Cryptographic Solutions
Explain the importance of using appropriate cryptographic solutions
What you will learn
- Tell symmetric encryption from asymmetric, and know why real systems use both together.
- Explain why hashing is not encryption, and why SHA-256 alone is the wrong tool for storing passwords.
- Trace how a digital signature proves both who sent a message and that it was not altered.
- Separate encryption from encoding and obfuscation — the confusion the exam tests most.
- Pick the right solution for a given situation instead of memorising algorithm names.
Encryption is not an end in itself. It is a tool serving three distinct purposes, and the exam mostly measures whether you can tell which one a scenario needs: hiding content from anyone without the key, proving content was not altered, or proving who sent it. Different tools for different jobs — and the most common mistake is reaching for the first when the question is about the second.
How encryption works
The same key at both ends — this is symmetric encryption.
Plaintext
The data as it is, readable.
Encrypt with a key
A public algorithm plus a secret key. The secrecy lives in the key, never in the algorithm.
Ciphertext
Meaningless without the key — and safe to carry over an untrusted network.
Decrypt with the key
Plaintext again
The process is reversible — which is exactly what separates it from hashing.
Core terms
| Plaintext / Ciphertext | The data before encryption and after it. |
|---|---|
| Key | The secret that makes the algorithm's output unique. The algorithm is public; only the key is secret. |
| Symmetric | One key both encrypts and decrypts. Fast; its problem is getting the key to the other side. AES is the example. |
| Asymmetric | A key pair: a public key you publish and a private key that never leaves you. What one locks only the other opens. RSA and ECC are the examples. |
| Hash | A fixed-length fingerprint of any input. One-way: the input cannot be recovered from it. SHA-256 is the example. |
| Salt | A unique random value added to each password before hashing, so two identical passwords no longer share a fingerprint. |
| Digital Signature | The message's hash, encrypted with the sender's private key. Proves identity and integrity at once. |
| PKI / CA | The structure that binds a public key to a verified identity. The CA is the authority that issues the certificate and vouches for that binding. |
Symmetric vs asymmetric
| Symmetric | Asymmetric | |
|---|---|---|
| Keys | One shared key | A pair: public and private |
| Speed | Fast — suits bulk data | Much slower — not used to encrypt large files |
| The core problem | How do you deliver the key safely? | How do you know the public key belongs to who you think? |
| Who solves whose problem | Solves nothing on its own | Used to exchange a symmetric key, then symmetric carries the session |
That last row is what actually happens in every HTTPS connection you open: asymmetric runs only at the start of the session so the two sides can agree on a symmetric key, then the rest of the traffic moves under symmetric because it is faster. Someone who memorised "asymmetric is slower" without this context stalls when the exam asks why both are used together.
Hashing vs encryption
| Hashing | Encryption | |
|---|---|---|
| Direction | One-way — no way back | Reversible with the key |
| Key | No key | Requires a key |
| Purpose | Integrity: has anything changed? | Confidentiality: hiding the content |
| Output length | Fixed, however large the input | Scales with the input |
"We'll encrypt the passwords in the database"
A wrong sentence, and a very common one. Passwords are hashed, not encrypted — because encryption is reversible, and whoever steals the database and the key with it recovers every password in plaintext. The system never needs to know your password; it only needs to confirm that you do.
Real-world example: storing passwords
A company stores passwords as raw SHA-256. The database leaks. The problem is not that SHA-256 is broken — it is that SHA-256 is fast by design, so an attacker tries billions of guesses quickly. And with no salt, everyone who chose the same password shares a fingerprint, so cracking it once cracks it for all of them. The fix has two halves: a unique salt per user, which kills precomputed tables, and a deliberately slow algorithm such as Argon2id or bcrypt, which makes every guess expensive. OWASP's current guidance puts Argon2id first, bcrypt for legacy systems, and PBKDF2 where FIPS compliance requires it.
How a digital signature works
The sender hashes the message
A short fingerprint standing for the whole content.
Encrypts that hash with their private key
Private, not public — and this is the step most people get backwards.
Sends the message and signature together
The receiver decrypts the signature with the sender's public key
If it decrypts, the holder of the private key signed it.
Then hashes the message themselves and compares the two fingerprints
A match means the message was not altered in transit.
Which key for which job?
For confidentiality: encrypt with the recipient's public key — public, not private — only they can open it with their private one. For signing: sign with your own private key — anyone can verify with your public one. The rule: whatever only one person should be able to do uses the private key; whatever everyone should be able to do uses the public one.
How PKI builds trust
The server holds a key pair and requests a certificate
The CA verifies its identity, then signs its certificate
The certificate binds the public key to the domain name.
Your browser already trusts the CA
A root trust store ships with the system or the browser.
So it verifies the CA's signature on the certificate
And that is how you trust a server you have never seen — because you trust its guarantor.
Encryption ≠ encoding ≠ obfuscation
Base64 is encoding, not encryption: there is no key, and anyone reverses it in a second. Its purpose is moving data, not protecting it. Obfuscation makes something harder to read, not impossible. If a question describes protection with no key involved, the answer is not "encryption" however tempting it looks.
"We confirmed the file was unchanged"
If a question asks about confirming a file was not modified, it is asking about integrity — and the tool is hashing, not encryption. If it also wants proof of who produced it, move up to a digital signature. Read what the question asks you to prove, not the technical words it happens to mention.
Finally, where encryption applies: data is encrypted in transit by TLS, at rest on disk or in the database, and in use during processing — the hardest of the three. An exam question usually describes where a leak happened, and the right answer is the state that was not protected.
Current context — outside the objective
In August 2024, NIST released the first post-quantum cryptography standards: FIPS 203, 204 and 205. These are not in the published SY0-701 objectives and are not tested — but it is worth knowing that today's asymmetric algorithms now have a standardised successor being rolled out.
What matters on the exam
- The question describes a situation without naming the tool. Decide first: is it asking for confidentiality, integrity, or proof of identity? The answer follows the purpose.
- "Fastest" in a question about bulk data means symmetric. "Exchange keys safely" means asymmetric.
- Non-repudiation comes only from a digital signature — not from encryption alone and not from hashing alone.
- Any option describing passwords stored "encrypted" is almost always wrong. The right answer: hashed, salted, with a slow algorithm.
- Watch FIRST and BEST questions: several options may be technically true, and what is wanted is the one that fits the described situation.
Quick check
Answer in your head first, then reveal.
You need to send a large encrypted file to a colleague you have never met. Which approach, and why?Reveal the answer
Both: asymmetric to exchange a symmetric key safely, then symmetric to encrypt the file itself because it is far faster on bulk data.
A system stores passwords as SHA-256 with no salt. What are the two flaws?Reveal the answer
First, SHA-256 is fast by design, which allows guessing at enormous speed. Second, with no salt, identical passwords share a fingerprint and break as a group. The fix: a unique salt and a slow algorithm such as Argon2id.
Which key signs a message, and which one verifies it?Reveal the answer
You sign with your private key; the receiver verifies with your public key. The reverse — encrypting for confidentiality — uses the recipient's public key.
A colleague says they "encrypted" some text with Base64. Correct them.Reveal the answer
Base64 is encoding, not encryption: there is no key and anyone can reverse it. Its purpose is carrying data through text-only channels; it provides no confidentiality at all.
Sign in to track your progress on this topic.
Your next step
Read the lesson, then mark it complete
Sources
Used to verify the facts. The writing is original to Passuit.