Security+ Domain: Cryptography & PKI

Cryptography is how we protect the confidentiality, integrity and authenticity of information, and Public Key Infrastructure (PKI) is the system of certificates and trust that makes it usable at internet scale. This is one of the most conceptual Security+ domains, so we will build it up from first principles and then see it working end to end in the interactive explainer below.

Beginner: the three jobs of cryptography

Every cryptographic tool serves one of three goals:

• Confidentiality — encryption keeps data secret from anyone without the key.
• Integrity — hashing proves data has not been changed.
• Authenticity & non-repudiation — digital signatures prove who created something, and stop them denying it later.

If you can map any exam scenario to one of these three goals, you can usually pick the right control.

Intermediate: the building blocks

Symmetric encryption

One shared secret key encrypts and decrypts. It is fast, so it is used for bulk data. The standard is AES (128/256-bit). The challenge is key distribution — how do two parties agree a shared key securely?

Asymmetric encryption

A mathematically linked public/private key pair. Anything encrypted with the public key can only be decrypted with the private key, and vice versa. It is slower, so it is used to exchange keys and to sign. Common algorithms: RSA and ECC (elliptic curve, smaller keys for the same strength).

Hashing

A one-way function (e.g. SHA-256) that turns any input into a fixed-length fingerprint. You cannot reverse it. Used to verify integrity and to store passwords — always with a unique salt to defeat rainbow tables, and a slow algorithm (bcrypt, Argon2) to slow brute force.

Digital signatures

Hash the message, then encrypt the hash with your private key. Anyone can verify it using your public key: if the hash matches, the message is authentic and unaltered.

Advanced considerations

Real protocols combine these primitives. TLS uses asymmetric cryptography to agree a symmetric session key, then switches to fast symmetric encryption for the actual data. Modern configurations use perfect forward secrecy so that compromising one session key cannot decrypt past traffic. Weak or broken algorithms — MD5, SHA-1, DES, RC4 — must be retired. You should also understand key length, key rotation, and where keys are stored (ideally a hardware security module, HSM).

Interactive explainer: how certificate trust works

The single most important applied concept in this domain is how your browser decides to trust a website and set up an encrypted connection. Explore each step:

Practical example

When you visit https:// a site, the server presents a certificate signed by a Certificate Authority (CA) your browser already trusts. The browser verifies the signature, checks the certificate is not expired, matches the domain and has not been revoked (via CRL/OCSP), then negotiates a symmetric session key. From that point every request is encrypted — fast and confidential.

Common mistakes

• Confusing encryption (reversible, for secrecy) with hashing (one-way, for integrity).
• Believing hashing can be reversed, or storing passwords hashed without a salt.
• Treating a self-signed certificate as equally trustworthy as a CA-signed one.
• Letting certificates expire and cause outages, or using deprecated algorithms.

Best practices

Use strong, current algorithms (AES-256, SHA-256, RSA-2048+/ECC); salt and slow-hash passwords; protect and rotate private keys; automate the certificate lifecycle; and prefer configurations with perfect forward secrecy.

What employers expect

You can explain, in plain English, when to use symmetric vs asymmetric encryption, what a digital signature proves, and how certificate trust works — and you know which algorithms are no longer safe.

Technical interview questions

1. What is the difference between encryption and hashing?
2. Why does TLS use both symmetric and asymmetric encryption?
3. What does a digital signature prove, and how is it created and verified?
4. Walk me through how a browser decides to trust a website's certificate.
5. How would you securely store user passwords?

Behavioural interview questions

1. Describe a time you had to explain a complex technical concept to a non-technical audience.
2. Tell me about a time you responded to an expired-certificate or crypto-related outage.

Practice questions

1. Which provides integrity but not confidentiality? (Hashing)
2. Which key signs a message for non-repudiation? (The sender's private key)
3. Which mechanisms check whether a certificate has been revoked? (CRL / OCSP)
4. Which symmetric algorithm is the current standard? (AES)

Cryptography underpins Identity & Access Management (protecting credentials and tokens) and Secure Architecture & Cloud (encryption in transit and at rest) — study them together.

Where this fits in your Security+ pathway

This domain is one part of the CompTIA Security+ study hub. When you're confident here, review Threats, Attacks & Vulnerabilities and move on to Identity & Access Management to keep building toward the full exam.

Practise with Missiora

• AI Interview™ — rehearse Security+ style questions on this topic and get scored feedback.
• Career Coach™ — turn this knowledge into a study-to-job plan.
• Job Intelligence™ — see which of these skills real security adverts demand.