Security+ Cryptography Cheat Sheet: Algorithms, Hashing, PKI, TLS and IPsec
Reach 50,000+ security professionals
Sponsor a newsletter slot and put your brand in front of CISOs, engineers, and IT decision-makers.
Most Security+ cryptography questions ask you to pick the right tool for a goal or to tell two similar ideas apart. This cheat sheet covers symmetric and asymmetric algorithms, hashing, which key does what, PKI and certificates, TLS and IPsec, password salting and key stretching, and the traps that catch people. The algorithm facts follow NIST and IETF standards. These are our own study summaries of standard facts, not CompTIA's lists. The official CompTIA objectives document remains the authority for what is tested.
How to Use This Cheat Sheet
Cryptography questions usually ask you to pick the right tool for a goal, or to tell two similar ideas apart. These are our own study summaries of standard facts, not CompTIA's lists. The official CompTIA objectives document remains the authority for what is tested.
Symmetric Encryption
Symmetric encryption uses one shared key to encrypt and decrypt. It is fast, so it protects bulk data such as disks and VPN tunnels. The hard part is sharing the key safely.
| Algorithm | Type | Key or output size | Status |
|---|---|---|---|
| AES | Symmetric block cipher | 128-bit block, 128, 192 or 256-bit key | Current standard (NIST FIPS 197) |
| ChaCha20 | Symmetric stream cipher | 256-bit key | Modern, used in TLS 1.3 |
| 3DES | Symmetric block cipher | Up to 168-bit key (112 bits effective) | Deprecated |
| DES | Symmetric block cipher | 56-bit key | Broken, do not use |
| RC4 | Symmetric stream cipher | Variable | Broken, do not use |
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
Asymmetric Encryption
Asymmetric cryptography uses a key pair: a public key anyone can have and a private key the owner keeps. It is slower, so it is used for key exchange, digital signatures and certificates.
| Algorithm | Used for | Notes |
|---|---|---|
| RSA | Encryption, digital signatures, key exchange | Typically 2048-bit or larger keys |
| ECC (ECDSA, ECDH) | Signatures and key exchange | Smaller keys for similar strength, good for mobile and IoT |
| Diffie-Hellman (DH, ECDH) | Key exchange only | Two parties agree on a shared secret over an untrusted channel |
| DSA | Digital signatures | Older signature algorithm |
Hashing
A hash turns data into a fixed-size digest. It is one-way, so you cannot recover the data from the hash, and a good hash makes collisions impractical.
| Hash | Output size | Status |
|---|---|---|
| MD5 | 128 bits | Collisions are practical, do not use for security |
| SHA-1 | 160 bits | Deprecated for most security uses |
| SHA-256 (SHA-2) | 256 bits | Widely used, current |
| SHA-512 (SHA-2) | 512 bits | Current |
| SHA-3 | 224 to 512 bits | Current, different design from SHA-2 |
SHA-2 and SHA-3 are specified by NIST. Hashing is not encryption: there is no key and no way to decrypt.
Which Tool for Which Goal
| Goal | Tool | Remember |
|---|---|---|
| Confidentiality of bulk data | Symmetric encryption (AES) | Fast, but the key must be shared securely |
| Secure key exchange | Asymmetric or Diffie-Hellman | Slower, so it sets up a symmetric session key |
| Integrity | Hash, HMAC | A hash alone does not prove who made it |
| Authentication and non-repudiation of a message | Digital signature | Sender's private key signs, sender's public key verifies |
| Encrypt to a recipient | Recipient's public key | Recipient's private key decrypts |
| Protect stored passwords | Salted, slow hash (bcrypt, PBKDF2, scrypt, Argon2) | Unique salt per password, plus key stretching |
Digital Signatures and Certificates
A digital signature is made by hashing a message and signing the hash with the sender's private key. Anyone can verify it with the sender's public key, which proves integrity, authentication and non-repudiation.
Public key infrastructure (PKI) ties public keys to identities through certificates issued by a certificate authority (CA).
Chain of trust
A server certificate is signed by an intermediate CA, which is signed by a root CA that clients already trust.
CSR
A certificate signing request carries your public key and identity details to the CA.
Revocation
A certificate revocation list (CRL) or the Online Certificate Status Protocol (OCSP) tells clients whether a certificate was revoked before it expired.
Wildcard and SAN certificates
A wildcard certificate covers one level of subdomains, such as *.example.com. A subject alternative name (SAN) certificate lists several names.
Self-signed certificates
Signed by the same entity that uses them, so clients do not trust them by default.
TLS and IPsec
TLS protects data in transit for HTTPS and other protocols. Use TLS 1.2 or 1.3. SSL and early TLS versions are deprecated. TLS 1.3, defined in RFC 8446, removes legacy features and uses forward-secret key exchange.
Perfect forward secrecy means each session uses its own ephemeral key, so a later compromise of a long-term key does not expose past sessions.
| IPsec component | Purpose |
|---|---|
| AH (Authentication Header) | Integrity and authentication, no encryption |
| ESP (Encapsulating Security Payload) | Confidentiality plus integrity and authentication |
| Transport mode | Protects the payload between two hosts |
| Tunnel mode | Protects the whole original packet, used for site-to-site VPNs |
| IKE | Negotiates keys and security associations |
Passwords, Salting and Key Stretching
Never store passwords as plain text or with a fast unsalted hash. A salt is a unique random value added to each password before hashing, which defeats precomputed rainbow tables. Key stretching, using algorithms such as PBKDF2, bcrypt, scrypt or Argon2, makes each guess deliberately slow, which hurts offline brute-force attacks.
Common Exam Traps
These four mix-ups cause most missed cryptography questions.
Encryption versus hashing
Encryption is reversible with a key. Hashing is one-way. A question that asks for integrity usually wants a hash or HMAC, not encryption.
Which key does what
To encrypt for someone, use their public key. To sign, use your private key. To verify a signature, use the signer's public key.
Symmetric versus asymmetric speed
Symmetric is much faster, which is why TLS uses asymmetric methods to agree on a symmetric session key.
ECB mode
Electronic codebook mode encrypts identical blocks identically and leaks patterns. Authenticated modes such as GCM are preferred.
Looking Ahead: Post-Quantum Cryptography
Large quantum computers could break RSA and elliptic-curve cryptography. NIST has published post-quantum standards, including FIPS 203 (ML-KEM) for key establishment. This is background for exam awareness and for planning real migrations. For study, see our objectives explained for where cryptography sits in Domain 1, and our practice questions to test yourself.
The bottom line
Know which key does what, remember that hashing is not encryption, match each goal to its tool, and learn the deprecated algorithms to avoid. Then practice with scenario questions that describe a need and ask for the right control.
Frequently asked questions
What is the difference between symmetric and asymmetric encryption?
Symmetric encryption uses one shared key for both encrypting and decrypting and is fast. Asymmetric encryption uses a public and private key pair and is slower, so it is mostly used for key exchange, signatures and certificates.
Which key do I use to digitally sign a message?
You sign with your own private key, and anyone verifies the signature with your public key. This provides integrity, authentication and non-repudiation.
Is hashing the same as encryption?
No. Encryption is reversible with the right key. Hashing is one-way and has no key, so you cannot recover the original data from the digest. Hashes are used for integrity and password storage.
What is salting?
Salting adds a unique random value to each password before hashing. It makes identical passwords produce different hashes and defeats precomputed rainbow table attacks.
What is perfect forward secrecy?
Perfect forward secrecy means each session uses a unique ephemeral key, so compromising a long-term key later does not let an attacker decrypt past sessions. TLS 1.3 requires forward-secret key exchange.
Which hash algorithms should I avoid?
MD5 and SHA-1 should not be used for security purposes because practical collision attacks exist or are considered too weak. Use SHA-256 or stronger from the SHA-2 or SHA-3 families.
Is AES symmetric or asymmetric?
AES is a symmetric block cipher standardized by NIST in FIPS 197. It supports 128, 192 and 256-bit keys and is the most widely used symmetric algorithm.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Daily briefings + Google Top Stories in one step.
Enter your email and we'll subscribe you to the daily briefing and add Decryption Digest to your Google Search feed at the same time.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.
