Start with the security objective, not the algorithm name
When a Security+ scenario names a cryptographic control, first identify the required outcome. Confidentiality means unauthorized people cannot read the data. Integrity means unauthorized change can be detected. Authentication helps verify identity or origin. Non-repudiation aims to make a valid action difficult for its originator to deny.
Transform readable plaintext into ciphertext using a key.
Detect whether the protected content changed.
Sign with a private key and verify with the matching public key.
If the requirement says “recover the original data,” hashing is not the answer. If it says “detect modification,” a hash-based control may be central, but decide whether an attacker also needs to be prevented from replacing the digest.
Symmetric encryption: efficient protection with a shared secret
Symmetric encryption uses the same secret key to encrypt and decrypt data. It is efficient for protecting large volumes such as files, disks, database fields, backups and network-session traffic. AES is a common symmetric algorithm family in Security+ material.
The operational challenge is key distribution: every party that can decrypt must obtain and protect the shared key. If the key is exposed, an attacker may decrypt protected information or impersonate a legitimate participant, depending on the design.
Protecting a 500 GB database backup
The backup system encrypts the data with a symmetric key because bulk encryption must be efficient. The key is stored separately in an approved key-management system, access is logged, rotation is planned, and restore testing proves that recovery still works.
Asymmetric encryption: different keys with different responsibilities
Asymmetric cryptography uses a public key and a private key. The public key can be distributed; the private key must remain controlled by its owner. What one key does depends on the cryptographic operation: public-key encryption can protect data for the private-key holder, while a private-key signature can be verified using the public key.
Asymmetric cryptography does not eliminate key management. Certificates and public key infrastructure help bind a public key to a named subject, while validation checks the issuing chain, intended use, validity period and revocation status.
Hashing: a one-way integrity building block
A cryptographic hash accepts input of arbitrary size and produces a fixed-size digest. A small input change should produce a substantially different result. Secure designs depend on resistance to finding two inputs with the same digest and resistance to reconstructing the input from its digest.
document→ SHA-256 →digest Achanged document→ SHA-256 →digest BA plain hash can reveal accidental change, but an attacker who can alter both the file and stored digest can calculate a replacement. An HMAC combines a cryptographic hash with a secret key, allowing parties that know the key to verify integrity and authenticity. HMAC does not encrypt the message.
Passwords should use a unique salt and a purpose-built slow password-hashing or key-derivation scheme. A salt is not secret; it prevents identical passwords from producing identical stored values and makes precomputed attacks less useful.
Digital signatures: integrity and origin verification
A signer hashes the content and creates a signature using the private key. A verifier uses the signer’s public key to validate the signature against the received content. If validation succeeds and the public key is trusted, the verifier gains evidence that the content has not changed and that the corresponding private key created the signature.
Hash
Create a digest of the content.
Sign
Use the signer’s private key to produce the signature.
Verify
Use the trusted public key and received content to validate it.
A signature does not hide the signed content. When confidentiality is also required, use encryption in addition to signing. Protecting the private signing key is essential; theft undermines confidence in new signatures.
Worked scenario: why TLS uses a hybrid approach
Situation: A customer opens an HTTPS page. The server presents a certificate. The browser validates the hostname, dates and trust chain, and the handshake establishes fresh session secrets. Symmetric authenticated encryption then protects application data.
- Authentication: the certificate and proof of private-key possession help the browser authenticate the server.
- Key establishment: handshake mechanisms allow the endpoints to derive shared session secrets without sending the resulting symmetric key as plaintext.
- Efficient confidentiality and integrity: symmetric authenticated encryption protects the ongoing session.
Bulk traffic benefits from efficient symmetric cryptography. The protocol combines controls because no single mechanism is best for authentication, key establishment and high-volume data protection.
Real-world troubleshooting: certificate is valid, but the browser warns
A certificate can be within its validity dates and still fail validation. Use a structured check instead of replacing cryptography at random.
The requested DNS name must match the certificate’s permitted names.
The server must present the required intermediate certificates so the browser can build trust.
Review client time, certificate dates and applicable revocation information.
Confirm the certificate is suitable for the intended server-authentication purpose.
What you learned: encryption can be technically strong while trust configuration is wrong. Security+ questions often separate the algorithm from certificate lifecycle, identity validation and key-management failures.
Practice checks with explanations
A company must prove a downloaded installer was not modified. What should it publish?
Best answer: a digital signature that customers verify using a trusted public key. A public hash alone detects a mismatch but can be replaced if an attacker compromises both download and hash locations.
A sensor and server share a secret and must detect forged messages without hiding readings. What fits?
Best answer: HMAC. It authenticates the message and detects change using the shared secret without providing confidentiality.
A storage system must recover encrypted records later. Should it hash them?
Best answer: no. Use encryption with controlled keys because the original records must be recoverable. Hashing is one-way.
Common Security+ exam mistakes
- Calling hashing reversible encryption.
- Assuming a digital signature hides the content.
- Using a fast general-purpose hash alone for password storage.
- Forgetting that a plain digest can be replaced by an attacker.
- Confusing the certificate’s public information with the protected private key.
- Choosing asymmetric cryptography for all bulk data instead of recognizing a hybrid protocol.
- Checking certificate dates but ignoring hostname, chain, usage or revocation.
Frequently asked questions
What is the main difference between symmetric and asymmetric encryption?
Symmetric encryption uses the same shared secret key for encryption and decryption. Asymmetric encryption uses a mathematically related public and private key pair, enabling uses such as key establishment and digital signatures.
Is hashing a form of encryption?
No. Encryption is reversible with the correct key. A cryptographic hash is designed as a one-way transformation that produces a fixed-size digest and is commonly used to verify integrity.
Why do secure protocols use both symmetric and asymmetric cryptography?
They combine complementary strengths. Asymmetric mechanisms can authenticate parties or establish shared secrets, while efficient symmetric encryption protects the bulk session data.
Does a digital signature provide confidentiality?
No. A digital signature primarily supports integrity, origin authentication and non-repudiation goals. Encrypt the content separately when confidentiality is required.
How should passwords be stored?
Store passwords with a purpose-built, salted password-hashing or key-derivation function and appropriate work settings, not reversible encryption or a fast general-purpose hash alone.
Current exam reference
Use the official CompTIA Security+ certification page to confirm the active exam and download current objectives before scheduling. ITCertPath explanations and practice are independent resources and do not reproduce confidential exam questions.