Cryptographic solutions

Cryptography protects confidentiality, integrity, and authenticity, but only when the right tool is used the right way. This objective covers PKI and certificates, symmetric and asymmetric encryption, hashing and salting, digital signatures, key management hardware, and newer ideas such as blockchain.

Symmetric, asymmetric, and hashing

Real protocols combine them. TLS uses asymmetric cryptography to authenticate the server and agree on a session key, then switches to symmetric encryption for speed. Key length matters: longer keys resist brute force, and ECC reaches the same strength as RSA with much shorter keys, which is why it's popular on mobile devices.

Hashing turns any input into a fixed-length digest. A good hash is one-way and collision resistant. For passwords, a salt (random value stored with the hash) makes identical passwords produce different hashes and defeats rainbow tables; key stretching (PBKDF2, bcrypt, Argon2) runs the hash many times to slow brute force.

Where encryption is applied

Encryption can be applied at many levels: full-disk, partition, volume, file, database, record (individual fields), transport (TLS, IPsec), and in some products even in use. Full-disk encryption protects a lost laptop but does nothing once the user is logged in; record-level encryption protects a credit card column even from a database administrator.

PKI and certificates

A public key infrastructure binds public keys to identities. A certificate authority (CA) signs certificates; a root CA is usually kept offline while intermediate CAs issue day-to-day certificates. A certificate signing request (CSR) carries the requester's public key. Revocation is checked with a certificate revocation list (CRL) or the online certificate status protocol (OCSP); OCSP stapling lets the server attach a fresh OCSP response so clients don't have to ask.

• Wildcard certificate: covers every host one level below a domain, such as *.example.com.
• Subject alternative name (SAN): lists several names on one certificate.
• Self-signed certificate: no third party vouches for it; fine for labs, risky for public services.
• Key escrow: a trusted third party holds a copy of keys for recovery.

Key management hardware and other techniques

A trusted platform module (TPM) is a chip on the motherboard that stores keys and measures boot integrity; it's what lets full-disk encryption unlock only on an untampered device. A hardware security module (HSM) is a dedicated, tamper-resistant appliance or cloud service for generating and storing keys at scale, such as a CA's signing key. A secure enclave is an isolated area of a processor for sensitive operations. A key management system tracks keys through their life cycle: generation, distribution, rotation, and destruction.

Obfuscation hides meaning without strong cryptography: steganography hides data inside other data (for example, an image), tokenization replaces a sensitive value with a random token stored in a vault, and data masking shows only part of a value (****-1234). Blockchain is a distributed, append-only ledger where each block contains the hash of the previous one, so tampering is evident.

Key terms

Symmetric encryption

Encryption that uses the same secret key to encrypt and decrypt, which makes it fast for bulk data.

Asymmetric encryption

Encryption that uses a mathematically linked public and private key pair.

Hashing

A one-way function that turns any input into a fixed-length digest used to detect changes.

Salting

Adding a unique random value to each password before hashing so identical passwords produce different hashes.

Key stretching

Running a password through a slow hash many times to make brute-force guessing expensive.

Digital signature

A hash of a message encrypted with the sender's private key, proving origin and integrity.

Certificate authority (CA)

A trusted entity that verifies identities and signs digital certificates binding them to public keys.

Certificate signing request (CSR)

A message containing a public key and identity details sent to a CA to request a certificate.

Online Certificate Status Protocol (OCSP)

A real-time query a client uses to ask whether a specific certificate has been revoked.

Certificate revocation list (CRL)

A list, signed and published by a CA, of certificates it has revoked before their expiry.

Wildcard certificate

A certificate that covers every host name one level below a domain, such as *.example.com.

Trusted Platform Module (TPM)

A chip on a device's motherboard that stores keys securely and measures boot integrity.

Hardware security module (HSM)

A dedicated tamper-resistant device or service for generating, storing, and using cryptographic keys at scale.

Tokenization

Replacing a sensitive value with a random substitute and storing the real value in a secure vault.

Steganography

Hiding data inside another file or medium, such as an image or audio, so its existence isn't obvious.

Blockchain

A distributed, append-only ledger in which each block includes the hash of the previous block, making tampering evident.