Cryptography and Data Protection
Domain focus
Cryptography and Data Protection tests symmetric and asymmetric encryption, hashing, digital signatures, PKI, TLS, key management and protection of data at rest and in transit.
Core rules and concepts
- Symmetric encryption uses one shared key and is fast; AES is a standard example. Asymmetric encryption uses a public/private key pair; RSA and ECC are examples.
- Hashing is one-way and produces a fixed-length digest; it checks integrity but does not encrypt data.
- A digital signature signs a hash with the sender's private key; the receiver verifies with the public key, giving integrity, authentication and non-repudiation.
- TLS usually combines asymmetric methods for key exchange with symmetric encryption for bulk data.
- A salt is unique per password and need not be secret; it defeats precomputed rainbow tables. A MAC or AEAD mode provides integrity protection.
- Private keys must be protected; public keys may be distributed.
Worked example
A user downloads a software update and wants to verify it. The vendor signs the update hash with its private key. The user hashes the downloaded file, then verifies the signature with the vendor's public key. Reasoning: a matching hash alone could be replaced by an attacker; the signature ties the hash to the vendor's private key. Encryption is not required for this integrity check.
Traps that cost marks
Do not say hashing encrypts data. Do not share a private key to prove identity. Do not claim a digital signature provides confidentiality. Do not reuse salts or treat a salt as a secret key. Do not say HTTPS protects data after it reaches the server. Do not ignore key storage and rotation.