If you’re planning to take the Security+ exam, you should have a good understanding of encryption methods that include using a matched key pair of a public key and a private key.
Here is a sample practice test question:
Q. An organization is implementing a PKI and plans on using public and private keys. Which of the following can be used to create strong key pairs?
A. MD5
B. RSA
C. AES
D. HMAC
Can you answer this question? More, do you know why the correct answer is correct and the incorrect answers are incorrect? The answer and explanation is available at the end of this post.
The two primary encryption methods are symmetric and asymmetric. Symmetric encryption encrypts and decrypts data with the same key. Asymmetric encryption encrypts and decrypts data using a matched key pair of a public key and a private key.
These encryption methods include two elements:
- Algorithm. The algorithm performs mathematical calculations on data. The algorithm is always the same.
- Key. The key is a number that provides variability for the encryption. It is either kept private and/or changed frequently.
This post covers encryption method that uses a public key and a private key.
Using RSA
Ron Rivest, Adi Shamir, and Leonard Adleman developed RSA in 1977 and the acronym uses their last names. It is an asymmetric encryption method using both a public key and a private key in a matched pair, and it is widely used on the Internet and elsewhere due to its strong security.
As an example, email applications often use RSA to privately share a symmetric key between two systems. The application uses the recipient’s public key to encrypt a symmetric key, and the recipient’s private key decrypts it.
Chapter 5 of the CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide introduces Trusted Platform Modules (TPMs) and hardware security modules (HSMs) used for hardware encryption. As a reminder, TPMs and HSMs provide secure storage for RSA keys.
The RSA algorithm uses the mathematical properties of prime numbers to generate secure public and private keys. Specifically, RSA relies on the fact that it is difficult to factor the product of two large prime numbers. The math is complex and intriguing to mathematicians, but you don’t have to understand the math to understand that RSA is secure if sufficient key sizes are used.
What is a sufficient key size? RSA laboratories recommend a key size of 2048 bits to protect data through the year 2030. If data needs to be protected beyond 2030, they recommend a key size of 3072 bits.
What Key Encrypts and What Key Decrypts?
Some people memorize absolute rules such as the public key always encrypts and the private key always decrypts. However, as with most absolute rules, they don’t hold true.
Consider this scenario. Bart wants to send an email to Lisa so decides to encrypt it. He also wants to ensure that Lisa knows that Bart sent it. These require both encryption and a digital signature.
For encryption:
- The recipient’s (Lisa’s) public key encrypts the data
- Lisa’s public key is available publicly
- Bart can retrieve it and use it to encrypt the data
- The recipient’s (Lisa’s) private key decrypts the data
- Lisa’s private key always remains private
- Lisa is the only person that can decrypt the data
For a digital signature:
- The sender’s (Bart’s) private key encrypts the hash for the digital signature
- Bart is the only person that has his private key
- The sender’s (Bart’s) public key decrypts the hash for the digital signature
- Bart’s public key is available publicly
- Lisa can retrieve it to verify the digital signature
- If Bart’s public key decrypts the digital signature, it must have been encrypted with Bart’s private key
Check out this page for a few sample practice test questions related to keys.
Remember this
RSA is widely used to protect data such as email and other data transmitted over the Internet. It uses both a public key and a private key in a matched pair.
Q. An organization is implementing a PKI and plans on using public and private keys. Which of the following can be used to create strong key pairs?
A. MD5
B. RSA
C. AES
D. HMAC
Answer is B. Rivest, Shamir, Adleman (RSA) is used to create key pairs. Message Digest 5 (MD5) and Hash-based Message Authentication Code (HMAC) are hashing algorithms.
Advanced Encryption Standard (AES) is a symmetric encryption algorithm.
