Cryptography, Virtualization, and Final Review

Cryptography is the mathematical foundation of information security, providing confidentiality, integrity, and authentication services. The field divides into three primary primitive types, each serving a different purpose.

Symmetric encryption uses one shared key for both encryption and decryption. It is computationally fast and appropriate for bulk data. AES (Advanced Encryption Standard) is the NIST-approved symmetric standard — AES-256 is the target for classified information. Older symmetric algorithms such as DES (56-bit, broken by brute force in 1999) and 3DES are deprecated.

Asymmetric encryption uses a mathematically linked public/private key pair. The public key is freely distributed; the private key is kept secret. Data encrypted with the public key can only be decrypted with the corresponding private key. RSA is the foundational asymmetric algorithm — minimum 2048-bit keys for current security. ECC (Elliptic Curve Cryptography) achieves equivalent security at much smaller key sizes, making it preferred in TLS implementations where bandwidth and computational overhead matter. Asymmetric operations are orders of magnitude slower than symmetric operations — this is why TLS uses asymmetric key exchange (RSA or ECDHE) to establish a shared symmetric session key, then switches to AES for the bulk data transfer.

Hash functions are one-way: they produce a fixed-length digest from arbitrary input, and the original input cannot be recovered from the digest. MD5 (128-bit) and SHA-1 (160-bit) are deprecated due to known practical collision vulnerabilities. SHA-256 and SHA-3 are current standards.

PKI (Public Key Infrastructure) provides the trust chain that makes HTTPS work. A Certificate Authority (CA) vouches for server certificates — it signs them with its own private key. Browsers and operating systems maintain a trust store of root CA certificates. When you connect to a site via HTTPS, the server presents its certificate; the browser validates the signature chain up to a trusted root CA. If a certificate is compromised before its expiry date, the CA publishes it on the Certificate Revocation List (CRL) or through OCSP (Online Certificate Status Protocol).

TLS 1.3 made three critical improvements over TLS 1.2: it removed all deprecated cipher suites (RC4, DES, 3DES, MD5, SHA-1), it mandated ECDHE for every connection (ensuring forward secrecy on all sessions), and it reduced the handshake from two round trips to one. Forward secrecy means each session uses a unique ephemeral key pair — if the server's long-term private key is later stolen, recorded past sessions cannot be decrypted.

Virtualization security introduces unique attack surfaces. VM escape exploits hypervisor vulnerabilities to break the isolation guarantee between VMs — an attacker in one VM gains access to the host or other VMs. The cloud shared responsibility model varies by service type: in IaaS, the provider secures the physical infrastructure and hypervisor; the customer secures the OS, applications, and data. In PaaS, the provider also manages the runtime environment; the customer secures application code and data. In SaaS, the provider manages everything below the application layer; the customer manages user identities and access controls.

Standards: Maryland Blueprint Pillar 3 · EC-Council CEH v12 Domain 19 (Cryptography) + Domain 20 (Cloud Computing) · PGCC INT-2681 Outcomes 3, 5, 7.