Domain 3 · Objective reference 3.6 · Chapter 24 of 62
Select cryptography and manage a trustworthy PKI
About 5 minutes · Current ISC2 outline effective 15 April 2024; the announced 15 April 2027 replacement requires separate mapping
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: PKI binds identity to keys under a trust policy.
Explore the anchors
Verify identity and bind it to a certificate.
Concept matching activity
Match this task or description to its concept:
Check chain identity purpose and validity.
Choose a concept before checking the explanation.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Concepts and mechanisms
- Design, evidence and tradeoffs
- Key lifecycle and quantum terminology
Concepts and mechanisms
Symmetric encryption commonly protects bulk data with a shared key. Asymmetric mechanisms use related public and private keys for purposes such as key agreement or signatures. Elliptic-curve mechanisms are a family of asymmetric constructions, not a separate promise of perfect security. Hashes support digest-based verification designs, while message authentication codes use a secret to support integrity and authenticity among parties holding that secret. A signature uses a signing key and an appropriately trusted verification key; it need not provide confidentiality.
Design, evidence and tradeoffs
A public-key infrastructure binds keys and identities through certificates and a trust process. Evaluate issuance, identity proofing, certificate chains, intended names and uses, validity, revocation and key protection. A client that accepts any certificate can encrypt to the wrong peer. Plan key generation, custody, access, rotation, recovery and destruction. Quantum-related developments affect selection and migration planning; post-quantum algorithms and quantum key distribution are different ideas. Use maintained approved mechanisms and test interoperability rather than designing a new scheme.
Key lifecycle and quantum terminology
Choose algorithms and modes according to required properties, interoperability and current authoritative guidance, then manage generation, distribution, storage, rotation, revocation, recovery and destruction of keys. Elliptic-curve cryptography is asymmetric cryptography, not a synonym for every quantum-resistant method. Quantum key distribution and post-quantum cryptography address different assumptions and deployment requirements. A certificate binds an identity claim to a public key under an issuer’s process; validate trust chain, intended use, validity and status. Encryption without appropriate integrity protection can leave modification risks.
| Mechanism | Useful distinction | Common error |
|---|---|---|
| Encryption | Confidentiality under key assumptions | Assuming it authorizes every reader |
| Hash | Digest; not reversible encryption | Trusting a reference from the same untrusted source |
| MAC | Shared-secret integrity/authenticity | Treating shared-secret evidence as unique public attribution |
| Signature | Private signing and trusted verification | Assuming signed statements are necessarily true |
| PKI | Identity/key binding and lifecycle | Accepting a certificate without intended-peer validation |
Worked example
A service encrypts data with a symmetric key and restricts key use to the intended workload; it also validates the remote peer during key establishment.
Check your understanding
Why is key lifecycle management as important as algorithm choice?
Show explanation
Exposed, lost, misused or unrevoked keys can defeat a suitable algorithm or make protected data unavailable.
Source and study boundary
Official syllabus source. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.