| 🏠 Back to Exam Syllabus | 📺 RooCloud on YouTube | 🌐 RooCloud Practice Exams |
CISSP 6.1 - Cryptographic Foundations (Part 1 of 3)
This episode of the ISC2 Certified Information Systems Security Professional (CISSP) exam prep series opens the Domain 3 journey into cryptography, starting at the foundation — what cryptography is actually trying to accomplish, the language used to talk about codes and ciphers, and the ideas that separate a trustworthy cryptosystem from a false sense of safety.
What this episode covers
- The four goals of cryptography — confidentiality, integrity, authentication, and nonrepudiation, chosen like a menu.
- Confidentiality across three states — data at rest, in transit, and in use, each facing its own threat.
- Integrity and authentication — digital signatures prove nothing changed; challenge-and-response proves identity.
- Nonrepudiation — only public key systems can make a sender’s action truly undeniable.
- Core cipher vocabulary — plaintext, ciphertext, cryptography, cryptanalysis, and cryptology.
- Keys and key space — every extra bit doubles the possibilities a brute-force attacker must try.
- Secret vs open algorithms — trust published designs; security through obscurity fails.
Watch the full episode above for the worked examples and detailed explanations of each concept.
Frequently Asked Questions
What are the four goals of cryptography?
Confidentiality keeps data secret, integrity keeps data unaltered, authentication proves who someone is, and nonrepudiation makes an action undeniable. No single system has to deliver all four — think of them as a menu, where you choose the ones your situation actually requires.
What does nonrepudiation guarantee?
It guarantees that a sender cannot later deny sending a message, assuring the recipient it truly came from that person and not an impostor. A shared secret key alone cannot provide this, because if two people hold the same key, either one could have produced the message, so neither can be pinned down. Nonrepudiation comes only from public key systems, where each person holds a private key that is theirs alone.
What vocabulary do you need to talk about ciphers?
A plaintext message is the readable original, which you run through an algorithm to produce ciphertext, the scrambled version you send; the recipient reverses the process to recover the plaintext. The art of building these systems is cryptography, the art of breaking them is cryptanalysis, and together the whole field is called cryptology.
What is a key, and why does its size matter so much?
A key is really just a number, usually a very large binary one, and the key space is the full range of values it could hold, set by the bit size. Add one bit and you double the number of possibilities, so a longer key means an attacker guessing values by brute force faces exponentially more work. All of your protection rests on keeping that key secret.
Should the algorithm itself be kept secret?
Most cryptographers say no. A system should stay secure even if everyone knows exactly how it works, as long as the key stays private — the blunt version is simply that the enemy knows the system. Hiding the design instead is called security through obscurity, and it tends to fail the moment someone peeks, while publishing an algorithm invites the whole community to attack it so weak ones get exposed and abandoned fast.
📚 Master the ISC2 CISSP Exam!
Ready to test your knowledge? Access chapter-specific Multiple Choice Questions (MCQs) and full-length practice exams for the ISC2 CISSP certification at RooCloud.com. Solve the chapter-wise questions to reinforce this lesson before moving to the next episode.
Reference: This article is based on concepts discussed in CISSP 6.1 - Cryptographic Foundations (Part 1 of 3).