Cryptography Basics
What each algorithm is for, and which of the three properties it gives you. Most cryptography questions are answered by knowing whether the scenario needs confidentiality, integrity, or authenticity.
Cryptography Basics · firsttry.app/cheatsheets/cryptography-basics · original reference written from published exam objectives. Not affiliated with any certification body.
What each property needs
| You need | Use | Example |
|---|---|---|
| Confidentiality | Encryption | AES for data, TLS for traffic |
| Integrity | Hashing | SHA-256 checksum on a download |
| Authenticity | Digital signature | Sign with a private key, verify with the public one |
| Integrity and authenticity | HMAC or a signature | HMAC-SHA256 on an API request |
| Non-repudiation | Digital signature | The signer cannot deny signing |
| Key exchange over an untrusted link | Asymmetric or Diffie-Hellman | TLS handshake |
Symmetric algorithms
| Algorithm | Type | Key size | Status |
|---|---|---|---|
| AES | Block, 128-bit blocks | 128 / 192 / 256 | Current standard |
| ChaCha20 | Stream | 256 | Current, common on mobile |
| 3DES | Block | 168 effective | Deprecated |
| DES | Block | 56 | Broken, do not use |
| RC4 | Stream | 40 to 2048 | Broken, do not use |
| Blowfish / Twofish | Block | Up to 448 / 256 | Legacy, largely replaced by AES |
Asymmetric and hashing
| Algorithm | Purpose | Notes |
|---|---|---|
| RSA | Key exchange, signatures | 2048-bit minimum, 3072 preferred |
| ECDSA | Signatures | 256-bit ECC is roughly 3072-bit RSA |
| ECDH | Key exchange | Elliptic curve Diffie-Hellman |
| Diffie-Hellman | Key exchange | Does not authenticate on its own |
| SHA-256 / SHA-3 | Hashing | Current standards |
| SHA-1 | Hashing | Collision attacks demonstrated, deprecated |
| MD5 | Hashing | Broken, non-security checksums only |
| bcrypt / scrypt / Argon2 | Password storage | Deliberately slow, salted |
| PBKDF2 | Key derivation | Iteration count is the work factor |
PKI components
| Component | What it does |
|---|---|
| Certificate Authority (CA) | Issues and signs certificates |
| Registration Authority (RA) | Verifies identity before the CA issues |
| Root CA | Top of the chain, kept offline |
| Intermediate CA | Signs end-entity certificates so the root stays offline |
| CSR | The request sent to a CA, carries the public key |
| CRL | Published list of revoked certificates |
| OCSP | Live revocation check for one certificate |
| OCSP stapling | The server presents its own fresh OCSP response |
| Key escrow | A third party holds a copy of the private key |
| Wildcard certificate | Covers one level of subdomain, *.example.com |
| SAN certificate | Covers several named hosts on one certificate |
| Self-signed certificate | No third-party trust, fine internally |
Now test yourself
Memorizing a table is a start. Practice questions are what make it stick, and every answer carries the full explanation.