Security+ 1.4 — Explain the importance of using appropriate cryptographic solutions.

Status: done

Exam objective

Explain the importance of using appropriate cryptographic solutions.

Official CompTIA scope (SY0-701 v5.0)

Open PDF on page 5

My notes

What is Cryptography?

Definition: Practice and study of writing and solving codes to hide information’s true meaning

Why Critical for Security:

Two Main Operations:

Encryption Fundamentals

Data States (Where to Encrypt)

1. Data at Rest

Definition: Inactive data stored on physical or electronic media

Examples:

Encryption Solutions:

Why Important: Protects against physical theft, unauthorized access

2. Data in Transit

Definition: Data actively moving across networks or between systems

Examples:

Encryption Solutions:

Why Important: Prevents eavesdropping, man-in-the-middle attacks

3. Data in Use

Definition: Data currently being processed or actively accessed

Examples:

Encryption Solutions:

Why Important: Protects against memory dumps, process inspection

Exam Tip: Know ALL THREE states — exam commonly asks “which state?”

Algorithm vs Key

Algorithm (Cipher)

Kerckhoffs’s Principle: Security should rely on the KEY, not the secrecy of the algorithm

Key

Analogy:

Key Strength and Security

Key Length

Common Key Sizes:

Brute Force Reality:

Key Rotation

Benefits:

Symmetric vs Asymmetric Encryption

Symmetric Encryption

Definition: Uses SAME key for both encryption and decryption

Also Called: Private key encryption, secret key encryption

How It Works:

Alice encrypts with Key-X → Sends ciphertext → Bob decrypts with Key-X

Characteristics:

Security Provided:

Common Algorithms:

Best Use Cases:

Exam Keyword: “Symmetric = Same key = Shared secret = Fast”

Asymmetric Encryption

Definition: Uses TWO mathematically related keys (key pair)

Also Called: Public key cryptography

The Key Pair:

How It Works:

Confidentiality:
  Alice encrypts with Bob's PUBLIC key → Bob decrypts with his PRIVATE key

Non-Repudiation/Authentication:
  Alice encrypts with her PRIVATE key → Anyone decrypts with Alice's PUBLIC key

Characteristics:

Security Provided:

Common Algorithms:

Best Use Cases:

Exam Keyword: “Asymmetric = Two keys = Public + Private = Slow but versatile”

Hybrid Approach (Best of Both Worlds)

How It Works:

  1. Use asymmetric to exchange a symmetric session key
  2. Use symmetric for actual data encryption

Example — HTTPS/TLS:

1. Browser and server perform asymmetric key exchange (RSA/ECDHE)
2. They agree on a symmetric session key (AES)
3. All data transferred using fast symmetric encryption (AES)

Benefits:

Real-World Use: Nearly ALL secure communications (HTTPS, VPN, SSH)

Symmetric Encryption Algorithms

Block Ciphers vs Stream Ciphers

Block Cipher
Stream Cipher

Major Symmetric Algorithms

DES (Data Encryption Standard) — DEPRECATED

Exam Note: Know it’s DEPRECATED due to short key length

3DES (Triple DES) — BEING PHASED OUT

Why Triple?: DES → Decrypt → DES (Encrypt-Decrypt-Encrypt)

AES (Advanced Encryption Standard) — CURRENT STANDARD

Rounds by Key Size:

AES-256 = Gold Standard for sensitive data

Exam Tip: AES is the go-to answer for modern symmetric encryption!

Blowfish
Twofish
RC4 — DEPRECATED

Exam Note: RC4 is BROKEN — don’t use it!

Asymmetric Encryption Algorithms

Diffie-Hellman (DH)

Variants:

Exam Tip: Diffie-Hellman = Key Exchange, NOT encryption!

RSA (Rivest-Shamir-Adleman)

Common Uses:

Best Practice: Minimum 2048-bit keys (NIST recommendation)

Exam Scenario: “Encrypt small data with non-repudiation” → RSA

ECC (Elliptic Curve Cryptography)

ECC Variants:

Modern Trend: ECC replacing RSA for new implementations

Exam Tip: ECC = Smaller keys, same security, better for mobile/IoT

Hashing

What is Hashing?

Definition: One-way cryptographic function producing unique fixed-size digest

Key Properties:

  1. One-way: Can’t reverse (hash → original data)
  2. Deterministic: Same input = same hash
  3. Fixed size: Any input → fixed output size
  4. Unique: Different inputs → different hashes (ideally)
  5. Avalanche effect: Tiny change → completely different hash

NOT Encryption: Can’t decrypt a hash!

Purpose:

Hashing Algorithms

MD5 (Message Digest 5) — BROKEN

Exam Note: MD5 is BROKEN for security purposes!

SHA Family (Secure Hash Algorithm)

SHA-1 — DEPRECATED

SHA-2 — CURRENT STANDARD

SHA-3

Exam Tip:

HMAC (Hash-based Message Authentication Code)

Use Cases:

Difference from plain hash: Requires secret key (authenticated)

Increasing Hash Security

Salting

Example:

User1: password123 + salt_abc123 → Hash_X
User2: password123 + salt_xyz789 → Hash_Y

Critical: Store salt WITH hash (not secret, just unique)

Key Stretching

Algorithms:

Example: Hash password 10,000 times instead of once

Nonce (Number Used Once)

Example — Authentication:

  1. Server sends nonce
  2. Client: Hash(password + nonce)
  3. Server verifies
  4. Nonce expires (can’t replay)

Hash Attacks

Collision Attack

Birthday Paradox: Collisions more likely than expected

Pass-the-Hash Attack

Public Key Infrastructure (PKI)

What is PKI?

Definition: Comprehensive framework for managing digital keys and certificates

Purpose: Enable secure data transfer, authentication, encrypted communications

Components:

Real-World Use: HTTPS websites, email encryption, code signing

PKI Components

Certificate Authority (CA)

Types:

Commercial Examples: DigiCert, Let’s Encrypt, GlobalSign

Registration Authority (RA)

Think: RA = Front desk, CA = Manager who makes final decision

Certificate Signing Request (CSR)

Process:

  1. Generate key pair
  2. Create CSR with public key
  3. Submit CSR to CA
  4. CA validates and issues certificate
Digital Certificate

Purpose: Proves “this public key belongs to this person/server”

Certificate Types

Wildcard Certificate
SAN (Subject Alternative Name)
Single-Sided vs Dual-Sided

Single-Sided (Most common):

Dual-Sided (Mutual TLS):

Self-Signed Certificate

Problem: Browsers don’t trust (no CA validation)

Third-Party Certificate

Certificate Revocation

Certificate Revocation List (CRL)

When Revoked:

OCSP (Online Certificate Status Protocol)
OCSP Stapling

Modern Standard: OCSP Stapling preferred

Advanced PKI Concepts

Public Key Pinning
Key Escrow
Certificate Transparency (CT)

Encryption Tools

Trusted Platform Module (TPM)

What: Dedicated crypto chip on motherboard

Purpose: Hardware-level security for cryptographic operations

Functions:

Common Uses:

Versions:

Advantage: Keys never exposed to software (hardware-protected)

Exam Scenario: “Hardware-based encryption for laptops” → TPM + BitLocker

Hardware Security Module (HSM)

What: Physical device for safeguarding cryptographic keys

Purpose: Enterprise-grade key management and crypto operations

Functions:

Use Cases:

Characteristics:

TPM vs HSM:

Exam Tip: HSM = Enterprise crypto, mission-critical operations

Key Management System (KMS)

What: Centralized system for managing cryptographic keys

Lifecycle Management:

  1. Generation: Create keys
  2. Distribution: Securely share keys
  3. Storage: Secure key repository
  4. Rotation: Regular key changes
  5. Backup: Key recovery
  6. Destruction: Secure key disposal

Functions:

Examples:

Why Important: Manual key management doesn’t scale

Exam Tip: KMS manages entire key lifecycle

Secure Enclave

What: Isolated coprocessor within main CPU

Purpose: Secure data processing separate from main OS

How It Works:

Uses:

Devices:

Protection: Even compromised OS can’t access enclave

Exam Tip: Secure enclave = Hardware isolation for sensitive data

Obfuscation Techniques

Steganography

Definition: Hiding data within other data to conceal its existence

How It Works: Modify image, audio, or video to embed hidden message

Techniques:

Examples:

Goal: No one suspects hidden data exists

vs Encryption:

Combined: Encrypt THEN hide (defense in depth)

Detection: Steganalysis (looking for statistical anomalies)

Exam Scenario: “Hide the existence of communication” → Steganography

Tokenization

Definition: Replace sensitive data with non-sensitive substitute (token)

How It Works:

  1. Original data stored securely in vault
  2. Token generated (random value)
  3. Token used in systems
  4. Token has NO mathematical relationship to original

Example — Credit Cards:

Real Card: 4532-1234-5678-9010
Token:     8721-4893-2847-1234

Purpose: Reduce exposure of sensitive data

Use Cases:

Benefits:

vs Encryption:

Exam Tip: Tokenization = Payment data, no decrypt (lookup required)

Data Masking

Definition: Hiding original data by modifying it while maintaining usability

Techniques:

Static Masking
Dynamic Masking

Methods:

Examples:

Original SSN: 123-45-6789
Masked:       XXX-XX-6789

Original Email: john.doe@company.com
Masked:        j***d**@company.com

Use Cases:

Benefits:

Exam Tip: Data masking = Non-production environments, preserves format

Cryptographic Attacks

Downgrade Attack

What: Force system to use older, weaker crypto protocols

How:

  1. Attacker intercepts negotiation
  2. Modifies to request weak protocol
  3. Systems agree to weaker crypto
  4. Attacker exploits known vulnerabilities

Example: POODLE attack (force SSL 3.0 instead of TLS)

Defense:

Exam Tip: Downgrade = Forcing weaker crypto to exploit vulnerabilities

Collision Attack

What: Finding two different inputs producing same hash

Impact: Breaks integrity verification

Why Possible: Hash output smaller than input space (pigeonhole principle)

Birthday Paradox: Collisions occur sooner than expected

Famous Cases:

Defense:

Exam Scenario: “Hash collision vulnerability” → Use SHA-256 instead of MD5

Quantum Computing Threat

The Problem: Quantum computers can break current crypto

How Quantum Works:

What’s Vulnerable:

What’s Safe:

Why Asymmetric Is Vulnerable:

Post-Quantum Cryptography

Definition: Algorithms resistant to quantum attacks

Approaches:

1. Increase Key Sizes
2. New Algorithm Types

NIST Standards (2024):

General Encryption:

Digital Signatures:

Exam Tip: Post-quantum = Algorithms resistant to quantum computer attacks

Memory Aids and Mnemonics

Data States: “RAT”

Symmetric vs Asymmetric: “SAFE”

Good Hashes: “SHA-2/3”

PKI Components: “CRACK”

Obfuscation Types: “STM”

Encryption Tools: “THE KEYS”

Common Exam Traps

Trap 1: Confusing Encryption and Hashing

Trap 2: “Symmetric is Always Better”

Trap 3: MD5/SHA-1 Are Still OK

Trap 4: Diffie-Hellman Encrypts Data

Trap 5: TPM = HSM

Exam tips

  1. Know the three data states: At rest, in transit, in use
  2. Symmetric = Fast, same key: AES is the standard
  3. Asymmetric = Slow, key pairs: RSA/ECC for key exchange and signatures
  4. Hashing = One-way, integrity: SHA-256 is standard, MD5/SHA-1 broken
  5. Hybrid approach = Real-world (asymmetric key exchange + symmetric data encryption)
  6. PKI manages certificates: CA issues, RA verifies, CRL/OCSP for revocation
  7. TPM = Consumer hardware crypto: BitLocker, secure boot
  8. HSM = Enterprise hardware crypto: High-security, mission-critical
  9. Salting prevents rainbow tables: Add random data before hashing
  10. Quantum threat = Post-quantum crypto needed: NIST standards emerging

Pro Tip: When you see “appropriate cryptographic solution,” think:

Key terms

Examples / scenarios

Scenario 1: A company needs to encrypt a 500GB database.

Scenario 2: A developer wants to verify that a downloaded software file hasn’t been tampered with. The vendor provides an MD5 hash.

Scenario 3: A web application stores credit card numbers. Compliance requires protecting this data.

Mini quiz

Question 1: Which of the following BEST describes the difference between encryption and hashing? **Answer: Encryption is reversible; hashing is one-way** - **Encryption**: Plaintext → Ciphertext → Plaintext (reversible with key) - **Hashing**: Data → Hash (NOT reversible, one-way function) Purpose difference: - Encryption: Confidentiality (hide data) - Hashing: Integrity (verify unchanged)
Question 2: A company wants to securely exchange encryption keys over the internet without a pre-shared secret. Which algorithm should they use? **Answer: Diffie-Hellman** Key exchange without pre-shared secret = Diffie-Hellman. DH specifically designed for this purpose. Allows two parties to agree on shared key over insecure channel. NOT AES/3DES (symmetric — need shared key first), NOT SHA-256 (hashing — not for key exchange).
Question 3: Which symmetric encryption algorithm provides the STRONGEST security? **Answer: AES with 256-bit key** AES-256 = Current gold standard. No known practical attacks. DES is obsolete, 3DES is being deprecated, RC4 is broken.
Question 4: What additional security measure makes passwords more resistant to rainbow table attacks? **Answer: Add salt to passwords before hashing** Salting = Adding random data before hashing. Each password gets unique salt. Same password = different hashes (different salts). Rainbow tables useless (pre-computed for unsalted hashes).
Question 5: Which TWO cryptographic solutions are MOST appropriate for protecting data at rest on a company laptop? **Answer: TPM and BitLocker** Data at rest = Stored data (hard drive). BitLocker = Full disk encryption (Windows). TPM = Hardware chip storing encryption keys. Together: BitLocker encrypts drive, TPM secures keys. NOT TLS, IPSec, or SSH (all for data in transit).

CompTIA-style practice questions

Question 6: Which of the following BEST describes the difference between encryption and hashing?
A. Encryption is reversible; hashing is one-way
B. Hashing is reversible; encryption is one-way
C. Both are reversible with the correct key
D. Neither is reversible **Correct Answer: A. Encryption is reversible; hashing is one-way** - **Encryption**: Plaintext → Ciphertext → Plaintext (reversible with key) - **Hashing**: Data → Hash (NOT reversible, one-way function) This is a fundamental concept — know this cold for the exam!
Question 7: A company wants to securely exchange encryption keys over the internet without a pre-shared secret. Which algorithm should they use?
A. AES
B. 3DES
C. Diffie-Hellman
D. SHA-256 **Correct Answer: C. Diffie-Hellman** Key exchange without pre-shared secret = Diffie-Hellman. DH specifically designed for this purpose. **Why not others**: - A/B: Symmetric algorithms (need shared key first) - D: Hashing algorithm (not for key exchange)
Question 8: Which of the following provides the STRONGEST security for symmetric encryption?
A. DES with 56-bit key
B. 3DES with 168-bit key
C. AES with 256-bit key
D. RC4 with 128-bit key **Correct Answer: C. AES with 256-bit key** AES-256 = Current gold standard. Strongest option listed. No known practical attacks. **Why others are weaker**: - A: DES is obsolete (easily broken) - B: 3DES being deprecated - D: RC4 is broken (multiple vulnerabilities)
Question 9: A security administrator wants to verify that a password hasn't been compromised. The password database stores hashed passwords. What additional security measure would make passwords more resistant to rainbow table attacks?
A. Increase hash iterations
B. Add salt to passwords before hashing
C. Use longer passwords
D. Implement account lockout **Correct Answer: B. Add salt to passwords before hashing** **Salting** = Adding random data before hashing. Each password gets unique salt. Same password = different hashes. Rainbow tables useless. **Why others help but don't solve rainbow tables**: - A: Key stretching (helps, but salt is more direct answer) - C: Good practice, but doesn't stop rainbow tables - D: Prevents brute force, not rainbow tables
Question 10 (Multi-select): Which TWO cryptographic solutions would be MOST appropriate for protecting data at rest on a company laptop? (Choose TWO)
A. TLS
B. IPSec
C. TPM
D. BitLocker
E. SSH **Correct Answers: C. TPM and D. BitLocker** **Data at rest** = Stored data (hard drive). **BitLocker** = Full disk encryption (Windows). **TPM** = Hardware chip storing encryption keys. **Why not others** (all for data in transit): - A: TLS = HTTPS, secure web - B: IPSec = VPN tunnels - E: SSH = Secure remote access

Domain 1: General Security Concepts

Objective Title Status
1.1 Compare and contrast various types of security controls done
1.2 Summarize fundamental security concepts done
1.3 Explain the importance of change management processes done
1.4 Explain the importance of using appropriate cryptographic solutions (current) done
← Previous: Objective 1.3 Back to Dashboard Next: Domain 2 →