Talib AliCybersecurity Study Guide & Portfolio
← Learning Log

Learning Log

Session 9: Cryptographic Algorithms, Public Key Infrastructure and Cryptographic Solutions

Symmetric and asymmetric encryption, hashing and digital signatures; certificate authorities, certificate chains, revocation and key management; and encryption of data at rest and in transit, forward secrecy, password hashing, blockchain and obfuscation.

Topics covered 19

Session type: Tutor-led learning
Topic: Cryptographic algorithms, public key infrastructure and cryptographic solutions

Previous entry: Session 8: Threat Actors, Attack Surfaces and Social Engineering.

Session overview

This session continued the programme’s CompTIA Security+ preparation with a lesson titled “Explaining Appropriate Cryptographic Solutions”. It had three sections: cryptographic algorithms, public key infrastructure, and cryptographic solutions. The subject corresponds to objective 1.4 of the published Security+ SY0-701 objectives; this entry records what was covered and does not claim that any objective was covered in full.

The session had first been scheduled for Thursday 8 October 2026. That occurrence was cancelled, and the session took place on Monday 12 October 2026.

The tutor gave five demonstrations and led a classroom review of cryptographic algorithms. No lab is recorded as completed.

Taught and demonstrated

Each heading below records what the session covered, grouped under the lesson’s three sections. The points say which subjects were covered; they are not the wording of the lesson material, which is not recorded. Beginner definitions, analogies and worked examples were developed afterwards and are in the Study Guide lessons linked at the end. Where a subject is easily misstated, a box labelled Supplementary explanation gives the accurate position: these qualifications are mine, checked against published references, and are not the tutor’s words.

Cryptography, cryptanalysis and ciphers

  • Section 3A, cryptographic algorithms, began with cryptography, cryptanalysis and cryptology.
  • It covered plaintext, ciphertext and ciphers.
  • It covered Alice, Bob and Mallory as the conventional parties in descriptions of cryptography.
  • It covered Kerckhoffs’s principle.

Encoding and encryption

  • The session covered the difference between encoding and encryption.

Encoding is not encryption: an encoding such as Base64 uses a public scheme and no key, so anyone can reverse it and it gives no confidentiality.

The Caesar cipher and Enigma

  • The session covered the Caesar cipher and substitution.
  • It used Enigma as a historical example.

Symmetric encryption and AES

  • The session covered symmetric encryption and the Advanced Encryption Standard (AES).

Asymmetric encryption, RSA and ECC

  • The session covered asymmetric encryption, RSA and elliptic curve cryptography (ECC).
  • It covered key pairs and key distribution.
  • It covered prime numbers as the foundation of RSA.

ECC is a family of algorithms built on elliptic-curve mathematics, not one algorithm. RSA encryption and RSA signing use the keys for different purposes: a recipient’s public key encrypts, while a signer’s private key signs.

Key length, keyspace and brute force

  • The session covered key length, keyspace and brute force.

Hashing and the SHA families

  • The session covered the SHA families, including SHA-256 and SHA-512.
  • It covered fixed-length digests.
  • It covered weaknesses in MD5 and SHA-1.

A hash is one-way and uses no key, so it is not encrypted data and cannot be decrypted. MD5 is not suitable where collision resistance matters, because practical collisions have been produced for it.

Hash resistance properties and collisions

  • The session covered preimage resistance and collision resistance.
  • It covered hash collisions and the intuition behind the birthday bound.

Hash collisions are possible for every hash function, because there are more possible inputs than digests. A secure hash makes them infeasible to find, not non-existent.

Checksums and integrity verification

  • The session covered checksums and integrity verification.

Rainbow tables and password cracking

  • The session covered rainbow tables and password cracking.

Digital signatures

  • The session covered digital signatures.
  • It covered integrity, authentication and non-repudiation.
  • It covered the difference between encryption and signing.

A digital signature alone does not provide confidentiality: a signed document can be read by anyone who receives it. Non-repudiation provides evidence that a particular private key was used, not an unconditional guarantee of who used it.

Public key infrastructure and certificate authorities

  • Section 3B, public key infrastructure, covered PKI and certificate authorities (CAs).
  • It covered public and private CAs.
  • It used the DigiNotar compromise as a historical case.

A certificate authority does not certify that a website is safe. A certificate shows control of a name and a key, and says nothing about the honesty of whoever runs the site.

Digital certificates and X.509

  • The session covered digital certificates and X.509.
  • It covered public keys and subject identities.

Root, intermediate and leaf certificates

  • The session covered root certificates and trust anchors.
  • It covered root, intermediate and leaf certificates.
  • It covered certificate chains and their verification.

A root certificate is trusted because it has been placed in a device’s trust store as a trust anchor. Its own signature proves nothing, since a root signs itself.

Self-signed certificates and certificate signing requests

  • The session covered self-signed certificates.
  • It covered certificate signing requests (CSRs).

Common Name and Subject Alternative Name

  • The session covered the Common Name (CN) and the Subject Alternative Name (SAN).

The Subject Alternative Name is the field modern clients use to match a website’s name. The Common Name is no longer used for that purpose.

Certificate validity, expiry and revocation

  • The session covered certificate validity and expiration.
  • It covered certificate revocation.
  • It compared certificate revocation lists (CRLs) with the Online Certificate Status Protocol (OCSP).

Revocation checking has operational limitations: a revocation list is only as fresh as its last publication, and a status query can fail, be blocked or reveal which site is being visited. Many clients carry on when no answer arrives.

Key lifecycle and key management

  • The session covered the cryptographic key lifecycle.
  • It covered centralised and decentralised key management.
  • It covered the Key Management Interoperability Protocol (KMIP).

Entropy and randomness

  • The session covered entropy and cryptographic randomness.

TPMs, HSMs and secure enclaves

  • The session covered Trusted Platform Modules (TPMs), hardware security modules (HSMs) and secure enclaves.

A TPM does not necessarily contain every volume encryption key. It commonly protects one key that in turn protects others, which are stored in encrypted form on the drive.

FIPS 140-2 and FIPS 140-3

  • The session covered the FIPS 140-2 and FIPS 140-3 standards.

FIPS 140-3 supersedes FIPS 140-2. New validations are carried out against FIPS 140-3.

Key escrow and M-of-N recovery

  • The session covered key escrow.
  • It covered M-of-N threshold recovery.

Confidentiality and the states of data

  • Section 3C, cryptographic solutions, covered confidentiality.
  • It covered data at rest, data in transit and data in use.

Hybrid encryption

  • The session covered hybrid encryption.
  • It covered the use of AES and RSA together.

Disk, partition and file encryption

  • The session covered full-disk and partition encryption.
  • It covered BitLocker and the Encrypting File System (EFS).
  • It covered self-encrypting drives.

Database and record-level encryption

  • The session covered database encryption and record-level encryption.

Transport encryption, TLS and HTTPS

  • The session covered transport encryption and Transport Layer Security (TLS).
  • It covered HTTPS and certificate authentication.

Key agreement, ephemeral keys and forward secrecy

  • The session covered key agreement and Elliptic Curve Diffie-Hellman Ephemeral (ECDHE).
  • It covered ephemeral keys.
  • It covered perfect forward secrecy.

Forward secrecy is not automatic. It depends on an ephemeral key exchange and on the temporary keys and session keys being discarded after use.

Salting, stretching and peppering

  • The session covered salting, key stretching and peppering.
  • It covered password hashing using modern schemes.

Password storage requires a purpose-built password-hashing scheme, not a single fast hash. A salt differs from a pepper: a salt is unique to each password and stored beside its hash, while a pepper is a secret stored somewhere else.

Blockchain

  • The session covered blockchain and hash-linked records.

A blockchain does not necessarily use a public ledger: permissioned blockchains restrict who may read or take part. A central bank digital currency does not inherently require a blockchain.

Steganography, data masking and tokenisation

  • The session covered steganography.
  • It covered data masking.
  • It covered tokenisation.

Tokenisation is not equivalent to encryption. A token has no mathematical relationship to the value it replaces, so no key turns it back into the original.

De-identification and anonymisation

  • The session covered de-identification and anonymisation.

De-identification does not necessarily mean anonymisation. With direct identifiers removed, people may still be re-identifiable from what remains.

Tutor demonstrations

  • The tutor demonstrated the CyberChef website.
  • The tutor demonstrated the checksums published for Kali Linux downloads.
  • The tutor showed the FreeRainbowTables website.
  • The tutor showed Windows Certificate Manager.
  • The tutor showed the certificate store used by Microsoft Edge.
  • What was entered, opened or shown on screen in each demonstration is not recorded.

Classroom review of cryptographic algorithms

  • The session included a classroom review of cryptographic algorithms, as a review activity.
  • The questions asked and the answers given are not recorded.

Practical activity and evidence

  • Demonstrated by the tutor: the CyberChef website; the checksums for Kali Linux downloads; the FreeRainbowTables website; Windows Certificate Manager; and the Microsoft Edge certificate store. Watching these was observation, not practical work.
  • Review activity: a classroom review of cryptographic algorithms. It was a review of the taught material, not a lab.
  • Completed by me: no practical work is recorded. There is no confirmed completion of any hands-on lab for this session.
  • Discussed but not performed: encrypting storage, hashing and salting passwords, issuing or validating certificates, and managing keys. The lesson has associated labs on storage encryption and on hashing and salting; this entry does not record either as completed.
  • Not recorded: the exact wording of the lesson material; what was entered or shown in each demonstration; any checksum values, certificate details or outputs; and the questions and answers in the classroom review.

Key takeaways

  • Encryption needs a key to reverse, encoding needs none, and a hash cannot be reversed at all.
  • Symmetric encryption is fast and has a key-distribution problem; asymmetric encryption solves distribution and is slow; hybrid encryption uses each for what it does well.
  • A signature is made with the signer’s private key and checked with the signer’s public key. It gives integrity and evidence of origin, not confidentiality.
  • A certificate chain is trusted only because it ends at a root already in the device’s trust store.
  • Forward secrecy, salting and tokenisation each solve a specific problem, and each is easily confused with a neighbour: long-term keys, peppering and encryption.

How this entry was put together

  • Sources: the session’s lesson material, which had three sections, and a cryptography summary sheet supplied with it, summarised afterwards as a list of the subjects covered; and my record of which demonstrations the tutor gave.
  • Wording: the points under Taught and demonstrated say which subjects the session covered. They are in my own words and reproduce none of the lesson material. Nothing here is quoted from the tutor.
  • Supplementary explanation: everything in the boxes labelled Supplementary explanation is mine and is not attributed to the tutor. The accuracy qualifications were written afterwards, while I wrote up the session.
  • Independently checked: the accuracy qualifications against published references, including NIST publications, the TLS and certificate standards published as RFCs, the CA/Browser Forum’s requirements and Microsoft’s BitLocker documentation, and the Security+ wording against the published SY0-701 objectives. These are external references, not course evidence. The linked lessons name each one.
  • Not recorded: the exact wording of the lesson material, what each demonstration showed in detail, and the content of the classroom review.
  • Reflection: not yet written. I will add my own reflection on this session; none has been generated for this entry.
  • Diagrams: none in this entry. The linked lessons contain original diagrams; none reproduces the lesson material.
  • No practical work: this entry records classroom teaching, observed demonstrations and a review activity. It is not evidence of a completed lab, of configuring encryption or certificates, or of any work on a real system, and it does not record a qualification.