I85PREP
⌘ K
NISP Level 2 study materials
NISP Level 2 study resources

NISP Level 2: Cryptography and Identity Authentication

NISP Level 2 · Work through your exam, one topic at a time.

All guide sections

Cryptography and Identity Authentication

Cryptography and Identity Authentication asks which primitive solves which problem, how keys are managed, and how identity is proven. Expect questions contrasting encryption, hashing and signing, plus PKI and multi-factor scenarios.

Choosing the primitive

  • Symmetric - AES, SM4; fast, used for bulk data; requires a shared key. ECB leaks patterns, so use CBC with a random IV or an AEAD mode such as GCM.
  • Asymmetric - RSA, ECC/SM2; solves key distribution and enables signatures; slow, so it wraps a symmetric session key.
  • Hash - SHA-256, SM3; one-way, no key, used for integrity and password storage (salted, slow: bcrypt/PBKDF2/Argon2). MD5 and SHA-1 are deprecated for security use.
  • MAC/HMAC - keyed integrity, proving the message came from someone holding the key.
  • Digital signature - hash the message, encrypt the digest with the sender's private key; anyone verifies with the sender's public certificate. This gives integrity, authenticity and non-repudiation.

PKI and transport

A CA signs certificates binding identity to a public key; clients validate the chain to a trusted root, check validity dates, hostname, and revocation via CRL or OCSP. TLS uses certificates for server authentication, then negotiates a session key; ECDHE provides forward secrecy so a later key compromise does not decrypt recorded traffic.

Identity and authentication

Factors are knowledge, possession and inherence; MFA combines different categories. TOTP one-time codes, FIDO2 hardware authenticators (phishing-resistant), Kerberos tickets from a KDC, and SSO federated via SAML or OIDC are all examinable. Biometrics are non-revocable and should be a local unlock, not a remote secret.

Worked example

Alice must send Bob a confidential message that Bob can attribute to her. She hashes the message, signs the digest with her private key, then encrypts message-plus-signature with Bob's public key. Bob decrypts with his private key and verifies with Alice's public key. Reversing the keys fails: signing with Bob's key proves nothing about Alice, and encrypting with Alice's public key would make the message readable by anyone.

Traps

  • Saying a hash "encrypts"; it is keyless and irreversible, though guessable inputs fall to rainbow tables without salt.
  • Mixing up which key does what in signing versus encryption.
  • Assuming TLS protects the application from its own logic flaws.
  • Ignoring key management: rotation, escrow, destruction and HSM storage decide real security.
  • Overlooking China's Cryptography Law: commercial cryptography (SM2/SM3/SM4) plus mandatory application security assessment for critical information infrastructure.