CoreQ Academy3.7 Explain the importance of advanced cryptographic concepts.
Architects must plan for quantum-resistant algorithms, protect keys at scale and pick constructions that give confidentiality and integrity together without crippling performance.
Post-quantum cryptography (PQC)
- Post-quantum cryptography (PQC)
- Algorithms designed to resist attacks by quantum computers, such as NIST's ML-KEM (Kyber) and ML-DSA (Dilithium) standards.
- Post-quantum vs. Diffie-Hellman and elliptic curve cryptography (ECC)
- A large quantum computer running Shor's algorithm would break RSA, Diffie-Hellman and ECC; PQC algorithms rely on different hard problems.
- Resistance to quantum computing decryption attack
- Protects against "harvest now, decrypt later" collection of today's encrypted traffic.
- Emerging implementations
- Hybrid key exchanges (classical plus PQC) already deployed in TLS and messaging; plan crypto-agility and inventory now.
Key techniques
- Key stretching
- Slowing password hashing with many iterations (PBKDF2, bcrypt, Argon2).
- Key splitting
- Dividing a key into shares so several parties are needed to use it (e.g. Shamir secret sharing).
- Homomorphic encryption
- Computing on encrypted data without decrypting it.
- Forward secrecy
- Ephemeral session keys so a stolen long-term key cannot decrypt past sessions.
- Hardware acceleration
- CPU instructions (AES-NI) and accelerators that make strong crypto fast.
- Envelope encryption
- Data encrypted with a data key, which is itself encrypted by a master key in a KMS/HSM; enables efficient rotation.
- Performance vs. security
- Balancing algorithm strength, key size and latency for the use case.
- Secure multiparty computation
- Several parties compute a joint result without revealing their private inputs to each other.
- Authenticated encryption with associated data (AEAD)
- Modes like AES-GCM and ChaCha20-Poly1305 that provide confidentiality and integrity together, also authenticating unencrypted headers.
- Mutual authentication
- Both parties prove identity, e.g. mutual TLS with client certificates.
Check your understanding
Loading quiz…
Original CoreQ Academy material, mapped to objective 3.7 of the publicly available CompTIA SecurityX CAS-005 exam objectives (Exam objectives V5, document version 7.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.