Security+ level · Domain 1.0 General Security Concepts · 12% of the mapped exam

1.4 Explain the importance of using appropriate cryptographic solutions.

36 topics · 8 quiz questions

Cryptography protects confidentiality, integrity and authenticity. Choosing the right tool (symmetric versus asymmetric, hash versus signature, which encryption level) and managing keys and certificates correctly matters more than the algorithm itself.

Public key infrastructure (PKI)

Public key: Shared openly. Used to encrypt data for the key owner or to verify their signatures.
Private key: Kept secret by the owner. Used to decrypt data sent to them and to create digital signatures. If it leaks, the identity is compromised.
Key escrow: A trusted third party holds copies of keys so data can be recovered if a key is lost, or accessed under legal authority.

Encryption levels

Full-disk: Encrypts an entire drive (for example BitLocker, FileVault, LUKS). Protects lost or stolen devices when powered off.
Partition: Encrypts a single partition on a drive.
File: Encrypts individual files (for example EFS). Protection follows the file within the system.
Volume: Encrypts a logical volume, which may span disks.
Database: Encrypts the whole database (for example transparent data encryption).
Record: Encrypts specific rows or fields, such as a column of national ID numbers, so even database admins cannot read them.
Transport/communication: Encrypts data in transit, for example TLS for web traffic, IPsec for VPNs, SSH for remote admin.

Encryption concepts

Asymmetric: Uses a key pair (public and private). Slower; used for key exchange, digital signatures and identity. Examples: RSA, ECC.
Symmetric: One shared secret key encrypts and decrypts. Fast; used for bulk data. Example: AES. The challenge is sharing the key securely.
Key exchange: Securely agreeing on a shared symmetric key over an untrusted network, for example Diffie-Hellman (ECDHE in TLS).
Algorithms: The mathematical method. Prefer current, vetted algorithms (AES, RSA 2048+, ECC, SHA-256+); avoid deprecated ones (DES, 3DES, RC4, MD5, SHA-1).
Key length: Longer keys mean more possible keys and more resistance to brute force. AES-256 is stronger than AES-128; RSA needs far longer keys than ECC for similar strength.

Tools

Trusted Platform Module (TPM): A chip on the motherboard that stores keys, measures boot integrity and supports full-disk encryption.
Hardware security module (HSM): A dedicated, tamper-resistant device or service for generating, storing and using keys at scale, for example for a CA or payment system.
Key management system: Centralised service that handles key creation, rotation, storage, access policy and destruction (for example cloud KMS).
Secure enclave: An isolated area of a processor that protects sensitive operations and keys even if the main OS is compromised.

Obfuscation

Steganography: Hiding data inside other data, such as a message inside an image. Hides that data exists; not encryption.
Tokenization: Replacing sensitive data with a random token and storing the real value in a secure vault. Common for card numbers.
Data masking: Hiding part of data for display or testing, for example showing only the last four card digits.

Integrity and authenticity

Hashing: One-way function producing a fixed-length digest. Any change to input changes the hash. Used for integrity checks and password storage.
Salting: Adding a unique random value to each password before hashing so identical passwords hash differently and precomputed rainbow tables fail.
Digital signatures: Hash the message, then encrypt the hash with the sender private key. Anyone with the public key can verify integrity, authenticity and non-repudiation.
Key stretching: Running a password through many hashing rounds (PBKDF2, bcrypt, Argon2) to make brute force slow.

Blockchain

Blockchain: A distributed ledger where each block contains the hash of the previous one, so tampering with history is detectable.
Open public ledger: A ledger anyone can read and verify; many participants hold copies, so no single party can rewrite it.

Certificates

Certificate authorities: Trusted organisations that verify identity and sign certificates. Browsers and OSes ship with trusted root CAs.
Certificate revocation lists (CRLs): Lists published by a CA of certificates revoked before expiry (for example after key compromise).
Online Certificate Status Protocol (OCSP): Real-time check of a single certificate status. OCSP stapling lets the server attach a fresh signed status to speed things up.
Self-signed: A certificate signed by its own key, not by a trusted CA. Fine for internal testing; browsers will warn.
Third-party: A certificate signed by an external trusted CA, so clients trust it automatically.
Root of trust: The starting point that everything else is verified against, for example a root CA certificate or a TPM.
Certificate signing request (CSR) generation: Creating a key pair and a request containing the public key and identity details, which the CA signs to issue a certificate. The private key never leaves you.
Wildcard: A certificate valid for all first-level subdomains, such as *.example.com. Convenient, but one compromised key affects every subdomain.

Study tip

Remember who uses which key: encrypt with the recipient public key; sign with your own private key.

Scenario

A developer stores passwords using SHA-256 without a salt. Two users have the same password and identical hashes appear in the table. What should change?

Show answer

Use a unique salt per password and a slow key-stretching algorithm such as bcrypt, scrypt or Argon2 (or PBKDF2 with a high iteration count).

Check your understanding

< 1.3 previous 2.1 next >

Original CoreQ Academy material, mapped to objective 1.4 of the publicly available CompTIA Security+ SY0-701 exam objectives (Exam objectives V7, document version 7.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.