Cryptography fundamentals
Domain 1: General Security Concepts · Not started
Main exam topics
Security controls; confidentiality, integrity and availability; authentication and authorization; zero trust; physical security; change management; non-repudiation; encryption, hashing, certificates and digital signatures.
SY0-701 topic overview · Independent study resource, not a prediction of exam questions.
Symmetric encryption
Symmetric encryption uses one shared key to encrypt and decrypt. It is fast and suits bulk data, which is why AES protects disks and VPN traffic. The hard part is key distribution: both sides need the same secret without an attacker seeing it.
Asymmetric encryption
Asymmetric encryption uses a key pair. Data encrypted with a public key can only be decrypted with the matching private key. It is slower, so it is mostly used to exchange symmetric keys and to create digital signatures. RSA and elliptic-curve cryptography are common examples. To sign, the sender uses their own private key; anyone can verify with the public key.
Hashing and salting
A hash is a one-way, fixed-length fingerprint of data. Changing one bit changes the hash, so hashes verify integrity. Hashes cannot be reversed with a key. Password storage adds a unique random salt before hashing so identical passwords produce different hashes and rainbow tables fail. Key stretching tools such as PBKDF2 and bcrypt slow brute-force guessing.
PKI and certificates
Public key infrastructure binds public keys to identities using certificates signed by a certificate authority. Browsers trust a site because its certificate chains to a trusted root. Revoked certificates are published through CRLs or checked live with OCSP.
Know the difference: Symmetric vs. asymmetric encryption
| Aspect | Symmetric | Asymmetric |
|---|---|---|
| Keys | One shared key | Public/private pair |
| Speed | Fast, bulk data | Slower |
| Typical use | Disk, VPN data | Key exchange, signatures |
| Example | AES | RSA, ECC |
Saved