Cryptography and Key Management
Separate the goals before choosing a tool. Symmetric encryption (AES) is fast and used for bulk data; asymmetric encryption (RSA, ECC) solves key distribution and enables signatures but is slow. Hashing (SHA-256/512, SHA-3) provides integrity only and is one-way; HMAC adds a shared secret for authenticity; a digital signature is a hash encrypted with the sender's private key, giving integrity, authenticity and non-repudiation.
Key usage rules that examiners test relentlessly:
- Encrypt for confidentiality to the recipient's public key; the recipient decrypts with their private key.
- Sign with the sender's private key; anyone verifies with the sender's public key.
- Never share private keys; a certificate binds an identity to a public key and is vouched for by a CA.
PKI vocabulary: registration authority, certificate policies, CRL and OCSP for revocation, root and intermediate CAs, pinning, certificate lifecycle (issue, renew, revoke, expire). Key management covers generation, distribution, storage, rotation, escrow, destruction, plus split knowledge and dual control so no single person holds a whole key.
Cipher modes matter: ECB is deterministic and leaks patterns - never use it for multi-block data; CBC needs a random IV and is unauthenticated; GCM provides authenticated encryption. TLS combines asymmetric key exchange with symmetric session keys and supports perfect forward secrecy with ephemeral Diffie-Hellman, so compromise of a long-term key does not expose past sessions.
Traps: hashing is not encryption and cannot be reversed; a MAC is not a signature because both parties share the key and non-repudiation is impossible; obfuscation such as Base64 is encoding, not protection; storing passwords requires salted, slow hashes (bcrypt, scrypt, Argon2), not AES or plain SHA-256.
Worked example: a signed-then-encrypted message - sign with sender's private key, encrypt with recipient's public key; the recipient decrypts with their private key and verifies with the sender's public key.