Cryptography is one of the foundations of modern cybersecurity.
Whenever you log in to a website, send an HTTPS request, connect to a VPN, authenticate to a cloud service, or verify that software hasn't been modified, cryptography is usually involved somewhere in the process.
But cryptography is often confusing because several different mechanisms are used together:
- Symmetric encryption
- Asymmetric encryption
- AES
- RSA
- ECC
- Hashing
- SHA-256
- Digital signatures
- Digital certificates
- PKI
- Key exchange
The important thing isn't just understanding each technology individually.
It's understanding why they exist and how they work together.
- What is Cryptography?
Cryptography is the use of mathematical techniques to protect information and establish trust between communicating parties.
At a high level, cryptography helps provide four major security properties:
Confidentiality
Only authorized parties should be able to read the information.
Encryption provides confidentiality.
Integrity
The recipient should be able to determine whether data has been modified.
Hashing and digital signatures can provide integrity verification.
Authentication
A system should be able to verify who created or sent something.
Digital signatures and certificates help establish authentication.
Non-repudiation
A digital signature can provide evidence that a particular private key was used to sign data, subject to the surrounding trust model and key protection.
- Symmetric vs. Asymmetric Encryption
This is one of the most important distinctions in cryptography.
Symmetric encryption
Symmetric cryptography uses the same secret key for encryption and decryption.
Secret Key
|
v
Plaintext ---> [ AES ] ---> Ciphertext
|
v
[ AES ]
|
Secret Key
|
v
Plaintext
``
The major challenge is:
How do both parties securely obtain the secret key?
This is the key-distribution problem.
Symmetric encryption is generally very fast and is therefore suitable for encrypting large amounts of data.
3. AES
AES — Advanced Encryption Standard — is one of the most widely used symmetric encryption algorithms.
AES is commonly used for:
- Data-at-rest encryption
- Database encryption
- File encryption
- VPNs
- TLS connections
- Application-level encryption
AES supports key sizes of:
- 128 bits
- 192 bits
- 256 bits
A simplified example:
`text
Application
|
v
Plaintext
|
v
AES
|
v
Ciphertext
`
The important point is that AES is a symmetric encryption algorithm.
It is not used to solve the key-distribution problem by itself.
That is where asymmetric cryptography and key-exchange mechanisms become important.
4. Asymmetric Cryptography
Asymmetric cryptography uses two mathematically related keys:
- Public key
- Private key
The public key can be shared.
The private key must remain secret.
Conceptually:
`text
Key Pair
|
+---------+---------+
| |
Public Key Private Key
Share it Protect it
`
Asymmetric cryptography is useful for:
- Authentication
- Digital signatures
- Key establishment/exchange
- Secure communication
- Certificates
Two important families are RSA and ECC.
5. RSA
RSA is one of the best-known public-key cryptographic algorithms.
It is based on mathematical properties involving very large integers and the difficulty of certain number-theoretic problems.
Historically, RSA has been used for:
- Encryption
- Digital signatures
- Key transport
However, RSA requires relatively large key sizes compared with elliptic-curve systems providing comparable security.
Modern protocols therefore often favor elliptic-curve cryptography and newer key-exchange/signature algorithms depending on the use case.
The key lesson:
RSA is asymmetric cryptography; AES is symmetric cryptography.
They solve different problems.
6. ECC — Elliptic Curve Cryptography
ECC uses mathematical structures based on elliptic curves over finite fields.
Its major practical advantage is that it can provide strong security using smaller keys than RSA.
This makes ECC attractive for:
- TLS
- Mobile devices
- Embedded systems
- Cloud services
- Modern authentication systems
Conceptually:
`text
RSA
Large key size
|
v
Strong security
ECC
Smaller key size
|
v
Strong security
`
ECC isn't simply "better RSA."
It is a different family of public-key cryptography with different algorithms and implementation considerations.
7. Hashing
Hashing is frequently confused with encryption.
They are fundamentally different.
A cryptographic hash function takes input data and produces a fixed-length output.
`text
Input
|
v
Hash Function
|
v
Fixed-length Hash
`
For example:
`text
"Hello"
|
v
SHA-256
|
v
256-bit digest
`
A secure cryptographic hash is designed to make it computationally infeasible to reconstruct the original input from the digest.
Therefore:
Hashing is not encryption.
8. SHA-256
SHA-256 is a member of the SHA-2 family of cryptographic hash functions.
It produces a 256-bit message digest.
Hashing is commonly used for:
- Integrity verification
- Digital signatures
- Certificates
- Content addressing
- Software/package verification
- Security protocols
For example:
`text
File
|
v
SHA-256
|
v
Digest
`
If the file changes, its digest should change.
This allows a system to detect modification.
Important password-security distinction
You should not treat plain SHA-256 as a password-storage solution.
Passwords should generally be processed with a dedicated password-hashing/key-derivation algorithm such as Argon2id, scrypt, or bcrypt, with appropriate salts and parameters.
9. Encryption vs Hashing
This distinction is essential.
| Property | Encryption | Hashing |
|---|---|---|
| Primary purpose | Confidentiality | Integrity / fingerprinting |
| Reversible? | Yes, with the appropriate key | Designed to be one-way |
| Uses key? | Yes | Cryptographic hashes don't require an encryption key |
| Output | Ciphertext | Digest |
| Example | AES | SHA-256 |
| Typical use | Protect data | Verify data |
Think of it this way:
Encryption:
`text
Plaintext → Encryption → Ciphertext
Ciphertext → Decryption → Plaintext
`
Hashing:
`text
Data → Hash → Digest
`
You don't normally "decrypt" a SHA-256 hash.
10. Digital Signatures
Digital signatures provide a way to verify:
- Who signed the data
- Whether the data was modified
- Whether the signature corresponds to the claimed public key
A simplified signing process:
`text
Message
|
v
Hash
|
v
Sign with
Private Key
|
v
Digital Signature
`
The recipient can then use the corresponding public key to verify the signature.
Conceptually:
`text
Message + Signature + Public Key
|
v
Verify
|
+------+------+
| |
Valid Invalid
`
Digital signatures are therefore different from encryption.
Encryption protects confidentiality.
Digital signatures provide authenticity and integrity.
11. Digital Certificates
Now we have another problem.
Suppose I receive a public key.
How do I know that the public key actually belongs to the server or organization I intended to communicate with?
This is where certificates come in.
A digital certificate binds information about an identity to a public key.
A simplified model:
`text
Identity
+
Public Key
+
Certificate Information
|
v
Digital Certificate
`
For example, when you connect to an HTTPS website, your browser can validate the website's certificate and determine whether the certificate chains to a trusted Certificate Authority.
12. PKI — Public Key Infrastructure
PKI is the broader ecosystem used to establish and manage trust around public keys and certificates.
It can include:
- Public/private keys
- Digital certificates
- Certificate Authorities (CAs)
- Certificate issuance
- Certificate validation
- Certificate revocation
- Certificate lifecycle management
- Trust stores
- Policies and procedures
A simplified PKI model:
`text
Root CA
|
v
Intermediate CA
|
v
Server Certificate
|
v
Server
`
Your browser or operating system maintains trusted CA information.
The certificate chain allows the system to establish whether a presented certificate is anchored in a trusted authority.
13. Key Exchange
Symmetric encryption is fast.
But it has a problem:
How do two parties establish a shared secret over an untrusted network?
Key-exchange mechanisms address this problem.
A simplified model:
`text
Client Server
| |
| ---- Key Exchange ---------->|
| |
|<--- Key Exchange ------------|
| |
| Shared Secret |
|<============================>|
| |
| AES Encryption |
|<============================>|
`
The parties establish cryptographic material that can be used to derive shared symmetric keys.
This allows the system to use the performance of symmetric encryption while avoiding the need to send the secret key directly across the network.
Modern TLS commonly uses ephemeral Diffie-Hellman mechanisms such as ECDHE for key agreement.
14. How These Technologies Work Together
This is the part that is most important for a cybersecurity engineer.
Consider HTTPS.
It isn't simply:
"HTTPS = encryption."
A secure TLS connection involves several cryptographic mechanisms working together.
A simplified conceptual flow is:
`text
HTTPS / TLS
|
+------------+-------------+
| |
Certificate Key Exchange
| |
v v
Verify Server Establish Shared
Identity Secret
| |
+------------+-------------+
|
v
Symmetric Keys
|
v
AES
|
v
Encrypted Traffic
`
Hash functions and digital signatures also play important roles in the protocol and authentication process.
The architecture is therefore not:
`text
HTTPS = AES
`
It is closer to:
`text
Certificates
+
Authentication
+
Key Agreement
+
Cryptographic Verification
+
Symmetric Encryption
=
Secure TLS Channel
`
The exact algorithms depend on the TLS version and negotiated cipher suite.
15. A Practical Example
Imagine you connect to:
`text
https://example.com
`
A simplified conceptual sequence is:
Step 1 — Server presents a certificate
The server provides its certificate containing its public-key information and identity information.
Step 2 — Client validates the certificate
The client checks things such as:
- Certificate chain
- Trusted CA
- Validity period
- Hostname
- Certificate status, depending on the validation mechanism
Step 3 — Key agreement occurs
The client and server perform a key-agreement process.
Step 4 — Symmetric session keys are established
The connection now has symmetric cryptographic keys.
Step 5 — Application traffic is protected
The traffic can now be protected efficiently using symmetric authenticated encryption.
This is why modern secure communications don't normally use RSA to encrypt every byte of your HTTPS traffic.
16. The Mental Model to Remember
If you're preparing for a cybersecurity or security-architecture role, remember this:
`text
CRYPTOGRAPHY
|
+----------------+----------------+
| |
Confidentiality Trust & Integrity
| |
Symmetric Encryption Hashing
| Digital Signatures
AES |
| Certificates
| |
| PKI
|
Key Establishment
|
Asymmetric Crypto
|
RSA / ECC
`
And remember the core differences:
AES
Symmetric encryption
Used primarily for efficiently protecting data.
RSA
Asymmetric cryptography
Used historically for encryption and signatures, with modern deployments increasingly favoring other schemes for particular purposes.
ECC
Public-key cryptography
Provides strong security with relatively small keys and underpins several modern cryptographic algorithms.
SHA-256
Cryptographic hash
Used for producing a fixed-length digest for integrity and other cryptographic purposes.
Digital Signature
Authentication + integrity
Uses a private key to sign and a public key to verify.
Certificate
Identity ↔ public key binding
Helps establish that a public key belongs to the claimed identity.
PKI
Trust infrastructure
Manages certificates, CAs, keys, validation and lifecycle processes.
Key Exchange
Establishes shared cryptographic secrets
Allows parties to derive symmetric session keys without simply transmitting the secret key.
17. What a Cybersecurity Engineer Should Be Able to Explain
You don't necessarily need to become a cryptographer.
But you should be able to answer questions such as:
- Why is AES faster than RSA?
- Why can't hashing replace encryption?
- Why is SHA-256 not suitable as a password-storage algorithm by itself?
- What is the difference between encryption and digital signatures?
- Why do HTTPS connections use certificates?
- What problem does PKI solve?
- What is the purpose of key exchange?
- What is the difference between RSA and ECC?
- Why are smaller ECC keys useful?
- What happens when a certificate expires?
- What happens when a private key is compromised?
- How does a browser decide whether to trust a certificate?
- Why is symmetric encryption used for bulk traffic?
- Where do hashing and digital signatures fit into TLS?
If you can explain those concepts and how they fit together in a real architecture, you have moved beyond memorizing cryptography terminology and started thinking like a security engineer.
Final takeaway
Cryptography is not one technology.
It is a collection of mechanisms that solve different security problems:
AES → protect data efficiently
RSA/ECC → public-key cryptography
SHA-256 → create cryptographic digests
Digital signatures → authenticate and verify integrity
Certificates → associate identities with public keys
PKI → establish and manage trust
Key exchange → establish shared secrets
The real skill is understanding when to use which mechanism—and how they work together in systems such as TLS, VPNs, cloud security, identity systems, and application security.
Top comments (0)