Concept Focus

Word origin: crypto = secret; graphy = the science of writing. Definition: the science of transforming plaintext (PT) into ciphertext (CT) to achieve confidentiality, integrity, and authenticity, and non-repudiation when signed.

Encoding vs Encryption

Symmetric Encryption

A single secret key (K) is used for both encryption and decryption, optimized for speed and bulk data (backup files, object storage, logs, telemetry). It is implemented as block ciphers (e.g., AES: fixed-size blocks, padding, modes) or stream ciphers (bit or byte at a time).

Why it's fast. The operations (substitution, permutation, XOR, finite-field math) are constant-time and hardware-accelerable (AES-NI), with no expensive big-integer math per message like RSA.

Critical moving parts.

How symmetric encryption works

Symmetric encryption, one shared key encrypts plaintext to ciphertext and back
Symmetric encryption, one shared key encrypts and decrypts
Risks to avoid

Key reuse across environments. IV / nonce reuse (catastrophic in CTR / GCM). Storing keys in code or CI variables. ECB for structured data such as images or JSON with repeated fields.

Symmetric algorithms

Common symmetric encryption algorithms and their key and block sizes
Common symmetric algorithms at a glance

Asymmetric Encryption

Two mathematically related keys: a Public key (Pub) and a Private key (Priv).

Strengths. Solves key distribution (no sharing of the private key) and enables digital signatures, certificates, and PKI. Trade-offs. Slower than symmetric for bulk data, so it is used to exchange a session key (hybrid); it requires PKI (CAs, CRLs / OCSP) to vouch for public keys; and it carries side-channel risks (timing attacks on RSA), so use constant-time libraries or an HSM.

How asymmetric encryption works

Step by step asymmetric exchange between Alice and Bob using public and private keys
The exchange step by step, Bob publishes a public key, Alice encrypts, only Bob's private key decrypts
Asymmetric encryption flow from sender to recipient using public and private keys
Asymmetric encryption flow, encrypt with the recipient's public key, decrypt with their private key
Uses of asymmetric encryption including confidentiality, signatures and key exchange
Where asymmetric encryption is used

Asymmetric encryption and the CIA triad

Neuromesh analogy

Anya encrypts test logs with Anas's public key for confidentiality. Anas signs his response with his private key for integrity. Both rely on TLS for their collaboration tools to stay available.

Brain Ticklers

Practice Questions — Domain 3 · Cryptography

Q1. Anya needs to encrypt a 5 GB log file before uploading it to Neuromesh's storage. Which method is most efficient?

  1. Asymmetric encryption (RSA) with a 2048-bit key
  2. Symmetric encryption (AES-256) with shared key K1
  3. Encoding with Base64 before upload
  4. Signing with Neuromesh's private key

Q2. Marcus tells Anya to “never email a symmetric key over the internet.” Why?

  1. Keys can only be exchanged in Base64 format
  2. If the symmetric key is intercepted, the entire system is compromised
  3. Symmetric keys regenerate automatically, so distribution is irrelevant
  4. Asymmetric encryption does not require keys at all

Q3. In an Alice to Bob exchange, why can't Mallory use Bob's public key to decrypt the ciphertext?

  1. Public keys are designed for decryption only
  2. Mallory intercepted the ciphertext incorrectly
  3. Public keys can only encrypt; private keys are required to decrypt
  4. Mallory needs Anya's public key instead

Q4. Neuromesh wants both confidentiality and authentication in their API communication. Which combination is correct?

  1. Encrypt with Bob's private key, decrypt with Bob's public key
  2. Encrypt with Bob's public key (confidentiality), sign with Anya's private key (authentication)
  3. Encrypt with Base64, verify with SHA-1
  4. Encrypt with AES, publish the AES key on a public repo