Cryptography · Topic 1 of 4
Cryptography Terminology and Encryption Methods
Learn core cryptography terms and the main encryption methods: symmetric, asymmetric, block, stream, hashing and signatures, and where RouterOS uses them.
- 5 min
- Plaintext is encrypted into ciphertext with a key, and decrypted with a key.
- The algorithm is public. Only the key is secret.
- A longer key makes brute force harder.
What it is
Cryptography is the science of protecting information so that only the right people can read it or change it.
It supports the security services you met earlier, such as confidentiality, integrity and authentication. Almost every secure feature on a router, from SSH to IPsec, depends on it.
This page covers the vocabulary first. It then shows the main methods that turn readable data into protected data.
How it works
A cipher takes data and a key and produces output that is useless without the right key.
Basic terms
| Term | Meaning |
|---|---|
| Plaintext | The original readable data |
| Ciphertext | The data after encryption |
| Encryption | Turning plaintext into ciphertext |
| Decryption | Turning ciphertext back into plaintext |
| Cipher or algorithm | The mathematical procedure used |
| Key | The secret value that the procedure needs |
| Hash | A fixed size fingerprint of data, made by a one way function |
| Cryptanalysis | The study of breaking ciphers |
A good system follows one rule. The algorithm is public, and only the key is secret. If security depends on hiding the algorithm, it fails once the algorithm is found.
Why key length matters
The longer the key, the more keys an attacker must try. A key that is too short can be found by trying every possibility, which is called a brute force attack. A long key makes that impractical.
Classical methods
Old ciphers worked on letters, and they show the two basic ideas. Substitution replaces each symbol with another. Transposition keeps the symbols and changes their order.
Modern ciphers combine both ideas many times over, with strong mathematics. Classical ciphers are easy to break and are only a teaching tool.
Symmetric encryption
In symmetric encryption, both sides use the same key to encrypt and to decrypt. It is fast, so it carries the bulk of the data. The weak point is that both sides must get the key safely.
Asymmetric encryption
In asymmetric encryption, there are two keys that belong together, a public key and a private key. What one key encrypts, only the other can decrypt. You publish the public key and keep the private key secret.
It is much slower than symmetric encryption, so it is used for small jobs. These jobs are exchanging keys, proving identity and making signatures.
Block and stream ciphers
| Type | How it works | Note |
|---|---|---|
| Block cipher | Encrypts data in fixed size blocks | A mode of operation chains the blocks together |
| Stream cipher | Encrypts data bit by bit or byte by byte | Good for continuous data |
A block cipher uses a mode of operation and an initialisation vector. The vector makes sure that the same plaintext does not always give the same ciphertext.
Hashing and signatures
A hash function turns any amount of data into a short fixed size value. A small change in the data gives a very different hash. You cannot get the data back from the hash.
Hashes give integrity. If the hash of a received file differs from the expected hash, the file changed.
A digital signature goes further. The sender hashes the message and encrypts the hash with the private key, and anyone can check it with the public key. This gives integrity, authentication and non repudiation.
Hybrid use
Real protocols combine the methods. Asymmetric cryptography proves identity and agrees a shared key.
Then a fast symmetric cipher protects the data, and a hash checks integrity. SSH, HTTPS and IPsec all work in this way.
Where you see it in RouterOS
An IPsec proposal names the encryption and hash algorithms that two peers will use.
/ip ipsec proposal add name=secure auth-algorithms=sha256 enc-algorithms=aes-256-cbc
/ip ipsec proposal printThe enc-algorithms setting selects the symmetric cipher. The auth-algorithms setting selects the hash used for integrity.
Match each tool to its goal. Symmetric ciphers give speed, asymmetric ciphers give safe key exchange and identity, and hashes give integrity.
What to remember for the exam
Eight facts summarise the basics.
- Plaintext is encrypted into ciphertext with a key, and decrypted with a key.
- The algorithm is public. Only the key is secret.
- A longer key makes brute force harder.
- Symmetric encryption uses one shared key and is fast.
- Asymmetric encryption uses a public and a private key and is slow.
- A hash is a one way fixed size fingerprint that gives integrity.
- A digital signature uses the private key to sign and the public key to check.
- Real protocols are hybrid. They use asymmetric methods to set up and symmetric methods for the data.
Common mistakes
Four mistakes appear in exam questions.
Calling a hash encryption. A hash cannot be reversed, so it is not encryption.
Mixing up the keys. You encrypt for confidentiality with the receiver's public key, and you sign with your own private key.
Thinking asymmetric encryption is always better. It is slower, so it is not used for the bulk of the data.
Trusting a secret algorithm. Security must rest on the key and not on hiding how the cipher works.
Keep private keys private. Anyone who holds a private key can sign and decrypt as its owner.
Check yourself
Work through these three questions.
What is the main difference between symmetric and asymmetric encryption?
Symmetric encryption uses one shared key and is fast. Asymmetric encryption uses a public and a private key and is slower.
Why is a hash not a form of encryption?
A hash is a one way function, so you cannot get the data back from it. It is used to check integrity.
How does a digital signature work?
The sender hashes the message and encrypts the hash with the private key. Anyone can check it with the public key.
Topic 1 of 4 in Cryptography
Test yourself on Cryptography
The full MikroTik MTCSE question bank has 446 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.