Cryptography and Data Protection
Domain 5 tests correct use of cryptography to protect data in transit, at rest, and in use. Expect symmetric and asymmetric encryption, hashing, MACs, digital signatures, PKI, key management, tokenization, masking, and forward secrecy.
Core rules
- Symmetric encryption such as AES is fast for bulk data. Asymmetric encryption and key exchange solve key distribution and enable signatures, but are slower.
- Hashing provides integrity checks, not confidentiality. A MAC authenticates with a shared key; a digital signature provides integrity, authenticity, and support for non-repudiation when keys are managed correctly.
- Use authenticated encryption modes such as AES-GCM. Avoid ECB for structured data because identical blocks reveal patterns.
- Key management is the hard part: generate keys securely, restrict access, rotate, revoke, and separate keys from ciphertext.
- Tokenization and masking reduce exposure by replacing sensitive values; they are not the same as encryption.
Worked example
A team must share a sensitive file between two systems. A sound design generates a random symmetric data key, encrypts the file with AES-GCM, encrypts the data key with the recipient public key, and signs a hash of the file with the sender private key. The reasoning is layered: the symmetric key protects bulk data efficiently, the asymmetric step solves key delivery, and the signature proves origin and integrity.
Traps
Do not say encryption equals hashing, or that obfuscation equals cryptography. Do not store keys beside ciphertext or reuse IVs with a stream mode. Do not use MD5 or SHA-1 for security decisions.