Cryptography and Secure Communications
This domain tests whether you can evaluate cryptographic protections and secure communications without confusing encoding, hashing, and encryption. The exam focuses on misuse, key management, and protocol weaknesses.
Core rules and concepts
- Symmetric encryption uses one secret key for confidentiality; asymmetric encryption uses public/private keys and supports key exchange and signatures. Hashing provides integrity, not confidentiality; a MAC adds a shared secret; a digital signature adds non-repudiation.
- TLS protects data in transit when certificates are validated, ciphers are strong, and the client checks the hostname. Self-signed certificates are not automatically weak, but they require a trust decision.
- Common failures include weak random numbers, reused IVs/nonces, ECB mode, padding oracle bugs, expired or mismatched certificates, and SSL stripping without HSTS.
- Key management covers generation, storage, rotation, revocation, and separation of duties.
Worked example
An internal API uses AES-ECB and returns identical ciphertext blocks for repeated plaintext. You demonstrate the pattern with two controlled inputs, without decrypting user data. The reasoning: ECB preserves block patterns, so the proof is the repeated block, not a full break. You recommend AES-GCM with unique nonces and authenticated encryption, plus key rotation.
Traps
Base64 is encoding, not encryption. Hashing a password with MD5 or SHA-1 is not safe password storage. Do not call a self-signed certificate a vulnerability by itself; explain the trust and validation impact. Avoid cracking keys or capturing traffic outside scope.