CISSP Cryptography: Complete Study Guide

Cryptography transforms plaintext into ciphertext using mathematical algorithms and keys. The CISSP exam covers two main categories: symmetric and asymmetric encryption.

Symmetric Encryption

Symmetric encryption uses one shared key for both encryption and decryption. This makes it fast and efficient for protecting large amounts of data.

• AES (Advanced Encryption Standard) is the gold standard with 128, 192, or 256-bit key lengths
• Operates on 128-bit data blocks
• 3DES (Triple Data Encryption Standard) uses three DES operations but is becoming obsolete
• Stream ciphers like RC4 encrypt one byte at a time
• Block ciphers like AES encrypt fixed-size blocks

Asymmetric Encryption

Asymmetric encryption uses a public-private key pair. The public key encrypts, and the private key decrypts. This solves the key distribution problem that symmetric encryption creates.

• RSA is the most widely used algorithm for key exchange and digital signatures
• Elliptic Curve Cryptography (ECC) provides equivalent security with smaller key sizes
• ECC is increasingly popular for mobile and resource-constrained environments

Hash Functions

Hash functions produce fixed-length digests from variable-length input. They're essential for integrity verification and digital signatures.

• SHA-256 and SHA-3 are cryptographically secure
• MD5 and SHA-1 are broken and should never be used
• Hash functions are one-way (you cannot reverse them)

Choosing the Right Algorithm

Use symmetric encryption for bulk data because it's fast. Use asymmetric encryption for key distribution and authentication. The CISSP exam frequently tests your ability to recognize which algorithm fits specific security objectives.

Key management is arguably the most important aspect of applied cryptography. A strong encryption algorithm fails if keys are poorly managed.

Key Lifecycle Stages

The complete lifecycle includes four essential stages:

1. Key generation using cryptographically secure random number generators
2. Key distribution through secure channels or public key infrastructure
3. Key storage using Hardware Security Modules (HSMs) for tamper-resistant protection
4. Key rotation based on time intervals or data volume encrypted
5. Key destruction ensuring no recovery is possible

Public Key Infrastructure (PKI)

PKI manages digital certificates that bind public keys to identities. Certificate Authorities (CAs) issue and manage these certificates.

• X.509 is the standard certificate format
• Contains the certificate holder's public key, identity information, and CA digital signature
• Certificates expire and must be renewed
• Certificate Revocation Lists (CRLs) or OCSP (Online Certificate Status Protocol) check revocation status

Advanced Key Management Concepts

Key derivation functions create multiple keys from a single master key. Perfect Forward Secrecy (PFS) ensures session keys cannot be recovered even if long-term keys are compromised. Key escrow and key recovery mechanisms allow authorized access to encrypted data, though they create security risks.

Key Management Trade-offs

Understand the security-versus-usability balance. More frequent key rotation enhances security but increases administrative burden. Longer keys provide stronger security but slower performance.

Digital signatures prove who sent a message and that it hasn't been altered. They provide authentication, non-repudiation, and integrity assurance.

How Digital Signatures Work

1. Hash the message
2. Encrypt the hash with the sender's private key
3. The recipient decrypts with the sender's public key
4. Compare the decrypted hash to the hash of the received message
5. If they match, the message is authentic and unchanged

Only the private key holder can create valid signatures, providing non-repudiation. This is a critical CISSP exam concept.

Digital Signature Algorithms

• RSA Digital Signature Algorithm is widely used
• DSA (Digital Signature Algorithm) is another primary method
• ECDSA (Elliptic Curve Digital Signature Algorithm) offers equivalent security with smaller key sizes

Message Authentication Codes (MACs)

MACs like HMAC provide authentication and integrity using symmetric keys. They're faster than digital signatures but require both parties to share a secret key.

• HMAC combines a hash function with a secret key
• Protects against collisions and provides authentication guarantees
• Does not provide non-repudiation because both parties share the key

When to Use Each Method

Use digital signatures when non-repudiation is required. Use MACs for speed when both parties trust each other. Understand that digital signatures solve different problems than encryption. Signatures authenticate and prove integrity. Encryption hides message content.

Block cipher modes determine how algorithms like AES process data larger than a single block. The CISSP exam tests your ability to recognize security implications of each mode.

Common Block Cipher Modes

• ECB (Electronic Codebook) encrypts each block independently. Identical plaintext blocks produce identical ciphertext. This is fundamentally weak and must be avoided.
• CBC (Cipher Block Chaining) XORs each plaintext block with the previous ciphertext block before encryption. Requires an unpredictable initialization vector (IV).
• CTR (Counter) mode encrypts a counter value, enabling parallel processing and random access
• GCM (Galois/Counter Mode) provides authenticated encryption, combining encryption with authentication in one operation

Authenticated Encryption

Authenticated encryption is increasingly mandated because it protects both confidentiality and integrity. GCM is the preferred mode for new implementations. Older modes like ECB are fundamentally weak.

Cryptographic Standards and Governance

NIST and other standards bodies provide guidelines on algorithm selection. Standards evolve as computing power increases and vulnerabilities emerge.

• AES is recommended for symmetric encryption
• MD5 and SHA-1 are cryptographically broken
• SHA-256 and SHA-3 are currently secure
• DES is explicitly forbidden

Implementation Vulnerabilities

Algorithmic strength means nothing if implementation is flawed.

• Side-channel attacks exploit timing differences, power consumption, or electromagnetic emissions to recover keys
• IV reuse in CBC mode catastrophically weakens security
• Predictable initialization vectors compromise security even with strong algorithms
• Using symmetric keys as nonces defeats security purposes

Randomness quality in IVs and nonces is critical. Study common implementation pitfalls before exam day.

Mastering CISSP cryptography requires structured study because the subject is mathematically dense. Understand high-level purposes before diving into mathematical details.

Building Your Flashcard Deck

Create cards that organize information strategically:

• Concept cards answer basic questions (What is AES?)
• Application cards test practical use (When do you use AES?)
• Comparison cards address confusion points (RSA versus ECC, MAC versus digital signature)
• Scenario cards present requirements and ask for solutions

Shuffle your deck to test deeper understanding beyond sequential learning.

Focus on Practical Application

The CISSP exam emphasizes practical application over mathematical derivations. Focus on when to use each algorithm and why.

• Study algorithm properties like key size, block size, and use cases
• Practice scenario-based questions that present security requirements
• Group related concepts together to build mental categories
• Review official CISSP study materials alongside flashcards

Recommended Study Schedule

Dedicate 3 to 4 weeks for cryptography study. Study 45 to 60 minutes daily. This domain is prerequisite knowledge for security architecture and network security, so thorough mastery pays dividends.

1. Master high-level concepts first
2. Study symmetric and asymmetric encryption separately
3. Learn key management lifecycle in sequence
4. Focus on when to use each algorithm
5. Take practice exams in realistic exam conditions
6. Create additional flashcards for weak areas

Use spaced repetition with your flashcard app, reviewing difficult cards more frequently.