Cryptography Fundamentals: Encryption, Hashing, and Key Management

What Is Cryptography and Why Does It Matter?

Cryptography is the science of transforming data so that only authorized parties can read it. In security operations, cryptography protects data in transit, data at rest, and the integrity of systems and communications. Three core tools make this possible: symmetric encryption, asymmetric encryption, and hashing. Understanding how each works—and which algorithms are trustworthy today—is essential for every cybersecurity professional.

Symmetric Encryption

Symmetric encryption uses one shared secret key for both encrypting and decrypting data. Because both parties must possess the same key, secure key exchange is the central challenge. The advantage is speed: symmetric algorithms are computationally efficient and well-suited for encrypting large volumes of data.

The current gold-standard symmetric algorithm is AES (Advanced Encryption Standard). AES supports key lengths of 128, 192, and 256 bits. Longer keys provide greater resistance to brute-force attacks; AES-256 is widely recommended for sensitive data. AES replaced the older DES (Data Encryption Standard) and its successor 3DES, both of which are now considered deprecated due to small key sizes or practical attack vulnerabilities.

When using symmetric encryption, the key must be protected at the same level as the data itself. Exposing the key exposes everything it protects.

Asymmetric Encryption

Asymmetric encryption uses a mathematically linked key pair: a public key and a private key. Data encrypted with the public key can only be decrypted with the corresponding private key, and vice versa. This solves the key distribution problem: you can share your public key openly.

Common asymmetric algorithms:

• RSA (Rivest–Shamir–Adleman): One of the oldest and most widely deployed. Key lengths of 2048 bits or higher are currently recommended; 1024-bit RSA is considered weak and deprecated.
• ECC (Elliptic Curve Cryptography): Achieves equivalent security to RSA with much shorter key lengths (for example, a 256-bit ECC key is roughly comparable in strength to a 3072-bit RSA key). ECC is preferred in resource-constrained environments such as mobile devices and IoT.

Asymmetric encryption is slower than symmetric encryption, so in practice the two are combined. A common pattern: asymmetric encryption is used to securely exchange a symmetric session key, and then symmetric encryption handles the bulk data transfer. TLS uses this hybrid approach.

Digital signatures use asymmetric keys in reverse: the sender encrypts a hash of the message with their private key. Any recipient can verify the signature using the sender's public key, confirming both authenticity and integrity.

Hashing

A hash function takes input data of any size and produces a fixed-length output called a digest or hash. Hashing is a one-way operation—you cannot reverse a hash to recover the original data. Hashing does not encrypt data; it verifies integrity.

Properties of a secure hash function:

• Deterministic: The same input always produces the same output.
• Collision-resistant: It should be computationally infeasible to find two different inputs that produce the same hash.
• Avalanche effect: A tiny change in input produces a completely different hash.

Common hash algorithms:

• SHA-256 (Secure Hash Algorithm 256-bit): Part of the SHA-2 family, widely used and currently considered secure. Output is 256 bits.
• SHA-3: A newer family providing an alternative design to SHA-2; also considered secure.
• MD5 (Message Digest 5): Produces a 128-bit digest. MD5 is deprecated for security purposes because practical collision attacks have been demonstrated. It may still appear in non-security contexts such as file checksums for error detection, but it must not be used for authentication or digital signatures.
• SHA-1: Also deprecated; collision attacks have been demonstrated.

Hashing is used in password storage (combined with a salt—a random value added before hashing to prevent rainbow table attacks), file integrity verification, digital signatures, and certificate validation.

Key Management

Strong algorithms mean nothing if keys are poorly managed. NIST SP 800-57 provides the authoritative guidance on key management. Key practices include:

• Key generation: Use cryptographically secure random number generators. Key length must meet current recommendations.
• Key storage: Keys must be stored in protected locations—hardware security modules (HSMs) are the preferred solution for high-value keys. Keys must never be stored in plaintext alongside the data they protect.
• Key rotation: Keys should be changed on a defined schedule or after a security event. Regular rotation limits the damage if a key is compromised.
• Key expiration and revocation: Keys have defined lifetimes. Compromised or expired keys must be revoked promptly. Certificate revocation lists (CRLs) and the Online Certificate Status Protocol (OCSP) support this for public-key certificates.
• Key escrow: A copy of the key is held by a trusted third party or organizational authority so data can be recovered if the key owner is unavailable. Escrow itself must be secured as tightly as the original key.
• Key destruction: At end-of-life, keys must be securely destroyed so they cannot be recovered.

Safety and Professional Responsibility

In cybersecurity, "safety" extends to protecting systems and data that real people depend on. Using deprecated algorithms, storing keys carelessly, or skipping rotation schedules creates organizational risk and potential legal liability. Always verify that algorithm choices align with current NIST guidance and organizational policy before deploying any cryptographic solution.