Cryptography Essentials for the CISSP Exam: What You Must Know (and How to Think)

Cryptography is often feared by CISSP candidates because they think they need to be mathematicians. You don’t. The CISSP exam requires you to understand the concepts, the applications, and the management of cryptography, not the complex math behind it.

How CISSP Approaches Cryptography

The exam focuses on:

• Which algorithm to choose for a specific goal (speed vs. security).
• How to manage keys (the weakest link).
• The lifecycle of a cryptographic system.

Core Cryptographic Goals

• Confidentiality: Only authorized users can read the data. (Encryption).
• Integrity: The data hasn’t been altered. (Hashing).
• Authentication: Proving who sent the data. (Digital Signatures).
• Non-Repudiation: The sender cannot deny sending the message. (Digital Signatures / PKI).

CISSPWant to practise this hands-on? Crack CISSP in 1st Attempt covers it with live labs and mentor support.

Symmetric Encryption (Private Key)

Uses ONE key for both encryption and decryption. Fast, efficient, good for bulk data (hard drives, VPN tunnels).

• Algorithms: AES (Standard), DES (Weak), 3DES (Legacy), RC4 (Weak stream cipher), Blowfish/Twofish.
• Problem: Key Distribution. How do I get the key to you securely?

Asymmetric Encryption (Public Key)

Uses TWO keys: Public (encrypt) and Private (decrypt). Slower but solves key distribution.

• Algorithms: RSA (Factoring primes), ECC (Elliptic Curve – efficient for mobile), Diffie-Hellman (Key Exchange only), El Gamal.
• Use Case: Key exchange, Digital Signatures, small amounts of data.

Hashing & Data Integrity

One-way function. You cannot reverse a hash. Used to verify integrity.

• Algorithms: MD5 (Broken, avoid), SHA-1 (Weak), SHA-256/SHA-3 (Standard), HMAC (Hash + Key for integrity + auth).
• Collisions: When two different inputs produce the same hash (bad).

Digital Signatures & PKI

How do we trust the public key? Public Key Infrastructure (PKI).

• Digital Signature: Hash the message → Encrypt hash with Sender’s PRIVATE key. Provides Integrity, Authentication, and Non-Repudiation.
• Certificate Authority (CA): Trusted third party that issues certificates.
• CRL / OCSP: Mechanisms to check if a certificate has been revoked.

Key Management

This is the most critical part. If you lose the keys, crypto is useless.

• Storage: Never store keys with the data. Use Hardware Security Modules (HSM) or TPM chips.
• Rotation: Change keys regularly to limit impact of a compromise.
• Escrow: Giving a copy of the key to a third party (often for law enforcement or disaster recovery).
• Destruction: Securely destroying old keys is mandatory.

Cryptographic Attacks

Know the basics of how crypto is broken:

• Brute Force: Trying every key. Defeated by long keys (Key Space).
• Dictionary / Rainbow Tables: Pre-computed hashes. Defeated by “Salting”.
• Birthday Attack: exploits probability to find collisions (integrity attack).
• Known Plaintext / Chosen Plaintext: Attacker has samples of encrypted and decrypted data.

Encryption in Transit vs At Rest

• Data at Rest: Full Disk Encryption (BitLocker), Database encryption, File encryption. Protects against physical theft.
• Data in Transit: TLS (Transport Layer Security) – successors to SSL. VPNs (IPSec). Protects against sniffing/eavesdropping.