I85PREP
⌘ K
NISP Level 1 - Security Operations study materials
NISP Level 1 - Security Operations study resources

NISP Level 1 - Security Operations: Cryptography and Key Management

NISP Level 1 - Security Operations · Work through your exam, one topic at a time.

All guide sections

Cryptography and Key Management

This domain tests which primitive solves which problem and how keys are handled across their life. Calculation questions are rare; selection and reasoning questions are common.

Primitives and their jobs

  • Symmetric encryption - AES (128/192/256), SM4, ChaCha20. Fast, used for bulk data, requires a shared key.
  • Asymmetric encryption - RSA, ECC, SM2. Slow, used for key exchange and signatures, solves key distribution.
  • Hash - SHA-256/SHA-3, SM3. One-way, fixed length, used for integrity; collisions matter.
  • MAC/HMAC - integrity and authenticity using a shared key.
  • Digital signature - hash then encrypt with the sender's private key; gives integrity, authenticity and non-repudiation because only the signer holds that private key.

Modes and common misuse

Never use ECB on multi-block data: identical plaintext blocks produce identical ciphertext. Prefer authenticated modes such as GCM or CCM, or encrypt-then-MAC; encryption without integrity allows bit-flipping. Store passwords with a salted, slow KDF (bcrypt, scrypt, Argon2, PBKDF2 with high iterations), never with a fast hash or reversible encryption. Salt defeats rainbow tables; a pepper adds a secret kept outside the database.

Key management

Keys pass through generation, distribution, storage, use, rotation, archival, recovery and destruction. Use a KMS or HSM for root keys, apply split knowledge and dual control to the most sensitive material, and keep keys out of code and configuration files. Under PKI, certificates move through enrolment, issuance by a CA, chain validation, revocation via CRL or OCSP, and renewal before expiry.

Worked example

Two banks exchange a large file and must prove origin. Generate a random AES-256 key, encrypt the file with AES-GCM, wrap the AES key with the recipient's RSA public key, then sign the hash of the ciphertext with the sender's RSA private key. The recipient unwraps the key, verifies the signature, then decrypts. Confidentiality, integrity, authenticity and non-repudiation each map to a named mechanism.

Traps

  • Saying a hash encrypts data; hashing is one-way and irreversible.
  • Signing with the recipient's public key, or encrypting with your own private key and calling it confidential.
  • Reusing an IV or nonce with GCM, which destroys both confidentiality and integrity.