CISSP 7.7 - Applied Cryptography (Part 2 of 2)

This episode of the ISC2 Certified Information Systems Security Professional (CISSP) exam prep series continues applied cryptography in Domain 3, moving from the web out to networks and emerging uses — the controls you deploy across real infrastructure to keep data protected while it moves between people, offices, and services.

Frequently Asked Questions

How does the web stay encrypted, and why is SSL a warning sign?

Secure web traffic runs on Transport Layer Security, the successor to the older Secure Sockets Layer, which is riddled with known flaws and unsafe to use today even though many people still casually say SSL when they mean TLS. TLS uses hybrid cryptography: the browser and server negotiate a cipher suite, the browser encrypts a fresh ephemeral symmetric key with the server’s public key, and both sides then talk using the fast symmetric key. Remember that TLS is a framework, not an algorithm, so you must also confirm the algorithms inside the cipher suite are strong.

What is Tor doing under the hood?

Tor, once known as The Onion Router, anonymizes traffic by routing it through a chain of relay nodes wrapped in layers of encryption. It uses perfect forward secrecy, where each layer only reveals what a given node needs to pass the traffic along, so no single relay sees both where the traffic came from and where it is ultimately going. With a chain of several relays, Tor supports both anonymous browsing of the regular internet and the hosting of anonymous sites on the dark web.

How does steganography hide a message in plain sight?

Steganography conceals a secret message inside an ordinary-looking file rather than scrambling it, commonly by tweaking the least significant bits of an image so the picture looks identical to any viewer. The same idea powers digital watermarking, where hidden information marks intellectual property and can trace a copy back to the specific recipient it was issued to. It has legitimate uses and criminal ones alike, so recognize it as hiding, not encrypting.

How does IPSec protect communications?

IPSec is a standard architecture for building secure channels between two entities, with two core pieces: the Authentication Header provides integrity, authentication, and protection against replay, while the Encapsulating Security Payload provides confidentiality and integrity of the packet contents. It runs in transport mode, encrypting only the payload for peer-to-peer communication, or tunnel mode, encrypting the entire packet for link encryption between gateways. Each security association represents a one-way connection, so a two-way channel needs two.

Where is cryptography heading next?

Blockchain is a distributed, immutable public ledger that spreads records across many systems so no one can tamper with or destroy them, now spreading from cryptocurrency to supply chains and ownership records. Lightweight cryptography targets constrained settings, using purpose-built hardware to encrypt with minimal power for tiny sensors or smartcards, and to deliver the low latency fast network links demand. Homomorphic encryption lets you compute directly on encrypted data, yielding correct results without ever exposing the underlying plaintext.

Reference: This article is based on concepts discussed in CISSP 7.7 - Applied Cryptography (Part 2 of 2).