Security Architecture and Engineering · Topic 5 of 8
Cryptographic Solutions
Symmetric and asymmetric cryptography, hashing, digital signatures, PKI, key management practices and quantum-resistant algorithms for the CISSP exam.
- 4 min
- Includes a diagram
- Symmetric for bulk speed; asymmetric for key exchange and signatures; hashes for integrity.
- Sign with your private key; others verify with your public key.
- Encrypt to someone with their public key; they decrypt with their private key.
What it is
Cryptography protects confidentiality, integrity, authenticity and nonrepudiation. The exam tests which tool gives which property, how keys are managed and how certificates create trust. You will not compute algorithms, but you must choose the right one for the requirement.
How it works
Cryptographic methods
| Method | Keys | Use | Examples |
|---|---|---|---|
| Symmetric | One shared secret key | Bulk encryption, fast | AES (128, 192, 256-bit keys), ChaCha20; legacy DES and 3DES |
| Asymmetric | Public and private key pair | Key exchange, digital signatures | RSA, elliptic curve cryptography (ECC), Diffie-Hellman |
| Hashing | No key | Integrity check, fixed-length digest | SHA-2, SHA-3; MD5 and SHA-1 are broken for collision resistance |
| Elliptic curves | Asymmetric with smaller keys | Mobile and constrained devices | ECDH, ECDSA |
| Quantum-resistant | New algorithm families | Protection against future quantum attacks | NIST standards ML-KEM, ML-DSA and SLH-DSA |
Key counts: n people need n(n−1)/2 symmetric keys for every pair to communicate privately, but only 2n asymmetric keys (one pair each).
Real systems are hybrid. Asymmetric cryptography exchanges or protects a symmetric session key, and the symmetric key encrypts the bulk data. TLS works this way.
What each tool provides
| Need | Tool |
|---|---|
| Confidentiality | Encrypt with the recipient's public key (or a shared symmetric key) |
| Integrity | Hash, or a keyed hash (HMAC) |
| Authenticity and nonrepudiation | Digital signature: hash the message and sign the hash with the sender's private key |
| Verify a signature | Use the sender's public key |
Public key infrastructure (PKI)
| Component | Role |
|---|---|
| Certificate authority (CA) | Issues and signs certificates |
| Registration authority (RA) | Verifies identity before issuance |
| Certificate (X.509) | Binds a public key to an identity, signed by the CA |
| CRL and OCSP | Ways to check whether a certificate is revoked |
| Root and intermediate CAs | Root kept offline; intermediates issue day-to-day certificates |
Trust in a certificate depends on trusting the CA that signed it and checking that the certificate has not expired or been revoked.
Key management practices
| Practice | Purpose |
|---|---|
| Generation with good randomness | Unpredictable keys |
| Secure distribution | Keys reach only intended parties |
| Storage in HSMs or key vaults | Protect keys at rest |
| Rotation | Limit damage from exposure |
| Split knowledge and dual control | No single person holds a whole critical key |
| Threshold schemes (M of N) | Any M of N custodians can rebuild a key, so recovery survives absences |
| Escrow and recovery | Recover encrypted data if keys are lost |
| Revocation and destruction | Retire compromised or expired keys |
Digital certificates and signatures in practice
Code signing proves software came from the publisher and was not altered. Email signing (for example S/MIME) proves the sender. Certificate pinning reduces the risk of a fraudulent certificate from another CA.
How the exam asks about this
- "No single administrator should recover the backup master key, but recovery must work if two of five custodians are away." A 3-of-5 threshold scheme.
- "Which key does a recipient use to verify a digital signature?" The sender's public key.
- "How many symmetric keys do 10 people need?" 45.
What to remember for the exam
- Symmetric for bulk speed; asymmetric for key exchange and signatures; hashes for integrity.
- Sign with your private key; others verify with your public key.
- Encrypt to someone with their public key; they decrypt with their private key.
- n(n−1)/2 symmetric keys versus 2n asymmetric keys.
- Split knowledge, dual control and M-of-N schemes protect critical keys.
Hashing is not encryption. A hash cannot be reversed to recover the data and gives no confidentiality.
Common mistakes
Encrypting with your own private key for confidentiality. Anyone with your public key can read it.
Using MD5 or SHA-1 where collision resistance matters.
Keeping a single copy of a master key with one person.
Check yourself
Which key signs a digital signature?
The sender's private key.
How many symmetric keys are needed for 20 people to communicate in private pairs?
190.
What lets any 3 of 5 custodians reconstruct a key?
A threshold secret-sharing scheme.
Topic 5 of 8 in Security Architecture and Engineering
Test yourself on Security Architecture and Engineering
The full ISC2 CISSP question bank has 1,113 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.