Cryptography Basics: Encryption, Hashing, and How They Protect Data

What Is Cryptography?

Cryptography uses mathematical methods, algorithms, keys, and protocols to protect information and enable trusted digital communication. Depending on the technique and its implementation, cryptography can support confidentiality, integrity, authentication, and non-repudiation.

For Security+ scenarios, identify the security objective before selecting a technique. Encryption is primarily associated with confidentiality. Cryptographic hashing helps verify integrity. Password-hashing systems help verify passwords without storing them as readable plaintext. Digital signatures can support integrity, origin authentication, and non-repudiation when keys and supporting processes are trustworthy.

The Basic Cryptography Vocabulary

Encryption: Protecting Data Confidentiality

Encryption transforms plaintext into ciphertext using a cryptographic algorithm and key. Authorized users or systems can recover the data with the appropriate decryption process if they possess the required keying material and permissions.

Encryption is designed to protect confidentiality. Someone who copies encrypted information should not be able to understand its contents merely by reading the ciphertext. Real protection also depends on secure key management, suitable algorithms, correct implementation, and appropriate configuration.

Data at Rest

Data at rest is information stored on a device or storage system rather than actively moving across a network. Examples include laptop drives, file servers, databases, removable media, cloud storage, and backups.

Encryption at rest can reduce the impact of a stolen laptop or copied storage device. Its effectiveness depends on how keys are protected and whether an attacker can access the device while it is already unlocked or the data is available to an authenticated session.

Common Encryption Scopes

Data in Transit

Data in transit is information moving between systems. Examples include browser-to-server traffic, application-to-database connections, remote-access sessions, and transfers across public or private networks.

Technologies such as TLS and VPNs can use cryptographic mechanisms to protect communications in transit. When a scenario requires information to remain private while travelling, think encryption and confidentiality.

Hashing: Protecting Integrity and Verifying Data

A cryptographic hash function accepts input data and produces a fixed-length output called a hash value or digest. For a suitable modern hash function, even a small input change should produce a substantially different digest with overwhelming probability.

SHA-256 belongs to the SHA-2 family. A trusted digest can help an administrator detect whether a downloaded file differs from the version represented by that digest. The comparison is useful only when the reference digest itself comes from a trustworthy source.

The Avalanche Effect

A useful hash-function property is that a small input change should result in a substantially different digest. If one character in a downloaded file changes, the newly calculated digest should differ from the trusted digest. Security tools can compare these values to help detect modification or corruption.

One-Way Behavior and Collision Resistance

One-way behavior means it should be computationally infeasible to recover the original input from the digest alone. Collision resistance means it should be computationally infeasible to find two different inputs that produce the same digest.

These are distinct properties. A hash function is not a normal decryption mechanism, and collision resistance is not a promise that collisions are mathematically impossible.

Salting and Secure Password Storage

Applications should not normally store users’ passwords as readable plaintext. A secure password-storage design stores a verifier produced with a suitable password-hashing function, rather than keeping the original password for later retrieval.

What Is a Salt?

A salt is a unique value added to the input before password hashing. A different salt means the same password can produce different stored verifier values in different accounts. Salts also make precomputed lookup tables less useful against a collection of independently salted password hashes.

What Is Key Stretching?

Key stretching makes password-based guessing more computationally expensive by applying a deliberately costly derivation process. Depending on the algorithm, a password-storage or key-derivation design may use work factors, iteration counts, memory costs, or a combination of these.

• PBKDF2: a password-based key derivation function that uses repeated processing controlled by an iteration count.
• bcrypt: an adaptive password-hashing function with a configurable work factor.
• Argon2: a password-hashing family designed to make password guessing more expensive; Argon2id is a commonly considered variant.

For password storage, the algorithm, work factor, implementation, and salt all matter. A fast general-purpose digest such as SHA-256 alone is not a substitute for a suitable password-hashing design.

Symmetric and Asymmetric Cryptography: The Basic Difference

Symmetric cryptography uses the same shared secret key for encryption and decryption. Asymmetric cryptography uses a mathematically related public/private key pair. These approaches solve related but different problems.

This lesson covers the foundational distinction. Continue with Symmetric vs. Asymmetric Encryption for algorithms, use cases, and hybrid approaches.

Hybrid Encryption and Key Exchange

Real-world protocols often combine cryptographic techniques. A protocol can use asymmetric cryptography or a key-agreement method to establish shared session key material, then use symmetric cryptography to protect bulk session data efficiently.

Key exchange or key agreement is about establishing keying material; it is not the same operation as encrypting every application message. In modern TLS configurations, ephemeral key agreement can also support perfect forward secrecy, helping protect past sessions against later compromise of a long-term authentication key when the protocol and implementation provide that property.

Cryptographic Algorithms and Key Length

An algorithm and its key length both influence security, but a larger key size does not automatically make every system secure. Algorithm design, attack history, protocol, implementation, key generation, and key management all matter.

Organizations should select approved algorithms and key sizes that meet their requirements and current standards. Deprecated algorithms, weak configuration, poor random-number generation, and exposed keys can undermine a design even when another component appears strong.

Cryptographic Key Management

Cryptography can fail if keys are not managed properly. Key management includes key generation, storage, distribution or establishment, use, rotation, revocation, backup where appropriate, and secure destruction.

TPM vs. HSM vs. KMS vs. Secure Enclave

These terms describe related but different ways of protecting and managing keys. They should not be treated as interchangeable.

Why Key Protection Matters

If an attacker obtains the relevant decryption key, encryption may no longer protect the data from that attacker. Good key protection includes least-privilege access, secure storage, auditing, recovery arrangements, rotation or revocation procedures, and controls for compromised or retired keys.

Key escrow means retaining key material or recovery capability under controlled conditions so it can be recovered under defined circumstances. Weak access controls and governance can make escrow a security risk. Certificate authorities and certificate lifecycle details are covered separately in the Public Key Infrastructure (PKI) lesson.

Encryption vs. Other Forms of Data Protection

Some techniques reduce exposure or change how information is represented without performing conventional encryption. Identify the actual protection goal when these terms appear in Security+ scenarios.

Blockchain, Hashes, and Public Ledgers

A blockchain is a type of distributed ledger that commonly links blocks using cryptographic hashes and may use digital signatures to authenticate transactions. Consensus and governance mechanisms help participating systems agree on ledger state.

Hash-linked blocks can make changes to previously recorded data detectable because changing a block can affect subsequent hash links. However, blockchain does not make tampering mathematically impossible, guarantee that the original data was truthful, or automatically make public ledger entries confidential.

• Hashes: help link records and make certain modifications detectable.
• Digital signatures: can help associate a transaction with control of a signing key.
• Consensus: helps participating nodes agree on accepted ledger state under the system’s rules.
• Confidentiality: is separate. Public availability can expose transaction information unless additional privacy measures are used.

Cryptography and Security Goals

Cryptographic mechanisms support these goals, but do not automatically guarantee them in every situation. A digital signature does not prove that signed content is factually true or that the signing key was never compromised. Key trust, implementation, and supporting processes matter.

Common Cryptography Mistakes

Security+ Scenario Strategy

Identify the requirement first, then match the technique to the problem. Pay attention to words such as protect, detect, verify, hide, replace, establish, and recover; they can point to different solutions.

For additional context, review Non-Repudiation and Digital Signatures and the CIA Triad. Continue with the Security+ SY0-701 guide hub for the complete series.