Cryptography Basics
What each algorithm is for, and which of the three properties it gives you. Most cryptography questions are answered by knowing whether the scenario needs confidentiality, integrity, or authenticity.
Cryptography Basics · firsttry.app/cheatsheets/cryptography-basics · original reference written from published exam objectives. Not affiliated with any certification body.
What each property needs
| You need | Use | Example |
|---|---|---|
| Confidentiality | Encryption | AES for data, TLS for traffic |
| Integrity | Hashing | SHA-256 checksum on a download |
| Authenticity | Digital signature | Sign with a private key, verify with the public one |
| Integrity and authenticity | HMAC or a signature | HMAC-SHA256 on an API request |
| Non-repudiation | Digital signature | The signer cannot deny signing |
| Key exchange over an untrusted link | Asymmetric or Diffie-Hellman | TLS handshake |
Symmetric algorithms
| Algorithm | Type | Key size | Status |
|---|---|---|---|
| AES | Block, 128-bit blocks | 128 / 192 / 256 | Current standard |
| ChaCha20 | Stream | 256 | Current, common on mobile |
| 3DES | Block | 168 effective | Deprecated |
| DES | Block | 56 | Broken, do not use |
| RC4 | Stream | 40 to 2048 | Broken, do not use |
| Blowfish / Twofish | Block | Up to 448 / 256 | Legacy, largely replaced by AES |
Asymmetric and hashing
| Algorithm | Purpose | Notes |
|---|---|---|
| RSA | Key exchange, signatures | 2048-bit minimum, 3072 preferred |
| ECDSA | Signatures | 256-bit ECC is roughly 3072-bit RSA |
| ECDH | Key exchange | Elliptic curve Diffie-Hellman |
| Diffie-Hellman | Key exchange | Does not authenticate on its own |
| SHA-256 / SHA-3 | Hashing | Current standards |
| SHA-1 | Hashing | Collision attacks demonstrated, deprecated |
| MD5 | Hashing | Broken, non-security checksums only |
| bcrypt / scrypt / Argon2 | Password storage | Deliberately slow, salted |
| PBKDF2 | Key derivation | Iteration count is the work factor |
PKI components
| Component | What it does |
|---|---|
| Certificate Authority (CA) | Issues and signs certificates |
| Registration Authority (RA) | Verifies identity before the CA issues |
| Root CA | Top of the chain, kept offline |
| Intermediate CA | Signs end-entity certificates so the root stays offline |
| CSR | The request sent to a CA, carries the public key |
| CRL | Published list of revoked certificates |
| OCSP | Live revocation check for one certificate |
| OCSP stapling | The server presents its own fresh OCSP response |
| Key escrow | A third party holds a copy of the private key |
| Wildcard certificate | Covers one level of subdomain, *.example.com |
| SAN certificate | Covers several named hosts on one certificate |
| Self-signed certificate | No third-party trust, fine internally |
Try it here
Three verified practice questions on this material. Answer one, and see the official page behind the answer.
4-1Security Operations
What is the minimum amount of entropy a session identifier should contain to resist brute-force guessing attacks?
Describe capabilities of Microsoft Entra
A help desk spends much of each Monday unlocking accounts and resetting forgotten passwords. Which Microsoft Entra feature lets users fix this themselves?
Security Assessment and Testing
How many phases does the Penetration Testing Execution Standard define?
Five free questions on every practice exam. No account, no card.