top of page

Cryptography

CISSP Guide to Encryption, Hashing, Digital Signatures, and PKI


Summary

Cryptography is one of the most heavily tested topics on the CISSP exam, spanning multiple domains, especially Security Architecture & Engineering and Identity & Access Management. Understanding confidentiality, integrity, authentication, nonrepudiation, encryption algorithms, hashing, digital signatures, certificates, PKI, and key management is essential for both the exam and real-world cybersecurity.

This guide explains the concepts in a simple, exam-focused manner while highlighting common mistakes, memory techniques, and real-world applications.


Cryptography Explained

Cryptography protects information by converting readable data (plaintext) into an unreadable form (ciphertext). Only authorized parties possessing the correct cryptographic key can recover the original information.

Modern organizations rely on cryptography to secure:

  • Internet communications

  • Cloud services

  • Banking transactions

  • VPN connections

  • Wireless networks

  • Password storage

  • Digital signatures

  • Software updates

  • Email security

Without strong cryptography, confidentiality, integrity, authentication, and nonrepudiation cannot be achieved.


Why Cryptography Matters

Cryptography enables organizations to:

  • Protect confidential information

  • Verify data integrity

  • Authenticate users and systems

  • Support digital signatures

  • Secure online transactions

  • Protect cloud environments

  • Meet compliance requirements

  • Prevent tampering

  • Build trust across insecure networks

Nearly every cybersecurity framework—including NIST, ISO 27001, PCI DSS, HIPAA, and GDPR—requires cryptographic controls.


The Four Security Services

Confidentiality

Ensures information is only accessible to authorized users.

Examples:

  • AES encryption

  • TLS

  • VPN encryption

  • BitLocker

  • Database encryption

Integrity

Ensures data has not been modified.

Common mechanisms:

  • Hashing

  • HMAC

  • Digital signatures

Authentication

Verifies identity.

Examples:

  • Digital certificates

  • Challenge-response protocols

  • PKI

Nonrepudiation

Prevents a sender from denying an action.

Achieved using:

  • Digital signatures

  • PKI

  • Certificates


Plaintext vs Ciphertext

Plaintext

GoCyberNinja

Ciphertext

3A9F7D82C...

Only someone with the appropriate cryptographic key can decrypt the ciphertext.


Symmetric Encryption

Symmetric encryption uses one shared secret key for both encryption and decryption.

Same Key

Encrypt
↓

Ciphertext

↓

Decrypt

Advantages

  • Extremely fast

  • Ideal for large files

  • Efficient

  • Low CPU usage


Disadvantages

  • Difficult key distribution

  • Poor scalability

  • Shared secret risk


Common Symmetric Algorithms

AES (Advanced Encryption Standard)

The CISSP favorite.

Supports:

  • 128-bit

  • 192-bit

  • 256-bit keys

Uses:

  • VPNs

  • TLS

  • WPA3

  • Disk encryption

  • Cloud encryption


Remember: AES replaced DES.

DES

  • 56-bit key

  • Broken

  • Deprecated

Never recommended today.

3DES

Improved DES by applying DES three times.

Secure but:

  • Slow

  • Deprecated

  • Being phased out

Blowfish

Fast software encryption algorithm.

Largely replaced by AES.

Twofish

AES finalist.

Still secure but less common.


Asymmetric Encryption

Uses two mathematically related keys.

  • Public Key

  • Private Key

Anyone may know the public key.

Only the owner possesses the private key.

Advantages

  • Secure key exchange

  • Digital signatures

  • Authentication

  • Nonrepudiation

Disadvantages

  • Slow

  • Computationally expensive


Popular Algorithms

RSA

Most common public-key algorithm.

Uses:

  • Digital signatures

  • Certificates

  • TLS

  • Key exchange


ECC (Elliptic Curve Cryptography)

Provides equivalent security with much smaller keys.

Benefits:

  • Faster

  • Smaller certificates

  • Lower CPU usage

Widely used on:

  • Mobile devices

  • IoT

  • Modern PKI


Symmetric vs Asymmetric

Feature

Symmetric

Asymmetric

Keys

One

Two

Speed

Fast

Slow

Large Files

Excellent

Poor

Key Exchange

Difficult

Excellent

Digital Signatures

No

Yes

Authentication

Limited

Yes


CISSP Tip

Encrypt data with AES.

Exchange AES keys using RSA or ECC.


Hashing

Hashing converts data into a fixed-length value.

Characteristics:

  • One-way

  • Cannot be reversed

  • Detects changes

  • Used for integrity


Popular Hash Algorithms

SHA-256

Industry standard.

Used in:

  • Blockchain

  • Certificates

  • Password protection

  • Integrity verification


SHA-512

Even stronger.

Common in enterprise systems.


MD5

Broken.

Collision attacks exist.

Do not use.


SHA-1

Deprecated.

Collision attacks demonstrated.

Avoid.


Digital Signatures

Digital signatures provide:

✓ Integrity

✓ Authentication

✓ Nonrepudiation

Process:

  1. Create hash

  2. Encrypt hash using sender's private key

  3. Receiver decrypts using sender's public key

  4. Compare hashes

If hashes match:

Document is authentic.


Digital Certificates

Certificates bind:

Identity

↓

Public Key

Issued by:

Certificate Authority (CA)

Contains:

  • Owner

  • Public key

  • Validity dates

  • Signature

  • Issuer


Public Key Infrastructure (PKI)

PKI manages:

  • Certificates

  • Certificate Authorities

  • Registration Authorities

  • Revocation

  • Trust

Components include:

  • CA

  • RA

  • CRL

  • OCSP

  • Certificates


Key Management

Cryptography is only as strong as its key management.

Lifecycle:

Generate

↓

Store

↓

Distribute

↓

Rotate

↓

Archive

↓

Destroy

Poor key management compromises even the strongest algorithms.


Perfect Forward Secrecy

Generates temporary session keys.

Benefits:

Even if a long-term key is stolen:

Previous sessions remain secure.

Modern TLS uses Perfect Forward Secrecy extensively.


Common Cryptographic Attacks

Brute Force

Attempts every possible key.

Defense:

Long keys.


Dictionary Attack

Uses common passwords.

Defense:

Strong passwords and MFA.


Rainbow Table Attack

Targets password hashes.

Defense:

Salt passwords.


Birthday Attack

Targets hash collisions.

Defense:

Use SHA-256 or stronger.


Man-in-the-Middle (MITM)

Intercepts communications.

Defense:

TLS

Certificates

Mutual authentication


CISSP Exam Tips

Remember these high-value concepts:

  • AES = symmetric encryption

  • RSA = asymmetric encryption

  • ECC = smaller keys

  • Hashing = integrity

  • Digital Signature = integrity + authentication + nonrepudiation

  • PKI manages certificates

  • Certificates contain public keys

  • Private keys sign

  • Public keys verify


Common CISSP Mistakes

❌ Thinking hashing encrypts data

Hashing cannot be reversed.

❌ Believing RSA encrypts large files

RSA is used for key exchange and signatures.

AES encrypts data.

❌ Confusing authentication with confidentiality

Encryption provides confidentiality.

Certificates provide authentication.

❌ Assuming MD5 is secure

It is obsolete.

❌ Assuming SHA-1 is acceptable

Use SHA-256 or stronger.


Memory Tricks

CIA

Confidentiality

Integrity

Availability


HASH

Integrity


RSA

Public/Private Keys


AES

Fast

Shared Key


Digital Signature

Private signs

Public verifies


Real-World Examples

HTTPS

Uses:

RSA/ECC

↓

Exchange AES session key

↓

AES encrypts communication


VPN

AES encrypts traffic.

Certificates authenticate endpoints.


Password Storage

Passwords should never be encrypted.

Instead:

Hash


Salt


Software Updates

Vendor signs software.

Operating system verifies signature before installation.


CISSP Practice Questions

Question 1

Which algorithm is the current encryption standard for protecting sensitive data?

A. DES

B. AES

C. MD5

D. SHA-1

✅ Answer: B


Question 2

Which security service does hashing primarily provide?

A. Confidentiality

B. Integrity

C. Availability

D. Authorization

✅ Answer: B


Question 3

Which key is used to create a digital signature?

A. Recipient Public Key

B. Sender Public Key

C. Sender Private Key

D. Session Key

✅ Answer: C


Question 4

Which PKI component issues digital certificates?

A. Registration Authority

B. Certificate Authority

C. HSM

D. Key Escrow

✅ Answer: B


Question 5

Which algorithm provides public-key cryptography?

A. AES

B. DES

C. RSA

D. SHA-256

✅ Answer: C


Key Takeaways

  • Cryptography protects confidentiality, integrity, authentication, and nonrepudiation.

  • AES is the modern standard for symmetric encryption.

  • RSA and ECC provide public-key cryptography for secure key exchange and digital signatures.

  • Hashing verifies integrity and should not be confused with encryption.

  • Digital signatures provide integrity, authentication, and nonrepudiation.

  • PKI manages certificates and trust relationships.

  • Effective key management is essential to maintaining cryptographic security.

  • Understanding when to use encryption, hashing, digital signatures, and PKI is critical for success on the CISSP exam and in real-world cybersecurity.


Related Articles

  • CIA Triad

  • Defense in Depth

  • Least Privilege

  • Security Architecture and Engineering

  • Identity and Access Management

  • Zero Trust Security

  • Multi-Factor Authentication (MFA)

  • Public Key Infrastructure (PKI)

  • Data Classification

  • Security Policies

  • Security Governance

  • Risk Management

  • Cryptographic Key Management

  • Digital Certificates

  • Secure Communications

  • Cloud Security Encryption

  • TLS and HTTPS

  • VPN Security

  • Hashing Algorithms

  • Password Security and Authentication

bottom of page