1.4 Cryptographic Foundations, Key Management & PKI

🎯 Key CompTIA Security+ Exam Takeaways

• Symmetric encryption (AES-256, ChaCha20) uses a single shared secret key, providing fast, high-throughput bulk data encryption.
• Asymmetric encryption (RSA, ECC) uses a mathematically linked public/private keypair for key exchange, digital signatures, and identity attestation.
• 256-bit Elliptic Curve Cryptography (ECC) provides equivalent cryptographic resistance to 3072-bit RSA with significantly lower computational overhead.
• Public Key Infrastructure (PKI) binds public keys to verified identities using digital certificates issued by trusted Certificate Authorities (CAs).
• OCSP Stapling improves performance and privacy by having the web server periodically fetch and attach the CA's signed revocation status directly to the TLS handshake.

Modern cryptography provides the technical bedrock for confidentiality, integrity, authentication, and non-repudiation. Cryptographic solutions divide into symmetric and asymmetric algorithms. Symmetric ciphers (such as AES-GCM and ChaCha20) use a single secret key shared between parties for both encryption and decryption. Because symmetric algorithms are computationally lightweight and support hardware acceleration (AES-NI), they are universally deployed for bulk storage encryption and high-throughput network transport.

Asymmetric cryptography utilizes a mathematically coupled keypair: a public key (openly distributed) and a private key (strictly guarded by the owner). Data encrypted with the public key can only be decrypted by the matching private key, enabling secure key exchange over untrusted networks (Diffie-Hellman, RSA). Conversely, data encrypted with the private key can be decrypted by anyone with the public key, creating digital signatures that prove origin authenticity and non-repudiation.

Public Key Infrastructure (PKI) governs the lifecycle of asymmetric keys and digital certificates. A trusted Certificate Authority (CA) verifies the identity of certificate requesters, signs their digital certificates (X.509 format), and publishes revocation data when keys are compromised. To prevent the severe performance bottlenecks of downloading massive Certificate Revocation Lists (CRLs) or querying the CA's Online Certificate Status Protocol (OCSP) responder for every client connection, modern architectures deploy OCSP Stapling (RFC 6066/6960), where the web server caches the signed CA revocation status and staples it directly into the TLS handshake.

⚠️ Common Pearson VUE Exam Traps

• Confusing OCSP with CRL; CRLs require clients to download large, stale revocation lists, whereas OCSP provides real-time status queries.
• Attempting to encrypt multi-terabyte database backups directly with asymmetric RSA; asymmetric ciphers are computationally slow and limited in block size, making them suitable only for key exchange and signatures, not bulk payloads.