CoreQ Academy3.8 Given a scenario, apply the appropriate cryptographic use case and/or technique.
Choose the cryptographic tool that fits the goal: confidentiality, integrity, authenticity, non-repudiation or privacy, within legal and resource limits.
Use cases
- Data at rest
- Disk, database and object encryption with managed keys.
- Data in transit
- TLS, IPsec, SSH.
- Encrypted tunnels
- VPNs and TLS tunnels protecting traffic across untrusted networks.
- Data in use/processing
- Confidential computing, enclaves or homomorphic techniques.
- Secure email
- S/MIME or PGP for signed and encrypted messages.
- Immutable databases/blockchain
- Hash-chained records that make tampering evident.
- Non-repudiation
- Digital signatures proving who signed.
- Privacy applications
- Anonymisation, pseudonymisation and privacy-preserving computation.
- Legal/regulatory considerations
- Export controls, approved algorithms (e.g. FIPS) and lawful access rules.
- Resource considerations
- Lightweight algorithms for constrained devices.
- Data sanitization
- Cryptographic erase and secure deletion.
- Data anonymization
- Irreversibly removing identifiers.
- Certificate-based authentication
- Users or devices authenticate with certificates and private keys.
- Passwordless authentication
- Passkeys/FIDO2 using public-key cryptography instead of passwords.
- Software provenance
- Signed attestations of where and how software was built.
- Software/code integrity
- Signatures and hashes proving code was not modified.
- Centralized vs. decentralized key management
- One KMS for consistency and audit versus distributed key control for resilience and autonomy.
Techniques
- Tokenization
- Replacing sensitive values with tokens mapped in a vault.
- Code signing
- Signing software so recipients can verify publisher and integrity.
- Cryptographic erase/obfuscation
- Destroying keys so encrypted data becomes unreadable.
- Digital signatures
- Hash signed with a private key for integrity and authenticity.
- Obfuscation
- Making code or data hard to understand; not a substitute for encryption.
- Serialization
- Converting objects to a storable format; sign or validate serialized data to prevent tampering and deserialization attacks.
- Hashing
- Fixed-length fingerprints for integrity checks.
- One-time pad
- Theoretically unbreakable when the key is truly random, as long as the message and never reused; impractical at scale.
- Symmetric cryptography
- One shared key; fast bulk encryption (AES).
- Asymmetric cryptography
- Key pairs for key exchange and signatures (RSA, ECC).
- Lightweight cryptography
- Algorithms for constrained devices, e.g. NIST's Ascon.
Check your understanding
Loading quiz…
Original CoreQ Academy material, mapped to objective 3.8 of the publicly available CompTIA SecurityX CAS-005 exam objectives (Exam objectives V5, document version 7.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.