What Is Cryptography in Cyber Security? Encryption, Hashing and Digital Signatures

Why Cryptography Matters Every Day

Each time you open a banking app, send a WhatsApp message, enter a password or visit a website that shows a padlock, cryptography is working in the background. It makes online payments possible, keeps your messages private and lets you verify that a downloaded file or software update really comes from its publisher. Without it, the internet as we use it would be unsafe.

In security work, cryptography provides four goals: confidentiality (only intended parties read the data), integrity (changes are detected), authentication (you know who you are talking to) and non-repudiation (a sender cannot deny sending). These connect to the CIA triad.

Plaintext, Ciphertext, Keys and Algorithms

The original readable message is plaintext. An algorithm or cipher transforms it into unreadable ciphertext using a key. Security must rely on the secrecy of the key, not the secrecy of the algorithm; this is Kerckhoffs’s principle, and it is why public, heavily analysed algorithms such as AES are trusted. Longer keys make brute-force guessing impractical.

Symmetric Encryption

In symmetric encryption the same key encrypts and decrypts. It is fast and ideal for large amounts of data, such as encrypting a disk or a video call. The challenge is key distribution: both parties must securely share the secret key. The modern standard is AES (Advanced Encryption Standard) with 128 or 256-bit keys. Older ciphers such as DES and RC4 are considered weak and should not be used.

Asymmetric Encryption and Public Key Infrastructure

Asymmetric cryptography uses a key pair: a public key that can be shared with anyone and a private key that must be kept secret. Data encrypted with the public key can only be decrypted with the private key, and signatures created with the private key can be verified using the public key. It solves the key distribution problem but is slower, so it is typically used to exchange a symmetric key or to sign data. Common algorithms include RSA and elliptic-curve cryptography (ECC).

To trust a public key, we use Public Key Infrastructure (PKI): certificate authorities issue digital certificates binding a public key to an identity such as a website domain. Your browser trusts certain root authorities and checks certificate chains, expiry and revocation.

Hashing and Digital Signatures

A hash function such as SHA-256 converts any input into a fixed-length fingerprint. The same input always gives the same output, tiny changes produce completely different hashes and it is infeasible to reverse. Hashes verify file integrity and store passwords (with salts and slow algorithms like bcrypt or Argon2). Read more in what is hashing.

A digital signature combines hashing with asymmetric cryptography: the sender hashes the message and encrypts the hash with their private key; the receiver verifies it using the sender’s public key. This proves origin and integrity, and underpins software updates, e-signatures and secure email.

Where Cryptography Is Used

• HTTPS/TLS: secures web traffic using certificates and session keys.
• VPNs: encrypted tunnels using IPsec or WireGuard.
• Messaging apps: end-to-end encryption using protocols like Signal.
• Disk and mobile encryption: BitLocker, FileVault and device encryption.
• Password storage: salted hashes.
• Blockchain: hashes and signatures secure transactions.
• Code signing: verifying software authenticity.
• UPI and card payments: encryption and tokenisation protect payment data.

Common Cryptographic Mistakes and Attacks

Most real-world failures come from implementation, not mathematics. Examples include hard-coding keys in source code, using outdated algorithms, reusing initialisation vectors, storing passwords as plain hashes without salts, ignoring certificate errors, generating keys with poor randomness and rolling your own cryptography. Attacks include brute force, dictionary and rainbow table attacks, man-in-the-middle attacks on unvalidated certificates, downgrade attacks and side-channel attacks. Quantum computing may eventually threaten RSA and ECC, which is why post-quantum algorithms are being standardised.

Practising Cryptography in a Lab

In our beginner and certification-focused courses you use OpenSSL to generate keys, create a small certificate authority, encrypt and sign files, inspect TLS handshakes in Wireshark and crack weak password hashes in a controlled lab to understand why strong policies matter. The topic features prominently in Security+ and CEH, and forms a module of the complete cyber security course.

Common Misconceptions About Cryptography

• “Longer secrets always mean safer.” Algorithm quality and implementation matter too.
• “Hashing is encryption.” Hashes are one-way; encryption is reversible.
• “HTTPS means the website is trustworthy.” It means the connection is encrypted, not that the site is honest.
• “We can write our own algorithm.” Custom cryptography is almost always weak.
• “Quantum computers already break everything.” Not yet; research and migration plans are underway.

Hands-On Exercise: Encrypt, Hash and Sign

Using OpenSSL in a Linux terminal: create a text file, encrypt it with AES-256 using a passphrase and decrypt it; compute its SHA-256 hash, change one character and recompute to see the difference; generate an RSA key pair, sign the file with the private key and verify with the public key; finally inspect a website’s certificate chain with openssl s_client. Record commands and outputs in your notebook. These steps cover symmetric encryption, hashing, digital signatures and PKI in one session.

Self-Test

1. Which is faster, symmetric or asymmetric encryption? (Symmetric.)
2. What does a digital signature provide? (Authenticity and integrity.)
3. Which algorithm is the standard symmetric cipher? (AES.)
4. What does PKI manage? (Digital certificates and trust.)
5. Why are salts used? (To make password hashes unique.)

Illustrative Scenario: A Developer’s Shortcut

A start-up developer stores user passwords using a fast hash without salting, thinking it is secure enough. When the database is leaked through another vulnerability, attackers crack most passwords within hours using precomputed lists, and users who reused passwords suffer account takeovers elsewhere. Had the team used a slow salted algorithm such as bcrypt or Argon2, cracking would have been vastly harder. Small cryptographic decisions have large consequences.

Practical Tips for Using Cryptography Correctly

• Use well-reviewed libraries; never invent your own algorithms.
• Store keys in a secrets manager or hardware module, not in code.
• Prefer modern TLS versions and disable obsolete ciphers.
• Rotate keys and certificates on a schedule and monitor expiry.
• Back up recovery keys securely; lost keys mean lost data.

Where to Go Next: Practice and Resources

Foundational topics become easier once you see how they connect. Treat each article as one piece of a map: networks carry data, operating systems run services, applications process input, people make decisions and attackers look for the weakest link among them. Revisit the basics regularly, because later topics such as cloud security and incident response build directly on them.

• Official documentation and RFCs for protocols you use daily.
• OWASP and MITRE ATT&CK websites for structured knowledge.
• Beginner labs on guided learning platforms.
• Government awareness portals for scams and safe practices.
• A study partner with whom you can explain concepts to each other.

More Questions Learners Ask

Which fundamentals matter most for employers?

Networking, Linux and Windows basics, common attack types and clear communication.

Do I need to memorise all these terms?

No. Understand the idea behind each term and how it appears in a real incident; vocabulary becomes natural through labs and repetition.

What is the best order to learn security topics?

Start with networking and operating systems, then threats and controls, then hands-on labs, and finally a specialisation.

How can I test whether I really understand a concept?

Try to explain it in two minutes to a non-technical friend and then demonstrate it in a lab.

Are free resources enough for fundamentals?

They are a good start, but structured feedback from a live course helps you avoid gaps.

How often do fundamentals change?

Core principles change slowly, while tools and threats change quickly, so invest more in principles.

Interview Questions Related to This Topic

Employers often use fundamentals like these to check whether a candidate really understands a topic. Try answering in your own words before reading the model answer.

What is port scanning and is it legal?

Port scanning probes a host to discover open services. It is legal on systems you own or have permission to test, and may be considered hostile or illegal otherwise.

What is a firewall and how is an IDS different?

A firewall enforces allow or deny rules on traffic; an IDS monitors traffic or hosts and alerts on suspicious behaviour, while an IPS can also block it. They complement each other.

What is XSS and how is it different from CSRF?

XSS injects scripts that run in a victim’s browser in the context of a trusted site; CSRF tricks a logged-in user’s browser into sending an unwanted request. Output encoding and CSP help against XSS; anti-CSRF tokens and SameSite cookies help against CSRF.

Terms to Remember

A shared vocabulary makes learning faster. These terms appear repeatedly in classes, labs and interviews:

• EDR: Endpoint detection and response software that records activity on laptops and servers and helps contain compromised machines.
• Social engineering: Manipulating people, rather than breaking technology, to gain access or information.
• Least privilege: Giving each user or system only the access needed for the job, limiting damage if an account is compromised.
• Incident response: The organised process of detecting, containing, eradicating and recovering from a security incident and learning from it.
• Spoofing: Disguising a sender, address or website as a trusted one, such as a forged email sender or fake caller ID.
• ISO 27001: An international standard for an information security management system, often required by enterprise customers.

Learn This Hands-On: Recommended Courses

Reading builds understanding, but practice builds skill. If this topic interests you, the best next steps are CompTIA Security+ Training, Cyber Security Course and CEH Certification Training. Every course includes live labs, and a new batch starts every week. You can try a free demo class first, compare fees or read about the cyber security course in your city.

Related reading: What Is Hashing in Cyber Security? Hash Functions, Salting and Password Storage • What Is the CIA Triad in Cyber Security? Confidentiality, Integrity, Availability • What Is Cyber Security? Meaning, Types, Importance and Career Scope.