Cryptographic solutions

Cryptography is the bedrock of confidentiality, integrity, and non-repudiation in cybersecurity. CompTIA rigorously tests these concepts because implementing the wrong cryptographic solution or configuring it incorrectly creates a false sense of security while leaving data completely exposed.

Let’s break down this extensive objective piece by piece.

1. Cryptographic Principles & Techniques

Understanding how data is fundamentally scrambled, protected, and verified.

Symmetric vs. Asymmetric Encryption

• Symmetric Encryption: Uses a single, shared key to both encrypt and decrypt data. It is extremely fast and efficient for bulk data, but key distribution is difficult (how do you share the key securely without someone intercepting it?).
  • Algorithms: AES (Advanced Encryption Standard – the gold standard), 3DES (deprecated but on the exam), Blowfish/Twofish.
• Asymmetric Encryption: Uses a mathematically linked KeyPair: a Public Key (which anyone can see) and a Private Key (which must be kept strictly secret). If the public key encrypts data, only the corresponding private key can decrypt it. It solves the key distribution problem but is resource-intensive.
  • Algorithms: RSA, ECC (Elliptic Curve Cryptography – highly efficient for mobile devices due to smaller key lengths), Diffie-Hellman.

🤝 Key Exchange & Key Length

• Key Exchange: The process of securely sharing a symmetric session key over an insecure network using asymmetric cryptography (e.g., using Diffie-Hellman or RSA during a TLS handshake).
• Key Length: The size of the cryptographic key measured in bits. Longer keys equal stronger security because they increase the number of combinations required for a brute-force attack.
  • Example: An AES key length of 128 bits is mathematically secure, but AES-256 is standard for high-security environments. For RSA, a key length of at least 2048 bits or 4096 bits is considered secure today.

🛡️ Hashing & Salting

• Hashing: A one-way mathematical function that takes an input of any size and turns it into a fixed-length string (a fingerprint of the data). You cannot reverse a hash back into the original plaintext. It is used exclusively to verify Integrity.
  • Algorithms: SHA-256, SHA-3, MD5 (legacy/compromised).
• Salting: Adding random, unique data (a “salt”) to a plaintext password before hashing. This ensures that two users with the same password (Password123) will have completely different hashes stored in the database, breaking Rainbow Table attacks (pre-computed lists of hashes).

✍️ Digital Signatures & Key Stretching

• Digital Signatures: Provide Authentication, Integrity, and Non-repudiation. To sign a file, you hash it and encrypt the hash with your Private Key. The recipient decrypts the hash using your Public Key and compares it to a fresh hash of the file. If they match, the file hasn’t changed, and it definitely came from you.
• Key Stretching: A technique used to make a weak password more secure against brute-force attacks by running it through a hashing algorithm thousands of times, intentionally slowing down the attacker.
  • Examples: bcrypt, PBKDF2.

2. Encryption Levels & Transport

Where and how data is encrypted determines what threats it is protected against.

💾 Storage Encryption Levels

• Full-Disk (FDE): Encrypts the entire physical drive, including the OS. Protects data at rest if a laptop is physically stolen. (e.g., BitLocker, VeraCrypt).
• Partition: Encrypts a specific logical division of a hard drive while leaving other partitions unencrypted.
• Volume: Encrypts a specific storage container or mounted directory, which may span across multiple physical disks.
• File: Encrypts individual files. Good for fine-grained control; if an attacker compromises the OS, file-level encryption can still protect a specific document.
• Database: Encrypts the database files or tables entirely, often referred to as Transparent Data Encryption (TDE).
• Record: Encrypts a specific row or field inside a database (e.g., encrypting only the Credit_Card_Number column, while leaving User_Name viewable for database queries).

Transport / Communication Encryption

Protects data in transit across networks using protocols like HTTPS (TLS), SSH, or IPsec VPNs. This prevents eavesdropping and Man-in-the-Middle (MitM) attacks.

3. Public Key Infrastructure (PKI) & Certificates

PKI is the entire framework of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates.

Component Roles

• Certificate Authority (CA): The trusted third party that validates identities and issues digital certificates.
• Root of Trust: The foundational, topmost CA in a PKI hierarchy (Root CA). Its certificate is self-signed and pre-installed into web browsers and operating systems.
• Certificate Signing Request (CSR): A formal request sent to a CA to obtain a certificate. You generate a public/private keypair on your server, keep the private key secret, and send the public key along with your identity details inside the CSR to the CA.
• Key Escrow: A security arrangement where a trusted third party holds a copy of your private encryption keys. If an employee leaves the company or loses their key, management can retrieve it from escrow to recover encrypted corporate data.

Types of Certificates & Validation

• Third-party: A certificate issued by an external, universally trusted CA (like DigiCert or Let’s Encrypt). Used for public-facing websites.
• Self-signed: A certificate generated internally without a trusted CA. Great for internal testing or closed home lab environments, but web browsers will throw an “Untrusted Connection” warning.
• Wildcard: A single certificate that secures a main domain and all its subdomains. (e.g., a certificate for *.packetflipper.com protects www.packetflipper.com, blog.packetflipper.com, and vpn.packetflipper.com).

Revocation Mechanisms

If a private key is stolen, the certificate must be canceled before its expiration date.

• Certificate Revocation List (CRL): A published list of revoked serial numbers maintained by the CA. Browsers periodically download this file, but it can become large and outdated between updates.
• Online Certificate Status Protocol (OCSP): A faster, real-time alternative to CRLs. The browser queries the CA’s OCSP server directly via an API call (“Is this specific certificate valid? Yes/No”).

4. Cryptographic Hardware & Tools

Dedicated hardware mechanisms built to handle cryptographic workloads and protect sensitive keys from the main operating system.

• Trusted Platform Module (TPM): A dedicated, tamper-resistant cryptographic microchip soldered directly onto a computer’s motherboard. It securely stores encryption keys, passwords, and digital certificates, and is heavily used by Full-Disk Encryption (like BitLocker) to verify system boot integrity.
• Hardware Security Module (HSM): A heavy-duty, external physical device or plug-in card used in enterprise data centers to handle massive cryptographic processing and safeguard the Root CA’s private keys.
• Key Management System (KMS): A centralized software or cloud service (such as AWS KMS) used to generate, distribute, rotate, and manage the lifecycle of cryptographic keys across an enterprise.
• Secure Enclave: A hardware-isolated area within a CPU (found in modern processors such as Apple T-series and Intel SGX). It runs code and processes data completely separate from the main OS, ensuring that even if the OS kernel is rooted by malware, the data inside the enclave remains unreadable.

5. Obfuscation Techniques

Obfuscation is the practice of making data confusing, hidden, or difficult for humans and machines to understand, without necessarily using traditional mathematical encryption.

• Steganography: Hiding a secret message or data within an ordinary file (such as embedding text in the binary data of a JPEG image or an audio track). To the naked eye, the image looks normal, but a stego-tool can extract the hidden payload.
• Tokenization: Replacing sensitive data with a non-sensitive substitute called a “token.” The actual data is safely stored in a centralized, highly secure database vault.
  • Example: Apple Pay tokenizes your credit card. The merchant never receives your real card number; they just get a temporary token that is useless to a hacker if stolen.
• Data Masking: Hiding sensitive structural data by replacing characters with dummy characters.
  • Example: A customer service screen showing your credit card as XXXX-XXXX-XXXX-1234.

6. Blockchain & Open Public Ledgers

• Blockchain: A decentralized, distributed ledger technology where data is recorded in a series of sequential “blocks.” Each block contains a cryptographic hash of the previous block, creating an immutable chain. If an attacker tries to alter a transaction in an old block, the hashes for every subsequent block break instantly.
• Open Public Ledger: A completely transparent, public blockchain database (like Bitcoin or Ethereum) where anyone in the world can review and audit every transaction that has ever occurred, ensuring architectural trust without a centralized authority.