.
- CA issues, RA verifies, CRL and OCSP report revocation.
Encrypting data but storing the key in the same database, or in application code, gives an attacker both at once.
Common mistakes
Signing with the public key. Signatures use the private key.
Treating a hash as proof of identity.
Ignoring certificate revocation checks.
Check yourself
What does a digital signature provide?
Integrity, authentication of the sender and non-repudiation.
What is the role of a registration authority?
To verify the identity of certificate requesters before the CA issues certificates.
Why are symmetric and asymmetric encryption often combined?
Asymmetric encryption securely exchanges a symmetric key, which then encrypts bulk data quickly.
Topic 4 of 8 in Protection of Information Assets
Test yourself on Protection of Information Assets
The full ISACA CISA question bank has 1,050 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.