I85PREP
⌘ K
NSA Assessment study materials
NSA Assessment study resources

NSA Assessment: Cryptography and Encryption

NSA Assessment · Work through your exam, one topic at a time.

All guide sections

Cryptography and Encryption

What this domain tests

Cryptography and Encryption tests correct primitive selection and key lifecycle: symmetric encryption, asymmetric encryption, hashing, HMAC, digital signatures, PKI, TLS, and key management. Expect questions on modes, IV and nonce handling, forward secrecy, and why a hash is not encryption.

Core rules

  • Use AES-GCM or ChaCha20-Poly1305 for authenticated symmetric encryption; never use ECB for multi-block data; never reuse a nonce with the same key.
  • Use RSA-OAEP or ECDH for key transport or agreement; use RSA-PSS or ECDSA for signatures; do not encrypt bulk data with asymmetric crypto.
  • Hash with SHA-256 or stronger for integrity; use HMAC for message authentication with a shared key; use digital signatures for origin and integrity with public verification.
  • TLS 1.3 uses ephemeral ECDH for forward secrecy; certificates bind identities to public keys through a trusted CA. Protect keys with HSMs or KMS, rotation, and separation of duties.

Worked example

A service stores sensitive records and talks to clients over the internet. Choose AES-256-GCM for records at rest, with a unique nonce per record and keys in a KMS. For transport, require TLS 1.3 with ephemeral ECDH, ECDSA certificates, and SHA-256. Authenticate updates with HMAC-SHA-256 using a rotated shared secret, or signatures if non-repudiation is required. Reasoning: GCM provides confidentiality and integrity; ephemeral ECDH gives forward secrecy; HMAC is faster than signatures for symmetric trust but does not provide non-repudiation.

Traps

Using a hash as a password encryption scheme; reusing an IV or nonce; treating base64 as encryption; confusing signing with encryption; ignoring certificate validation; and assuming TLS protects data at rest.