Security+ — Part 3: Encryption Overview & Public Key Infrastructure
Welcome Back!
Encryption is one of those topics where knowing the concept isn’t enough — you need to understand why each method exists and when to use which one. Symmetric encryption is fast but has a key distribution problem. Asymmetric encryption solves that but at a cost. PKI ties it all together. Once you see how they connect, a lot of things — HTTPS, secure email, digital signatures — start making sense.
This is Part 3 of the Security+ series. Full notes on GitHub.
What Is Encryption?
Encryption transforms readable data (plaintext) into unreadable data (ciphertext) using an algorithm and a key. Only someone with the right key can reverse the process.
- Plaintext — original, readable data
- Ciphertext — encrypted, unreadable output
- Algorithm — the mathematical formula (e.g., AES, RSA)
- Key — the secret used to encrypt and decrypt
Symmetric Encryption
One key does both the encrypting and decrypting. Both parties need to have the same key.
| Feature | Description |
|---|---|
| Key use | Same key on both ends |
| Speed | Fast and efficient |
| Drawback | Key distribution is a challenge — how do you securely share the key in the first place? |
Common algorithms: AES (current standard), DES and 3DES (deprecated), Blowfish, Twofish
Symmetric encryption is what gets used for bulk data encryption — encrypting files, disk drives, database records. It’s fast enough to handle large volumes.
Asymmetric Encryption
Two mathematically linked keys — a public key and a private key. What one encrypts, only the other can decrypt.
| Feature | Description |
|---|---|
| Public key | Shared openly, used to encrypt |
| Private key | Kept secret, used to decrypt |
| Reversible use | Also supports digital signatures (sign with private, verify with public) |
Use cases: Secure email (PGP), SSL/TLS (HTTPS), digital signatures
Asymmetric encryption solves the key distribution problem — you can share your public key with anyone without risk. But it’s slower, so in practice TLS uses asymmetric encryption to exchange a symmetric key, then switches to symmetric for the actual data transfer.
Public Key Infrastructure (PKI)
PKI is the system that manages trust — it’s how your browser knows a website’s certificate is legitimate and not faked.
Key Components
- CA (Certificate Authority) — the trusted entity that issues digital certificates
- RA (Registration Authority) — verifies identities before the CA issues a cert
- CSR (Certificate Signing Request) — what you send to the CA to request a certificate
- CRL / OCSP — ways to check if a certificate has been revoked
- Digital certificate — binds an identity (domain, organization) to a public key
Encryption in Practice
| Scenario | Method |
|---|---|
| Encrypting a file for storage | Symmetric (AES) |
| Sending secure email | Asymmetric (RSA + PGP) |
| Authenticating a server over HTTPS | PKI and digital certificate |
If you want to see how encryption requirements show up in compliance frameworks, the SOC 2 & NIST CSF Part 2 covers cryptographic controls and key management requirements in detail.
Part 4 covers threat actors and attack vectors
Stay Curious!