Topic 4 of 6
Encryption and hashing
Encryption makes data unreadable to anyone without the key. Hashing produces a unique fingerprint that can't be reversed. They seem similar, but they solve different problems, and the exam asks about exactly that difference.
Contents
What is encryption?
Encryption turns data into something unreadable and unusable to anyone who isn't authorized. To read it, it has to be decrypted with a secret key. Even if an attacker intercepts the encrypted data, it's useless without the key.
Encryption is one of the most important technical controls for confidentiality, but not the only one: you also need access controls and policies on who can see what. And all its strength depends on the keys being protected.
Symmetric vs. asymmetric
🔑 Symmetric encryption
Uses the same key to encrypt and decrypt. Because only one key is involved, it's fast and suited to large volumes, like files on disk or database records.
Problem: distributing the key. Both parties need the same secret key, and sharing it securely, especially over a network, is hard.
🔐 Asymmetric encryption
Uses a pair of mathematically related keys: one public and one private. The private key can't be derived from the public one.
Advantage: the public key can be shared freely, which solves distribution. Anyone can encrypt with your public key, but only you, with the private key, can decrypt. It's used in HTTPS and email encryption.
| Symmetric | Asymmetric | |
|---|---|---|
| Keys | One, shared | A pair: public and private |
| Speed | Fast, suited to large volumes | More expensive |
| Main challenge | Distributing the key securely | Protecting the private key |
| Typical uses | Disks, databases | HTTPS, encrypted email, digital signatures |
Which key is used for what
It's the most repeated question on asymmetric encryption. It depends on whether you want confidentiality or authenticity:
Send a message only the recipient can read
- The sender gets the recipient's public key.
- They encrypt the message with it.
- Only the recipient's private key decrypts it.
Sign to prove who's sending
- The sender signs with their private key.
- Anyone verifies the signature with the sender's public key.
- If it verifies, the data came from them and didn't change.
Digital signatures
Asymmetric encryption also enables signing. A digital signature proves two things at once:
Authenticity
The data comes from the expected sender.
Integrity
The data hasn't changed since it was signed.
They're used to verify software downloads, authenticate email, and secure electronic documents and transactions. Note that a signature doesn't hide the content: its goal isn't confidentiality.
Encryption by data state
At rest
Data stored on a physical device: a server disk, a database, or a cloud storage account. If someone steals the disk or accesses the account without authorization, they can't read it without the keys.
In transit
Data traveling over the internet, between services, or across a private network, which anyone observing the traffic could intercept. HTTPS is the best-known example: it uses Transport Layer Security (TLS) so nobody else can read what the browser and server exchange. The same applies between cloud services and to VPN connections over public networks.
In use
Data being processed in memory (RAM) or on the CPU. It's normally decrypted for processing, which opens an exposure window. Confidential computing creates protected environments (secure enclaves) where it's processed without being exposed to the operating system or the hypervisor. This matters especially in multitenant environments, where several customers share the same hardware.
Key management
Encryption is only as secure as its keys. A stolen or exposed key puts the data within the attacker's reach and defeats the encryption. Key management covers how keys are generated, stored, protected, rotated, and retired. Best practices:
Separate keys and data
If they're together, whoever accesses one has both.
Dedicated hardware
HSMs (hardware security modules) are tamper-resistant devices designed to store keys.
Rotate keys
Changing them periodically limits the data exposed if one is compromised.
Control access
Only authorized users and systems, with strong authentication and least privilege.
In Azure: Azure Key Vault centralizes keys, certificates, and secrets, reduces the risk of exposing them, supports rotation, and integrates with other services to encrypt without exposing the key to code or administrators.
Hashing
Hashing turns any input into a fixed-length string called a hash (or digest). It's one-way: it can't be reversed to get the original.
No keys
There's nothing to decrypt: a hash doesn't "open".
Deterministic
The same input with the same algorithm always gives the same hash: it's a reliable fingerprint.
Sensitive to changes
If the data changes, the hash changes. That's why it works for integrity checks.
| Encryption | Hashing | |
|---|---|---|
| Uses a key? | Yes | No |
| Reversible? | Yes, with the key | No |
| Output length | Depends on the data | Fixed |
| Typical use | Protecting data that will be read later | Storing passwords and verifying integrity |
Passwords and salting
Store the hash, not the password
The system stores only the hash. At sign-in, it hashes what the user types and compares it with the stored one. The real password is never stored or transmitted in plain text.
If the database is stolen, they only get hashes
That's far more secure than storing plain-text passwords.
The risk: precomputed tables
Because the hash is always the same, an attacker can precompute hashes for millions of common passwords and look for matches (rainbow tables or dictionary attacks).
The fix: salt
A random, unique value (salt) is added to each password before hashing. Two users with the same password end up with different hashes, and the attacker would need a separate table for every possible salt.
Salting is a standard practice and required in any properly implemented authentication system.
Exam scenarios
| Need | Answer | Why |
|---|---|---|
| Protect a disk's files in case it's stolen | Encryption at rest | Without the keys, whoever has the disk can't read the data. |
| Stop anyone from reading what travels between the browser and the site | Encryption in transit (HTTPS/TLS) | It prevents intercepted traffic from being read. |
| Process sensitive data without exposing it to the hypervisor | Confidential computing (in use) | It uses secure enclaves protected even from the operating system. |
| Prove a document was sent by a person and wasn't altered | Digital signature | It proves authenticity and integrity. |
| Store user passwords | Hashing with salt | The password isn't stored and precomputed tables don't work. |
| Check that a download wasn't modified | Compare the hash | If the file changes, the hash changes. |
| Centralize keys, certificates, and secrets in Azure | Azure Key Vault | A managed key management service. |
Common exam traps
❓ "The original value can't be recovered." Encryption or hashing?
Hashing. Encryption can always be reversed with the right key.
❓ Which key encrypts a message so only the recipient can read it?
The recipient's public key. Only their private key decrypts it. Signing works the other way: the sender uses their private key.
❓ Does HTTPS protect data at rest?
No. HTTPS (TLS) encrypts data in transit. Data at rest is encrypted in storage.
❓ Does hashing use a secret key?
No. Hashing uses no keys; encryption does.
❓ Does a digital signature hide the document's content?
No. It proves authenticity and integrity, not confidentiality.
❓ Which data state does confidential computing protect?
Data in use, being processed in memory or on the CPU.
❓ What is the salt for?
So identical passwords produce different hashes and precomputed tables stop working.
Did you get this topic?
Test what you just learned
An application stores user passwords. If the database is stolen, they want it to be very hard to use precomputed tables to discover the passwords. What should they apply?
Ready to test "Encryption, hashing, and digital signatures"?
Original questions, each with a full explanation.
Start a mock exam