Cryptography and Key Management

The drive that was lost and found

Somewhere between the security desk and the gate, the drive slipped out of the laptop bag. Nobody noticed until the airport, and by then the drive, carrying the quarterly payroll extracts for three thousand employees, was in the hands of whoever found it in the taxi. The story that followed went one of two ways. In the good version, the drive was encrypted with a modern algorithm, the passphrase was long and typed nowhere else, and the finder got nothing but a brick with a blinking light. In the bad version, the encryption was the same real algorithm, but the passphrase was the CEO’s dog’s name, or the unlock key lived in a text file on the same drive, or the drive backed itself up to the cloud in plaintext every night anyway.

The mathematics did not change between the two versions. The outcome did. That is the first lesson of cryptography, and this chapter keeps returning to it: the algorithm is the cheap, certain part of the system, and key management is the expensive, fragile part. A cipher that has survived forty years of public attack will still hand over every byte if the key was chosen by a human with a birthday, stored next to the ciphertext, or reused past its lifetime. The exam knows this. Cryptography questions are far more often about keys, randomness, lifecycle, and judgment than about the internal arithmetic of a cipher, and the candidate who understands why will answer correctly on the ones that are.

The chapter builds in the order the material actually connects. First, what cryptography is for, the four properties it can provide and the one it cannot. Then the three families of primitives: symmetric ciphers, asymmetric ciphers, and hashes, each tied to the public standard that defines it, because the exam expects you to know which standard owns which algorithm. Then the infrastructure that turns a bare key into an identity, the public key infrastructure, and the discipline of the key lifecycle as NIST SP 800-57 frames it. Then the attack surface, including the quantum question, which stopped being hypothetical in 2024. A set of practice questions with rationales closes the chapter, and a one-page reference table ends it.

What cryptography is for

Cryptography is the practice of converting information into a form that can be carried or stored in the open without leaking what it means, using secret parameters called keys. That description sounds modest, but the properties that flow from it are the backbone of modern security: confidentiality, integrity, authentication, and non-repudiation. Every cryptographic mechanism in this chapter exists to provide one or more of those four, and the first skill the exam rewards is naming which property a given mechanism provides and which it does not.

Confidentiality is the property that matters in the lost-drive story: an adversary who obtains the ciphertext cannot recover the plaintext without the key. Confidentiality is the only one of the four that encryption alone provides, and even that comes with conditions. Encryption protects the data in the form it protects: a full-disk encryption tool protects the bytes on the disk, not the copy of the document the user emailed, not the plaintext printout on the desk, and not the decrypted buffer sitting in memory of a process the attacker already controls. The exam’s manager-perspective questions are built on exactly this gap. A DLP rule that catches the plaintext copy is not a substitute for encryption, and encryption is not a substitute for the DLP rule; they protect different versions of the same data.

Integrity is the property that the data is exactly what the sender produced, unmodified by accident or malice. Encryption alone does not provide integrity in any usable sense. An attacker who cannot read an encrypted message can still flip bits in it, and with the older block cipher modes, flipping a bit in the ciphertext reliably flips the corresponding bit in the plaintext after decryption, a property that message authentication was invented to fix. Integrity mechanisms are message authentication codes (MACs) and hashes, discussed later in the chapter, and the modern cipher modes such as GCM bundle confidentiality and integrity into one operation.

Authentication, in the cryptographic sense, is the property that the message came from the party it claims to come from. Symmetric authentication through a shared secret answers “does the holder of our shared key say this?” and asymmetric authentication through digital signatures answers “did the holder of this specific private key produce this?” The third property is frequently confused with integrity on the exam, and the distinction is worth making crisp: integrity says the message was not changed, authentication says who produced it, and a mechanism that proves the second generally proves the first as well, because changing a signed message invalidates the signature.

Non-repudiation is the property that a party cannot deny having performed an action. It is the most socially loaded of the four, because it is the only one that has to survive the signer changing their mind. Technically, a digital signature created with a private key that belongs uniquely to one signer gives strong evidence that the signer’s key produced the signature, and combined with a timestamp it pins the action to a moment. But the technical link only reaches as far as the key protection and the identity binding reach: if the private key was shared, stolen, or stored on a machine with malware, the signature no longer proves the signer acted. Legal non-repudiation is therefore a process property, built from signatures, timestamps, audit trails, and procedures that establish who owned the key, while cryptographic non-repudiation is the mathematical component inside it.

One more goal belongs in this list even though it is not one of the four: confidentiality in transit and at rest is frequently joined by the requirement of availability, and cryptography serves it oddly. An encrypted backup is useless if the key that opens it was destroyed along with the building. Key recovery design, discussed in the lifecycle section, is the control that keeps the property of recoverability, and it is the classic place where a well-meaning “destroy the keys” policy quietly deletes the company.

The ground rules: Kerckhoffs, security strength, and cryptanalysis

Three ideas sit under everything else, and the exam uses all three as answer discriminators.

Kerckhoffs’s principle, stated by the Dutch cryptographer Auguste Kerckhoffs in 1883, is that a cryptosystem must be secure even if everything about the system except the key is public knowledge. Claude Shannon’s 1949 restatement is blunter: the enemy knows the system. The principle is the theoretical spine of open design, the fourth of the design principles in the previous chapter, and it is why modern algorithms are published, standardized, and attacked publicly for years before they are trusted: the secrecy must live entirely in the keys, which can be changed, and never in the algorithm, which once leaked is compromised forever. A “security by obscurity” scheme whose strength depends on the attacker not knowing how it works fails Kerckhoffs by definition, and every exam answer that rests on hiding the mechanism is wrong for that reason.

Security strength is the measure of how hard it is to defeat a mechanism, expressed in bits. A mechanism with n bits of security requires roughly 2 to the n operations for the best known attack to break it. The number is a statement about the algorithm’s math, not about the user: AES-128 has 128 bits of security against key search, meaning a brute force attack needs about 2 to the 128 attempts, a number so large that every machine ever built working in parallel for the age of the universe could not reach it. The confusion the exam exploits is between the key length and the security strength. They are the same number only for some algorithms. A 3-key triple DES key is 168 bits long, but meet-in-the-middle attacks reduce its effective strength to about 112 bits, and that 112 is the number that matters. Similarly, a 256-bit ECC key and a 3072-bit RSA key both land near 128 bits of security, which is why comparing them by key length alone is meaningless.

Cryptanalysis is the craft of breaking ciphers, and its vocabulary shows up in attack scenarios. A ciphertext-only attack gives the attacker nothing but the encrypted output. A known-plaintext attack gives matching plaintext and ciphertext pairs, which is why block ciphers are vulnerable to pattern analysis if the same key is used across many messages. A chosen-plaintext attack lets the attacker pick plaintexts and see their encryptions, which is why feeding untrusted input to an encryption oracle is dangerous. None of these are attacks against the modern algorithms themselves in their proper modes; the attacks in practice land on implementations, randomness, key reuse, and protocol logic, which is where the chapter’s later sections spend their time.

Symmetric encryption: one key, two directions

Symmetric encryption uses a single key for both encryption and decryption. It is fast, compact, and the workhorse of all bulk data protection, from disk encryption to TLS record data, and its one structural weakness is distribution: both sides need the same secret, and getting a secret to a party you have never met is a problem that symmetric cryptography cannot solve by itself. That is why the field is built from two halves, and the asymmetry in the second half exists precisely to solve the first half’s distribution problem.

The symmetric family splits into stream ciphers and block ciphers. A stream cipher encrypts one bit or byte at a time, mixing each unit of plaintext with a generated keystream, and a block cipher processes fixed-size chunks, 64 bits in the older generation and 128 bits in the modern one. In practice the distinction blurs, because block ciphers are run in modes that make them behave like stream ciphers, and the important exam fact is that nearly all modern symmetric cryptography is block cipher cryptography in a mode.

The history matters mainly for the age of the material. DES, the Data Encryption Standard adopted as FIPS 46 in 1977, used a 56-bit key and a 64-bit block, and by the late 1990s a dedicated hardware machine built by the Electronic Frontier Foundation broke a DES key by exhaustive search in about three days. The lesson was not that DES was badly designed, it was that 56 bits is too small, and the interim fix was triple DES, 3DES, which applies DES three times to stretch the effective strength. NIST standardized 3DES in SP 800-67, but its 64-bit block and aging design finally ran out of runway: SP 800-131A Revision 2, the transition standard, deprecated 3DES and set a disallowance date of December 31, 2023, after which it is no longer approved for new use. An exam scenario involving 3DES in a current design should read as a modernization task, not a working control.

The replacement is AES, the Advanced Encryption Standard, standardized in FIPS 197 and chosen in 2000 by a public competition. AES uses a 128-bit block and key sizes of 128, 192, and 256 bits, with 128 bits and 256 bits the ones that appear in practice. The algorithm is named for its key size in the common phrasing: AES-128, AES-192, AES-256. AES-128 already sits far beyond any feasible brute force, and the larger key sizes exist for margin, for classified data, and for quantum headroom rather than because anyone has broken AES-128. FIPS 197 is the standard the exam expects you to name for AES, and SP 800-57 Part 1 provides the guidance on which size fits which security strength target.

The mode of operation is where block ciphers gain their real behavior, and the standards are NIST SP 800-38A for the classic modes and SP 800-38D for GCM. ECB, electronic codebook, encrypts each block independently, which means identical plaintext blocks produce identical ciphertext blocks, and that single property makes it useless for real data. The classic demonstration encrypts a bitmap image in ECB mode and the image’s silhouette is still visible in the ciphertext, because the large uniform areas of the picture encrypt to large uniform areas of output. ECB is the mode the exam always flags as wrong, and the reason is always the same: it leaks patterns. CBC, cipher block chaining, XORs each plaintext block with the previous ciphertext block before encrypting it, so identical blocks produce different output and each ciphertext block depends on everything before it. CBC needs a random initial value, the IV, which must never be reused with the same key. CTR, counter mode, encrypts a running counter instead of the data and XORs the result with the plaintext, turning the block cipher into a stream cipher with random access; its IV, more honestly called a nonce, must also be unique per key. CFB and OFB complete the classic family, both turning the cipher into a keystream generator at the cost of some properties.

The modern workhorse is GCM, Galois/Counter Mode, standardized in SP 800-38D. GCM combines CTR-mode confidentiality with a built-in authentication tag, so one operation provides confidentiality, integrity, and authenticity of the ciphertext, plus authenticity of associated data such as headers that must travel in the clear. That combination, authenticated encryption with associated data, is why GCM is the default choice in TLS 1.3 (RFC 8446), IPsec, and most modern protocols. GCM’s discipline is its one hard rule: the nonce must be unique for every message under the same key. Reusing a GCM nonce with the same key allows an attacker to forge messages and, in the worst case, recover the authentication key itself. The same rule, in simpler form, applies to CTR and CBC: nonce and IV reuse reuses keystream or reintroduces the pattern leak, and both are key-management failures dressed up as algorithm failures.

Asymmetric encryption: two keys, one public

Asymmetric cryptography, public key cryptography, gives each participant a pair of keys: a private key that must never leave its owner and a public key that can be published to the world. The two are mathematical inverses: what one encrypts, the other decrypts, and one cannot be derived from the other in any feasible time. The entire trick rests on one-way functions, operations that are easy to compute and hard to invert: multiplication of two large primes is easy, factoring their product is hard; modular exponentiation is easy, computing the discrete logarithm is hard. The exam does not test the arithmetic. It tests the direction of the keys, which is where nearly every wrong answer lives.

To send a confidential message to a recipient, the sender encrypts with the recipient’s public key, and only the recipient’s private key can decrypt it. To prove authorship, the sender signs with their own private key, and anyone can verify with the sender’s public key. The two operations are exact mirrors, encrypting to someone uses their public key, signing as someone uses your private key, and mixing the two is the most common trap in the question bank. A message encrypted with the sender’s own private key is not confidential to the recipient, because anyone with the public key can read it; it is merely authenticated, and that is the only legitimate meaning of the phrase “encrypted with my private key.”

RSA, invented by Rivest, Shamir, and Adleman in 1977 and the oldest survivor of the modern era, provides both encryption and signatures and derives its strength from the difficulty of factoring large numbers. Diffie-Hellman, invented by Whitfield Diffie and Martin Hellman in 1976, solves the distribution problem directly: it is a key agreement protocol in which two parties exchange public values over an open channel and each derives the same shared secret, which they then use as a symmetric key. Diffie-Hellman on its own authenticates nothing; it prevents an eavesdropper from learning the secret but not an active man-in-the-middle from impersonating both sides, which is why real protocols bind the exchange to authenticated identities. Elliptic curve cryptography, ECC, re-implements the same families on the mathematics of elliptic curves, where the discrete logarithm problem is much harder per bit, so much smaller keys deliver the same security: the Diffie-Hellman variant is ECDH, the signature variant is ECDSA, and the modern signatures EdDSA and Ed25519 live in the same family. SP 800-57 Part 1 Revision 5 gives the comparable-strength table that the exam draws from: AES-128, a 256-bit ECC key, and a 3072-bit RSA key all sit near 128 bits of security, and the 2048-bit RSA still common in the field provides roughly 112 bits, classified as legacy strength with a sunset outlook for new deployments.

The performance gap between the two families is what defines real architectures. Asymmetric operations are hundreds of times slower than symmetric ones and consume more power, so no sane system encrypts a bulk payload with RSA. Instead, hybrid systems use asymmetric cryptography for the key exchange and symmetric cryptography for the data: TLS, for example, uses an ephemeral key exchange such as ECDHE to agree on a session key and AES-GCM for the records. Ephemeral here means a fresh key is generated for every session and discarded after it, and that property, forward secrecy, is the reason the exam treats ephemeral key exchange as a requirement rather than an option: if a server’s long-term private key leaks later, an attacker who recorded old sessions still cannot decrypt them, because the session keys that protected them no longer exist. The contrast is static RSA key exchange, where a leaked server key decrypts every recorded session retroactively.

Hashing and message authentication

A cryptographic hash function takes an input of any length and produces a fixed-size digest, and its usefulness comes entirely from three properties. It is one-way: given a digest, finding any input that produces it, the preimage problem, must be computationally infeasible. It is second-preimage resistant: given an input, finding a different input with the same digest must be infeasible. And it is collision resistant: finding any two distinct inputs with the same digest must be infeasible. These properties make the digest a fingerprint: two inputs with equal digests are, for every practical purpose, the same data.

The collision property carries a math tax that the exam loves. The birthday paradox says that finding any collision in an n-bit hash takes only about 2 to the n/2 operations (the birthday bound), not 2 to the n, so a hash’s collision resistance is only half its output size: SHA-256’s 256-bit output resists collisions to roughly 128 bits, and SHA-384 resists to 192. That is why the hash must be chosen with the future in mind and why the broken hashes are broken at exactly this boundary. MD5, 128 bits, had practical collisions demonstrated in 2004 by Wang and colleagues, and NIST’s SP 800-131A Revision 2 lists it as disallowed for every use the standard governs. SHA-1, 160 bits, resisted for longer, but in 2017 a team from Google and CWI published a real chosen-prefix collision, the SHAttered attack, and by then NIST had already deprecated SHA-1 in SP 800-131A and disallowed it for generating new digital signatures after 2013. The current family is SHA-2, defined in FIPS 180-4, the six variants from SHA-224 through SHA-512 and the two truncated forms SHA-512/224 and SHA-512/256, and SHA-3, defined in FIPS 202, the 2015 standard built on the Keccak sponge construction and deliberately different in structure so that a cryptanalytic breakthrough against one family does not kill both. For the exam, SHA-2 and SHA-3 are current, SHA-1 is deprecated for signature use and legacy at best, MD5 is broken, and any new design that names MD5 or SHA-1 should be treated as a finding.

A hash alone proves integrity against accidental corruption but not against deliberate attack, because the attacker who can modify the message can also recompute its hash. The fix is to key the hash, and the standard construction is HMAC, the Hash-based Message Authentication Code defined in FIPS 198-1. HMAC mixes a shared secret key into the hashing process and produces a MAC that only someone holding the key can compute or verify, so it provides integrity and authenticity together: a receiver who computes the same MAC over the received message with the shared key knows the message is untouched and came from a key holder. HMAC is not a signature: it proves “the holder of our shared secret produced this” and provides no non-repudiation, because both sides hold the same secret and either one could have produced the MAC. The exam distinguishes the two exactly there: HMAC for integrity plus authenticity between parties who share a secret, digital signatures when a third party must be able to verify and the signer must not be able to deny.

The same hashing family powers password storage, and the correct way to store passwords is the single most recycled operational scenario in the exam. Plaintext storage is malpractice, and so is a plain hash of the password, because an attacker with the hash file can run dictionary attacks across all the leaks at once, and identical passwords produce identical hashes, which lets the attacker see who shares a password. The fix has two parts. First, a random salt, unique per user, is mixed into the hash so that identical passwords produce different digests and precomputed rainbow tables become useless. Second, the function must be deliberately slow, an iterated or memory-hard key derivation function such as PBKDF2, defined in RFC 8018 and given NIST guidance in SP 800-132, or the newer bcrypt, scrypt, and Argon2, so that each candidate password an attacker tries costs real time and memory. OWASP’s guidance on the subject ranks Argon2id first among password storage algorithms, and NIST SP 800-63B requires verifiers to store memorized secrets as salted, one-way derivations with a work factor tuned to the threat model. The exam answer for any password-at-rest scenario is the same: unique random salt per user, a slow key derivation function, and no storage of the plaintext or of reversible encryption of it.

Digital signatures and non-repudiation

A digital signature is the asymmetric mirror of a MAC. The signer computes a hash of the message, then applies a signing operation with their private key to the digest, producing a signature that anyone with the signer’s public key can verify. Because the signature covers the digest and the digest covers the message, any change to the message breaks the signature, so one mechanism provides integrity, authentication of the signer, and technical non-repudiation at once. The standard family is defined in FIPS 186-5, which retains DSA for legacy use and carries ECDSA and the modern EdDSA as the current signature algorithms; RSA signatures under FIPS 186-5, the RSASSA-PSS variant, remain in wide use. The exam’s signature questions turn on two points: the signer signs a digest of the message, never the whole message, and verification uses the public key, so a signature verified by a public key proves the corresponding private key produced it, nothing more.

The honest reading of that last clause is the whole non-repudiation story. A signature proves the private key signed, and it proves nothing about the human until the key and the human are bound together by infrastructure and procedure. If the private key lived on a shared server, or the signer’s certificate was issued without identity verification, or the signature has no timestamp and the key was later revoked, the signature is cryptographically real and forensically weak. The complete control stack adds a timestamping authority, per RFC 3161, which binds the signature to a point in time, and the organizational practices, audit logs and policy, that establish key ownership. The exam tests the boundary in both directions: a digital signature over a hash of a contract with a timestamp is the strongest technical answer for non-repudiation, and no cryptographic mechanism can make a repudiation claim legally impossible if the key protection failed.

PKI: turning keys into identities

A bare public key is a number. Before a bank can trust a signature that verifies under it, someone must establish that the number belongs to the bank, and that binding is the job of the public key infrastructure, PKI. The core artifact is the digital certificate, standardized as X.509 in RFC 5280: a structured record that binds a public key to an identity, carrying the subject’s name, the issuer, the public key itself, the validity period, a serial number, and the digital signature of the issuer, which is what makes the certificate tamper-evident. The issuer is a certificate authority, the CA, a trusted third party that verifies the subject’s identity and then signs the certificate. When a system trusts a CA, it trusts every certificate that CA issues, and that single sentence is where the whole security model stands or falls.

Trust flows down a hierarchy. A root CA certifies itself with a self-signed certificate, and subordinate CAs hold certificates signed by the root, and end-entity certificates hang below them; a verifier follows the chain from the end-entity certificate up to a root it already trusts, the trust anchor, usually one of the root certificates shipped with the operating system or browser. The trust model in that construction is hierarchical and centralized: one root’s compromise poisons everything beneath it. Alternatives exist: cross-certification links two hierarchies, mesh and bridge topologies connect multiple CAs, and the web of trust used by PGP skips CAs entirely and lets users sign each other’s keys, with trust inferred from the number and closeness of endorsements. The exam’s PKI questions usually reduce to which component does what: the CA issues and signs, the registration authority, RA, verifies the applicant’s identity and forwards the request without signing, and the certificate holder owns the private key, which the CA never sees.

Certificates are born, live, and die in a lifecycle that mirrors identity administration. The issuance process checks identity, generates the key pair, and signs the certificate with a validity period. During life, relying parties validate the certificate, checking the signature, the validity dates, and whether the certificate has been revoked, and renewal happens when a certificate approaches expiry, typically with a fresh key pair rather than a reused one. The revocation question is the one the exam keeps returning to, because it is the operational weak spot: a certificate whose private key leaked is only as dead as the revocation mechanism is fast. The two mechanisms are the certificate revocation list, CRL, a signed list of revoked serial numbers published periodically by the CA, and the Online Certificate Status Protocol, OCSP, defined in RFC 6960, which answers a single certificate’s status in real time. OCSP stapling pushes the OCSP response into the TLS handshake so the client does not need a second connection. Both are slow to catch a compromise if the relying party checks infrequently, and the modern addition, certificate transparency as defined in RFC 6962, is a public append-only log of issued certificates that makes mis-issuance detectable: a CA that issues a fraudulent certificate cannot hide it, because the log is watched.

The PKI scenarios that matter in practice are the ones where the binding fails. A self-signed certificate used inside an application bypasses the trusted roots entirely; it can be fine for internal tooling and completely broken for anything a user’s browser should trust. A certificate with an expired validity period is untrustworthy even though the signature is valid. A certificate issued by a CA that later had its root removed from the trust stores fails for everyone overnight. And the deepest failure is the private key that lives on the application server in a world-readable file: the certificate is impeccable and the security is zero, because the binding between key and identity was never the hard part, protecting the key was.

Key management and the key lifecycle

NIST SP 800-57 Part 1, Recommendation for Key Management, opens its discussion of the topic with a line the exam paraphrases constantly: the security of cryptographic mechanisms depends on more than the algorithms, it depends on proper key management, and the standard is the field’s authoritative treatment of what that means. The lifecycle it defines has three broad phases. Pre-operational covers generation, distribution, and activation: the key is created, moved to wherever it will be used, and brought into service. Operational covers use, storage, and the controls that protect it while it works. Post-operational covers archival, recovery, and destruction: what happens when the key’s work is done. Every question about key rotation, key escrow, key storage, or key destruction is a question about one of these phases, and the manager-perspective answer is the one that treats the phases as a discipline with a documented policy behind it.

Generation is where security strength is actually made. A key’s entropy, the amount of true unpredictability in it, is the whole source of its strength, and it comes from a random number generator, not from an algorithm. The standard infrastructure is a CSPRNG, a cryptographically secure pseudo-random number generator, such as the DRBGs of NIST SP 800-90A, CTR_DRBG, HMAC_DRBG, and Hash_DRBG, seeded from a physical entropy source meeting the requirements of SP 800-90B. The exam scenario that matters is the opposite of a textbook: the system that generates keys from a predictable seed. The 2008 Debian OpenSSL vulnerability made the RNG state predictable from the process ID and left thousands of keys insecurely generated for two years, and the 2010 PlayStation 3 signing failure let researchers recover Sony’s private signing key because the firmware reused the same random nonce k for two signatures. In both cases the algorithms were untouched and the keys were burned by randomness. The lesson, and the correct answer to any such scenario, is that keys must come from a validated CSPRNG seeded from a good entropy source, and that hand-rolled randomness, time-based seeds, and nonce reuse are findings, not fixes.

Distribution is the phase where symmetric and asymmetric cryptography meet. Public keys travel in certificates over any channel, because they are public. Symmetric keys are the hard case, because the secrecy of the key must survive the trip, and the options are physical exchange out of band, splitting the key among couriers, or wrapping: encrypting the key with a key-encryption key, a master key that protects other keys, with the standard construction being the AES Key Wrap of RFC 3394. A key hierarchy is the architectural result: data-encryption keys do the bulk work, and master keys protect the data keys, and the master keys live in hardware so that the attack surface is a physical device rather than a disk file. Storage follows the same logic. The strong version is a hardware security module, an HSM, a tamper-resistant device validated under FIPS 140-3 that generates keys, stores them, and performs operations inside its own boundary so the private key never appears in the clear in server memory. The trusted platform module, TPM, is the commodity sibling: the chip on a laptop’s motherboard that seals keys to the hardware. Software key stores, key vaults, and key management services, KMS, are the practical middle ground, and the minimum bar anywhere is keys encrypted at rest, separated from the data they protect, and accessible only through authenticated APIs.

Use in the operational phase runs on two clocks. The cryptographic period, per SP 800-57, is the time a key is authorized for use, and the standard’s example periods run on the order of a year or two for a 128-bit symmetric data key and longer for asymmetric signature keys, with the exact values depending on the algorithm, the key size, and how much data the key protects. Rotation replaces a key with a new one before its period ends, so that a key whose compromise happened months ago stops mattering at the known boundary and so that cryptanalytic material does not accumulate. The exam’s rotation scenario is always the same shape: an organization that has used the same key for years, whose response should be a scheduled rotation policy with a documented period, not an emergency re-issue. Compromise handling lives in the same phase: when a key is suspected compromised, the response is immediate revocation of certificates that use it, rotation of the key, and analysis of what the key protected and for how long.

Two organizational mechanisms from this section deserve their own names because the exam distinguishes them sharply. Split knowledge means that no single person possesses the entire secret: the key is divided into shares, and combining a required subset, for example two of three shares, reconstructs it, with the classic construction being Shamir’s secret sharing. Dual control means that no single person can perform a critical action alone: two operators with separate credentials must both act, and neither can act for the other. The two are frequently implemented together, and the distinction is possession versus action: split knowledge controls who holds the material, dual control controls who exercises it. A master key split into shares held by two officers is split knowledge; a key ceremony that requires both officers to type their own passwords is both, and that combination is the standard answer for protecting a root or master key.

Post-operational handles the end of the key’s life. Archival preserves a key that may still be needed, to decrypt old backups or verify old signatures, with a documented retention policy. Recovery is the designed escape hatch: key escrow, the controlled deposit of a copy of a key with a trusted party or split among parties, so that the organization can decrypt data when the original key holder is unavailable, with the governance point being that escrow is authorized access, and the answer to an exam scenario about being locked out of your own encrypted data is a documented recovery process, never a single point of failure. Destruction is the reverse, and its modern form is the control that makes the algorithm irrelevant: crypto-shredding, deleting the key that protects data so that the ciphertext becomes unrecoverable, which for data that cannot be securely wiped, such as cloud object stores, is the most reliable disposal method in existence. Physical key destruction, for hardware tokens, means zeroization, the deliberate overwriting of key material in memory per the device’s standard, and the exam answer for destroying a key is always destroy or revoke the key itself, never merely delete the files it protects, because deletion leaves recovery artifacts.

The standard that ties the whole lifecycle together for an organization is ISO/IEC 27001:2022 Annex A control 8.24, use of cryptography, which requires a policy governing the use of cryptographic controls: the algorithms, key lengths, and usage rules, and how keys are managed through the lifecycle. The exam’s cryptography management questions consistently reward the same shape of answer: documented policy, standard algorithms with appropriate key sizes, keys protected through generation, distribution, storage, rotation, and destruction, and recoverability designed in before it is needed.

The attack surface

The modern algorithms resist direct attack, so the attacks that matter land around them. Knowing the taxonomy of where ciphers actually break is the difference between a strong and a weak answer to the exam’s attack scenarios.

Brute force and key search are the baseline: try every possible key. The defense is key size, which is why the transition away from 56-bit DES happened and why 128 bits is the floor. Analytical attacks are smarter than brute force: meet-in-the-middle is why double DES never gained traction, because encrypting twice with two 56-bit keys delivers only about 57 bits of effective strength, and the birthday attack halves collision resistance, which is why hash outputs must be twice the desired strength. The classical attack classes, ciphertext-only, known-plaintext, and chosen-plaintext, describe what the attacker gets, and none of them cracks AES in a proper mode; their role on the exam is to label scenarios.

Protocol and mode attacks exploit the surroundings of the cipher. A padding oracle attack feeds chosen ciphertext to a decrypting system and reads the error messages to recover plaintext or keys, and its famous realization was POODLE in 2014, which broke SSL 3.0’s CBC mode through exactly that channel. The response to every padding-oracle-era design was to move to authenticated modes like GCM, which the 2018 TLS 1.3, RFC 8446, made not merely optional but the default. The man-in-the-middle attack is the active channel attack: an attacker sits between two parties and passes or alters messages, and its defeat requires authentication of the key exchange, which is why Diffie-Hellman alone is never enough and why certificates exist.

Side-channel attacks read the physical leakage of computation rather than the math. A timing attack measures how long a private-key operation takes and correlates it with the key bits, which is why RSA and ECC implementations are written in constant time. Power analysis reads the current draw of a chip during an operation. Cache and microarchitectural attacks read the state of shared hardware, and Spectre and Meltdown, disclosed in 2018, showed that speculative execution can leak memory contents, including secrets, across process boundaries on nearly every modern CPU. The lesson the exam draws from the whole family is the same: side channels are defeated by constant-time implementations, hardware isolation, and keeping secrets inside devices such as HSMs, not by choosing a stronger cipher.

Randomness failures deserve a second mention here because they are the single most instructive attack family. A cryptographic system with perfect algorithms and a broken random number generator is broken, as the Debian and PlayStation examples showed, and the exam answer for any scenario in which keys turn out to be predictable, nonces repeat, or the same key material appears across systems is the same: the entropy source and the generator, SP 800-90A and SP 800-90B, are where the audit goes. The 2010 attack on Sony’s PlayStation 3 signing key, from a repeated nonce in ECDSA, remains the cleanest single demonstration that nonce discipline is a key-management property, not a performance detail.

The quantum question is no longer theoretical. A sufficiently large quantum computer running Shor’s algorithm factors integers and computes discrete logarithms in polynomial time, which would break RSA, Diffie-Hellman, and ECC outright, while Grover’s algorithm gives a quadratic speedup on symmetric key search, which halves the effective strength of AES, so AES-256 keeps roughly 128 bits of post-quantum security while AES-128 falls to an uncomfortable 64. The response is post-quantum cryptography, and NIST’s standardization program produced its first finished algorithms in 2024: FIPS 203, ML-KEM, a key encapsulation mechanism built on the module lattice problem and the eventual replacement for the key-exchange half of RSA and ECC; FIPS 204, ML-DSA, a lattice signature scheme; FIPS 205, SLH-DSA, a stateless hash-based signature scheme; and FIPS 206, FN-DSA, the Falcon variant finalized later in the year. The practical posture for the transition period is hybrid: combine a classical algorithm and a post-quantum algorithm so that breaking either one alone is not enough, and adopt the new standards early in the places that need long-lived security, because data recorded today can be decrypted after the quantum break, the harvest now, decrypt later threat. The exam-level fact set is compact: Shor’s threatens asymmetric cryptography, Grover’s halves symmetric strength, and the four new FIPS standards are ML-KEM, ML-DSA, SLH-DSA, and FN-DSA.

Finally, the non-cryptographic leak: traffic analysis. Encryption hides content but not patterns, the size of a message, its timing, the fact that two parties communicate, the fact that a connection spikes after midnight. An attacker who cannot read a single byte can still learn what a business is negotiating, when its executives are in the office, and which systems it is migrating. Metadata is the plaintext that encryption never touches, and the manager-perspective answer to a metadata exposure scenario is not a bigger cipher, it is a design change: padding, decoys, timing normalization, and the honest acknowledgment of what is observable. The same honesty applies to the whole chapter: cryptography is a control among controls, and it protects the bytes it is applied to, at the moment they are in the form it protects, for as long as the key discipline holds.

How the exam thinks about cryptography

The manager-perspective pattern from Chapter 2 applies to cryptography with unusual force, because the field is dense with technical detail and the exam is deliberately testing whether the candidate can see the management question behind it. Four patterns cover most of the questions.

First, algorithm choice answers are standards answers. The correct choice is a published, vetted, standardized algorithm in a current configuration: AES in GCM, SHA-256 or SHA-3, ECDSA or EdDSA, with the standard named. The wrong choices are proprietary ciphers, security through obscurity, broken legacy algorithms such as DES, 3DES, MD5, and SHA-1 in new designs, and home-grown crypto of any kind. When a scenario offers a “custom algorithm developed in-house because it is more secure since nobody knows it,” the correct response is not to evaluate the algorithm, it is to reject the premise, which is Kerckhoffs’s principle and open design operating in one sentence.

Second, key management is where the points are lost. The strongest encryption in the world fails on a weak password, a reused nonce, a world-readable key file, a key that never rotates, or a CSPRNG seeded from the clock. The exam builds scenarios that look like algorithm questions and are actually key questions, and the tell is the presence of a human, a file, a seed, or a schedule anywhere in the stem. When the answer must be the strongest, it is the one that names the key lifecycle: generation from a validated CSPRNG, storage in an HSM or protected vault, rotation on a documented period, revocation on compromise, and destruction by key deletion.

Third, cryptography is a control, not a strategy. It does not fix authorization, because decryption hands the plaintext to whoever holds the key, and it does not fix retention, classification, or process, because the plaintext copy in the backup, the email, and the printer queue is outside the cipher’s jurisdiction. An exam answer that claims encryption alone satisfies a regulatory requirement, or that an encrypted system no longer needs access control, monitoring, or DLP, is wrong by construction. The complementary control answer is the one that protects the plaintext copies, the keys, and the metadata alongside the ciphertext.

Fourth, regulatory and export dimensions are real. PCI DSS 4.0 requires stored account data to be rendered unreadable and cardholder data in transit to be protected with strong cryptography, with TLS 1.2 or later as the transmission floor, and GDPR Article 32 lists encryption among the appropriate technical measures for protecting personal data. Cross-border movement of cryptography is regulated through frameworks such as the Wassenaar Arrangement and national import and export laws, so an organization shipping encryption products or opening offices in multiple countries needs a compliance review, not just an engineering decision. The exam’s version of these questions is usually a jurisdiction or a standard name dropped into a scenario, and the correct answer recognizes the control the standard requires rather than inventing one.

Practice questions

1. A database administrator encrypts a column of customer records at rest using AES-256. An attacker steals a backup of the database and cannot read the column. Which cryptographic goal does the encryption directly provide?

A. Integrity B. Confidentiality C. Non-repudiation D. Authentication

2. A supplier sends a signed purchase order to a buyer. The buyer verifies the signature successfully with the supplier’s certificate, then checks that the order arrived unchanged. Which property does a valid signature provide for the order itself?

A. Confidentiality only B. Availability C. Integrity and authentication of the signer D. Non-repudiation of receipt

3. A vendor markets an encryption product whose design is kept secret, claiming the secrecy makes it stronger. Which principle or standard directly contradicts this claim?

A. Kerckhoffs’s principle B. Least privilege C. Defense in depth D. The birthday paradox

4. An application encrypts a bitmap image with AES in ECB mode. Even without the key, an observer can make out the image’s silhouette in the ciphertext. What is the direct cause?

A. The AES key is too short B. ECB encrypts identical plaintext blocks to identical ciphertext blocks C. ECB uses a nonce that repeats D. The image contains more blocks than the mode supports

5. Which algorithm is standardized by NIST FIPS 197?

A. Triple DES B. RSA C. AES D. SHA-256

6. An architect proposes 3DES for a new data-at-rest system. Which statement about 3DES is correct under current NIST guidance?

A. It is the strongest symmetric option because it applies DES three times B. NIST deprecated it and it is no longer approved for new use as of 2023 C. It is a stream cipher with a 128-bit block D. It provides 168 bits of effective security, making it superior to AES-256

7. A web server encrypts traffic records with GCM. Which set of properties does GCM provide in a single operation?

A. Confidentiality only B. Integrity only C. Confidentiality, integrity, and authenticity of the ciphertext, plus authenticity of associated data D. Non-repudiation and confidentiality

8. A developer reuses the same nonce for every message encrypted with a given key in CTR mode. What is the most direct consequence?

A. The cipher becomes unbreakable because the keystream repeats B. The keystream is reused, so an attacker can recover the XOR of the plaintexts C. The key length is effectively halved D. The messages become MAC-protected automatically

9. Alice wants to send a confidential message to Bob using RSA. Which key must she use to encrypt it?

A. Her own private key B. Her own public key C. Bob’s private key D. Bob’s public key

10. Two parties use raw Diffie-Hellman to agree on a shared secret over an unauthenticated channel. Which attack does this arrangement fail to prevent?

A. A brute force attack on AES B. A man-in-the-middle who impersonates both parties C. A side-channel attack on the network D. A replay of the shared secret

11. Per the comparable-strength table in NIST SP 800-57 Part 1, which three mechanisms sit near the same security strength?

A. AES-128, 256-bit ECC, 3072-bit RSA B. AES-256, 2048-bit RSA, 256-bit ECC C. AES-128, 512-bit ECC, 2048-bit RSA D. DES, 3DES, AES-128

12. A security engineer is asked to sign new documents with SHA-1. What is the most defensible basis for refusing?

A. SHA-1 is a stream cipher B. SHA-1’s collision resistance is insufficient, NIST deprecated it, and a real chosen-prefix collision was demonstrated in 2017 C. SHA-1 produces a 512-bit digest that is too large for signatures D. SHA-1 is disallowed because it requires a hardware token

13. Two servers share a secret key and authenticate their messages with HMAC. Which statement about this design is correct?

A. HMAC provides non-repudiation because only one server knows the key B. HMAC provides integrity and authenticity between the two servers, but not non-repudiation, because both hold the key C. HMAC is an asymmetric signature standard D. HMAC provides confidentiality of the messages

14. A web application must store user passwords. Which approach is the correct modern practice?

A. Store the password encrypted with a symmetric key stored on the same server B. Store a plain SHA-256 hash of each password C. Store a per-user random salt mixed with the password and processed by a slow key derivation function such as Argon2id D. Store passwords in plaintext so support staff can recover them for users

15. How does a signer create a digital signature under a standard scheme such as ECDSA?

A. They encrypt the entire message with their public key B. They encrypt a hash of the message with their private key C. They encrypt the message with the recipient’s public key D. They compute an HMAC with a shared secret and publish it

16. Which combination best supports non-repudiation of a business transaction?

A. A digital signature over a hash of the transaction, bound to the signer’s certificate, with a timestamp B. A log entry saying the transaction occurred C. HMAC computed with a shared departmental key D. An encrypted copy of the transaction in the database

17. In a PKI hierarchy, what is the role of the registration authority?

A. It signs certificates with the root key B. It verifies an applicant’s identity and forwards the request to the CA C. It generates the applicant’s private key and keeps it D. It publishes the certificate revocation list

18. A relying party must check, in near real time, whether a specific certificate has been revoked before accepting it. Which mechanism directly answers that single certificate’s status?

A. A full certificate chain download B. The certificate revocation list C. Online Certificate Status Protocol D. Certificate reissuance

19. An organization generates keys with an in-house random number generator seeded by the system clock. Which control does this most directly violate?

A. The use of a validated CSPRNG per NIST SP 800-90A, seeded from a proper entropy source B. The AES mode of operation C. The certificate validity period D. The requirement for dual control

20. A company stores its master key as two shares held by two different officers, and requires both officers to combine their shares and authenticate before the key can be used. Which two controls does this implement?

A. Split knowledge and dual control B. Key escrow and crypto-shredding C. Key wrapping and key rotation D. Forward secrecy and non-repudiation

21. An auditor finds that the same AES key has protected the payment database for eight years. What is the most appropriate response?

A. Increase the key size to AES-256 immediately B. Establish a documented rotation policy with a defined cryptographic period and rotate the key C. Move the database to a public cloud so the provider manages keys D. Leave the key in place because AES-128 has never been broken

22. A regulator asks how the organization could recover encrypted data if the only key holder left the company. Which control is the designed answer?

A. Crypto-shredding B. Key escrow or split recovery process C. Increasing the key length D. Storing a copy of the password with the data

23. An organization must destroy a confidential dataset that exists only in an encrypted cloud object store where files cannot be securely overwritten. Which method is the most reliable?

A. Overwrite the objects with zeros three times B. Degauss the storage service C. Delete the encryption keys, crypto-shredding the data D. Change the object names so the data is hidden

24. Shor’s algorithm, run on a sufficiently large quantum computer, would break which class of cryptography most directly?

A. Symmetric ciphers such as AES B. Hash functions such as SHA-256 C. Asymmetric systems such as RSA, Diffie-Hellman, and ECC D. HMAC

25. A penetration test discovers that RSA decryption times vary measurably with the private key. Which class of attack does this indicate, and which is the correct mitigation?

A. A brute force attack; increase the key size B. A side-channel timing attack; use a constant-time implementation C. A padding oracle attack; switch to CBC D. A birthday attack; use a longer hash

Answers and rationales

1. B. Encryption protects the data from being read without the key, which is confidentiality, and the scenario is the textbook version of it. Integrity is provided by hashes or MACs (option A), non-repudiation by signatures (option C), and authentication by MACs or signatures (option D).

2. C. A valid digital signature proves the message was not changed, integrity, and that the private key of the certificate holder produced it, authentication of the signer. Confidentiality is not provided by signing (option A), availability is a different property entirely (option B), and non-repudiation of receipt, proof that the buyer received it, is not something a supplier’s signature can show (option D).

3. A. Kerckhoffs’s principle requires security to rest on the key, not on the secrecy of the system, and open design, the engineering form of the same idea, treats hidden mechanisms as a liability. Least privilege (option B), defense in depth (option C), and the birthday paradox (option D) do not address whether the design may be public.

4. B. ECB encrypts each block independently, so identical plaintext blocks yield identical ciphertext blocks, and uniform regions of the image become recognizable patterns in the output. The AES key is not the issue (option A), ECB has no nonce to repeat (option C), and the block count is irrelevant (option D).

5. C. FIPS 197 is the standard that defines AES. Triple DES is SP 800-67 (option A), RSA and SHA-256 are defined elsewhere (options B and D).

6. B. SP 800-131A Revision 2 deprecated 3DES and disallowed it for new use after December 31, 2023, so a new design should not propose it. Applying DES three times is how it works but does not make it current (option A), it is a block cipher (option C), and its effective strength is roughly 112 bits, not 168, because of meet-in-the-middle attacks (option D).

7. C. GCM, standardized in SP 800-38D, is authenticated encryption: it provides confidentiality, integrity, and authenticity of the ciphertext, plus authenticity of associated data that travels in the clear. It does not stop at confidentiality or integrity (options A and B), and it does not provide non-repudiation, which requires signatures (option D).

8. B. CTR mode XORs the plaintext with a keystream derived from the nonce and key, so reusing the nonce reuses the keystream, and an attacker with two ciphertexts can recover the XOR of the plaintexts. The keystream repeating is the vulnerability, not a strength (option A), the key length is untouched (option C), and CTR provides no authentication (option D).

9. D. Confidentiality to Bob means encryption with Bob’s public key, which only Bob’s private key can undo. Alice’s private key is for signing (option A), her public key authenticates her own messages (option B), and Bob’s private key must never leave Bob (option C).

10. B. Diffie-Hellman prevents passive eavesdropping on the key agreement but authenticates no one, so an active attacker can impersonate both parties and negotiate separate secrets with each. A brute force attack on AES is unrelated (option A), side channels are physical attacks (option C), and replay of the shared secret is not the defining exposure of unauthenticated key agreement (option D).

11. A. The SP 800-57 Part 1 table places AES-128, 256-bit ECC, and 3072-bit RSA at approximately the same security strength. The other groupings mix strengths incorrectly (options B, C, and D).

12. B. SHA-1’s 160-bit digest gives only about 80 bits of collision resistance, NIST deprecated it in SP 800-131A and disallowed it for new signature generation after 2013, and the SHAttered team demonstrated a real chosen-prefix collision in 2017. SHA-1 is a hash, not a cipher (option A), its digest is 160 bits (option C), and it needs no hardware token (option D).

13. B. HMAC, defined in FIPS 198-1, proves that a holder of the shared key produced the message, so it provides integrity and authenticity between the two servers. It cannot provide non-repudiation, because either server could have computed the MAC (option A), it is symmetric, not a signature standard (option C), and it does not encrypt anything (option D).

14. C. A per-user random salt defeats precomputed tables and cross-user correlation, and a slow key derivation function such as Argon2id, scrypt, bcrypt, or PBKDF2 makes each guess expensive, which is the storage requirement of OWASP guidance and NIST SP 800-63B. Reversible encryption with the key nearby (option A) and plain hashing (option B) both fail against a stolen database, and plaintext storage (option D) is malpractice.

15. B. Signing hashes the message and applies the private key to the digest, so the signature covers the message and verifies with the public key. Signing does not use the public key (option A) or the recipient’s key (option C), and HMAC is symmetric, not a signature (option D).

16. A. A signature over the transaction’s hash, verifiable against a certificate that binds the key to the signer, with a timestamp that pins the moment, is the strongest technical non-repudiation package, and RFC 3161 covers the timestamping component. A log entry is repudiable (option B), an HMAC proves nothing to a third party (option C), and encryption provides no proof of authorship (option D).

17. B. The registration authority verifies the applicant’s identity and forwards the request to the CA, which signs. Signing is the CA’s job (option A), the applicant generates and keeps the private key (option C), and publishing the CRL is a CA function (option D).

18. C. OCSP, defined in RFC 6960, answers a single certificate’s revocation status online in near real time. A chain download does not carry status (option A), the CRL is a periodically published list that can be stale (option B), and reissuance is not a status check (option D).

19. A. Key generation must use a validated CSPRNG such as the DRBGs of SP 800-90A, seeded from an entropy source meeting SP 800-90B, and a clock-seeded generator produces predictable keys, the failure class behind the Debian OpenSSL incident. The other options concern modes, validity, and personnel controls, not generation randomness (options B, C, and D).

20. A. Two officers each holding a share means no single person possesses the whole secret, split knowledge, and requiring both to authenticate before the key is used means no single person can exercise it alone, dual control. Escrow, shredding, wrapping, and rotation are different lifecycle controls (options B, C, and D).

21. B. SP 800-57 frames key use in terms of cryptographic periods, and the response to an over-aged key is a documented rotation policy with defined periods, applied on schedule. Increasing key size without rotating does not retire the exposed key (option A), outsourcing changes who manages the key but not the absence of a policy (option C), and the key’s unbrokenness is exactly what cannot be assumed after years of use (option D).

22. B. Key escrow, or a split recovery process, is the designed answer to losing access to encrypted data when the key holder disappears, and NIST SP 800-57 treats recovery as part of the key lifecycle. Crypto-shredding destroys the data (option A), key length does not solve availability of the key (option C), and storing the password with the data defeats the encryption (option D).

23. C. When files cannot be securely overwritten, deleting the encryption keys makes the ciphertext unrecoverable, which is crypto-shredding, and it is the most reliable disposal method for such stores. Overwriting is not possible in the scenario (option A), degaussing applies to magnetic media (option B), and renaming hides nothing (option D).

24. C. Shor’s algorithm solves integer factorization and discrete logarithms in polynomial time, which directly threatens RSA, Diffie-Hellman, and ECC. Its effect on symmetric ciphers, hashes, and HMAC is not the defining break (options A, B, and D), and Grover’s algorithm, not Shor’s, is the one that halves symmetric strength.

25. B. Timing variation correlated with the private key is a side-channel timing attack, and the mitigation is a constant-time implementation that removes the dependency between the key and the operation’s duration. Brute force and key size address search, not leakage (option A), CBC is the mode padding-oracle attacks exploit, not a mitigation (option C), and the birthday attack concerns hashes (option D).

Cryptography on one page

The algorithm is the certain part, the key is the fragile part, and every scenario in this chapter is a key question wearing an algorithm costume. The goals are confidentiality, integrity, authentication, and non-repudiation, and the exam asks which mechanism provides which: encryption for confidentiality, hashes and HMAC for integrity and authenticity between secret holders, digital signatures for integrity, authorship, and technical non-repudiation. Kerckhoffs’s principle makes the key the only secret, so published standards are a feature, and security strength is measured in bits, not key length: AES-128, 256-bit ECC, and 3072-bit RSA sit at roughly 128 bits, while 168-bit 3DES delivers only about 112.

The primitive family is small and standards-bound. AES, FIPS 197, is the symmetric workhorse in the GCM mode of SP 800-38D, which bundles confidentiality with integrity and authenticity and demands a unique nonce per message; ECB, per SP 800-38A, leaks patterns and is always wrong. RSA, Diffie-Hellman, and ECC are the asymmetric family, used for key exchange and signatures, and real systems are hybrid: asymmetric for the exchange, symmetric for the data, with ephemeral keys delivering forward secrecy. SHA-2, FIPS 180-4, and SHA-3, FIPS 202, are the current hashes; MD5 and SHA-1 are broken or deprecated, and collision resistance is only half the output size. HMAC, FIPS 198-1, is the shared-secret MAC, and passwords at rest are salted per user and stretched through a slow KDF such as Argon2id or PBKDF2. Signatures, FIPS 186-5, sign the digest with the private key and verify with the public key.

PKI binds keys to identities: the CA signs, the RA verifies identity, X.509 certificates per RFC 5280 carry the binding, and revocation runs through the CRL and the real-time OCSP of RFC 6960. Key management, NIST SP 800-57 Part 1, is the discipline that decides everything: generation from a validated CSPRNG per SP 800-90A and 90B, distribution by wrapping or out-of-band means, storage in an HSM validated under FIPS 140-3 or a protected vault, use within a defined cryptographic period with scheduled rotation, recovery through escrow and split processes, and destruction by crypto-shredding, the key deletion that makes ciphertext unreachable. Split knowledge divides possession, dual control divides action, and ISO/IEC 27001:2022 Annex A control 8.24 requires the governing policy.

The attacks all land around the math: brute force and meet-in-the-middle against weak designs, padding oracles against CBC, nonce and randomness reuse against real deployments, side channels against implementations, and traffic analysis against the metadata encryption never touches. The quantum break, Shor’s against RSA, Diffie-Hellman, and ECC, is being answered by the 2024 standards ML-KEM (FIPS 203), ML-DSA (FIPS 204), SLH-DSA (FIPS 205), and FN-DSA (FIPS 206), while Grover’s merely halves symmetric strength. When the exam offers a proprietary cipher, a hidden design, a reused nonce, an unrotated key, or the claim that encryption alone solves a process problem, discard it, and keep the answer that names the standard, protects the key, and treats cryptography as one control among many.