CompTIA Security+ SY0-701 · Free study guide

A practical cryptography decision guide

Cryptographic questions become manageable when you separate five jobs: confidentiality, integrity, origin authentication, password verification, and key protection. Choosing a familiar algorithm without identifying the job is a common mistake.

Protecting data confidentiality

Use symmetric encryption for efficient bulk protection. The same secret encrypts and decrypts, so distribution and storage of that secret become critical. Asymmetric cryptography uses a public/private pair and is useful for key establishment and identity operations. Real protocols often combine both.

Select the protection level from the threat. Full-disk encryption helps when a powered-off laptop is stolen. Database or field encryption can narrow access inside an environment. TLS protects data in transit when the client validates the server’s certificate and uses a safe protocol configuration. Encryption does not stop an authorized but compromised process from reading plaintext in use.

Integrity and signatures

A cryptographic hash maps data to a digest. Comparing a trusted digest can detect change, but anyone can hash altered content. A digital signature uses a private key over a digest and can provide integrity, origin authentication, and non-repudiation when identity proofing and key custody are sound.

Code signing should verify both signature and trust. A valid signature from an untrusted or compromised publisher does not make code safe. Timestamping and revocation handling can affect how historical signatures are evaluated.

Passwords

Passwords should be verified, not decrypted. Use a password-specific hashing or derivation function with a unique salt and suitable work factor. A salt prevents identical passwords from sharing a verifier and frustrates precomputed lookup. Key stretching makes each guess costly. A global secret “pepper” can add a layer but requires protected operational management.

PKI decisions

Certificates bind public keys to identities through a trust chain. Validate subject name, issuer, validity, intended use, signature, and revocation. A certificate signing request contains a public key and identifying claims; the private key should not be sent to the certificate authority.

CRLs distribute lists of revoked certificates, while OCSP enables status queries. Availability and privacy tradeoffs matter. Short-lived certificates reduce the revocation window but demand reliable automation.

Wildcard certificates simplify many subdomains but expand the impact of key compromise. Self-signed certificates can encrypt traffic when their trust is distributed safely; they do not inherit public trust automatically.

Protect the keys

A TPM provides device-bound key and measurement capabilities. An HSM performs high-assurance key operations and centralizes protection. Secure enclaves isolate sensitive computation. Key-management systems coordinate generation, access, rotation, backup, expiry, revocation, and audit. Escrow supports authorized recovery but creates another sensitive path.

Tokenization substitutes a reference for a sensitive value. Masking changes presentation. Obfuscation raises the difficulty of interpretation. Steganography conceals the presence of information. These techniques can reduce exposure but should not be mislabeled as strong encryption.

For any design, document algorithm and key parameters, owners, allowed uses, storage, rotation, recovery, expiry, and incident response. The hardest cryptographic failures are often lifecycle failures rather than broken mathematics.