CompTIA Security+ SY0-701 · Free study guide

Objective 1.4 — Select cryptographic protections for a scenario

Cryptography works only when the chosen mechanism matches the required property and keys are protected throughout their lifecycle. Encryption provides confidentiality. Hashing produces a fixed-length digest useful for integrity checks. A digital signature combines a digest with a private-key operation to support integrity, origin authentication, and non-repudiation. None of these mechanisms automatically supplies availability or good access control.

Choose the primitive by the job

Symmetric encryption uses a shared secret and is efficient for bulk data. Asymmetric cryptography uses a public/private pair and supports key exchange and signatures, but is slower. Modern protocols commonly authenticate peers and establish session keys asymmetrically, then protect application traffic symmetrically.

Passwords should not be stored with reversible encryption. Store a password verifier using a unique salt and a deliberately expensive password-hashing or key-stretching function. Salts frustrate precomputed tables; work factors increase the cost of each guess. Plain fast hashes remain unsuitable for password storage.

Encryption can operate at different levels: full disk, partition, volume, file, database, field, or record. Full-disk encryption helps when a powered-off device is stolen but may not protect data from malware running under an authorized session. Partition or volume encryption narrows the protected storage boundary, while field or record encryption narrows data exposure but adds key and application complexity. Transport or communication encryption, such as correctly validated TLS, protects a connection rather than the stored copies at either endpoint.

Build and validate trust

Public key infrastructure binds keys to identities through certificates. A certificate signing request contains identity information and a public key; the private key should remain controlled by the requester. Clients build a trust path to a root and verify name, validity, intended use, and revocation information through a certificate revocation list or OCSP.

Self-signed certificates can encrypt traffic, but clients need a separate trusted distribution method. Wildcard certificates simplify coverage for subdomains while increasing the effect of one private-key compromise. Third-party certificates do not eliminate the need for inventory, renewal, and revocation handling.

Protect keys with tools suited to the risk. A TPM can bind device keys and measurements to a platform. An HSM centralizes high-assurance key operations. A secure enclave isolates sensitive computation. A key-management system governs generation, rotation, permissions, and audit. Escrow can support recovery, but it introduces another highly sensitive access path.

Tokenization replaces a sensitive value with a reference; masking changes presentation; obfuscation makes interpretation harder; steganography hides the existence of a message. These are not interchangeable with encryption.

Ledgers record claims; they do not hide data

A blockchain links ordered records with cryptographic hashes and a consensus process. An open public ledger permits public verification and usually broad participation or visibility. It can provide tamper-evident evidence that a hash or transaction was recorded under the ledger's operating assumptions, but it does not make the submitted content true, protect a compromised signing key, guarantee availability, or encrypt confidential payloads. Publish a digest or other non-sensitive commitment when public verification is required; keep sensitive source data protected separately. A private or permissioned ledger changes participation and governance but still needs identity, authorization, key, privacy, and recovery controls.

Decision rule: state the property first, select the mechanism second, and evaluate key custody, trust, rotation, revocation, and recovery before declaring the design secure.