L23
Encryption, hashing and data states
Cram this first — memory hook
Encryption = locked box you can unlock; hash = fingerprint to compare; signature = verifiable signer-bound evidence.
Exam trap
Hashing is not encryption with the key thrown away. A simple unkeyed hash does not prove who created the message.
The slide facts
Encryption is reversible with the appropriate key; hashing is one-way and supports integrity checks. Data can be at rest, in transit or in use.
If you have time — extra
Encryption transforms readable plaintext into ciphertext using an algorithm and keys, so authorized systems can recover the plaintext. Symmetric encryption uses a shared secret key; asymmetric cryptography uses related public/private keys. Advanced Encryption Standard () is symmetric. Rivest–Shamir–Adleman is named after Rivest, Shamir and Adleman and is an asymmetric algorithm family; it is not normally how every byte of a modern web session is encrypted. Hashing produces a digest: changing input normally changes the digest. There is no decryption key for a hash. However, someone can guess candidate passwords and compare their computed hashes; one-way does not mean weak passwords cannot be guessed. Password storage therefore uses appropriate salted password-hashing methods. Secure Hash Algorithm () names a family; Message Digest Algorithm 5 () is obsolete for collision-resistant security uses. A trusted expected hash can help detect file changes; a hash supplied by the same attacker as the file is not independent proof of authenticity.
Walkthrough
Identify whether data is stored, moving or being actively processed. Choose confidentiality/integrity controls for that state. Check that the comparison hash or verification key comes from a trusted source.