ITIS-468-47605: Certified Information Systems Security Professional (CISSP) Cert Exam Prep

Symmetric vs asymmetric

Symmetric cryptography uses one shared secret key for both encryption and decryption. It is fast and good for bulk data, but key distribution is hard and the number of keys grows as n(n-1)/2. Asymmetric cryptography uses a mathematically related key pair, solving distribution and enabling digital signatures, but is far slower. Real systems combine both: asymmetric to exchange a symmetric session key, symmetric for the data.

• Symmetric algorithms: AES (128/192/256), 3DES, Blowfish, Twofish, RC4 (deprecated).
• Asymmetric algorithms: RSA (factoring), Diffie-Hellman (key agreement), ECC (efficient, good for mobile), El Gamal.
• Hashing: SHA-2 / SHA-3 families; MD5 and SHA-1 are broken for collision resistance.
• HMAC adds a secret key to a hash to provide integrity plus data-origin authentication.

Which service does what?

• Encrypt with the recipient's public key → confidentiality.
• Sign with the sender's private key → authentication, integrity, non-repudiation.
• Hash alone → integrity only.
• Digital signature = hash of the message, encrypted with the signer's private key.

PKI and key management

A public key infrastructure binds identities to public keys using X.509 certificates issued by a certificate authority (CA), often through registration authorities. Revocation is published through CRLs or checked with OCSP. Keys must be protected across their full lifecycle: generation, distribution, storage, rotation, escrow, and destruction — the strongest algorithm fails if the key is mishandled.