Cryptography Basics: Encryption, Hashing, and Digital Signatures

Cryptography questions on the AP Cybersecurity exam rarely ask you to do math — they ask you to pick the right tool for the right job. Knowing what each tool actually guarantees is what separates a fast, confident answer from a guess.

Symmetric encryption

One shared secret key both encrypts and decrypts. Fast, efficient for large amounts of data (e.g., AES). The hard problem: how do both parties get the same key without an attacker intercepting it? This is the key exchange problem.

Asymmetric encryption

Uses a key pair: a public key (shared with everyone) and a private key (kept secret). Anything encrypted with the public key can only be decrypted with the matching private key (e.g., RSA). Slower than symmetric encryption, but solves the key exchange problem — no secret ever has to travel over the network.

In practice, most real systems use both: asymmetric encryption to safely exchange a symmetric key, then symmetric encryption for the actual bulk data. This hybrid approach is exactly how HTTPS works.

Hashing is NOT encryption

This is one of the most commonly confused pairs on the exam:

• Encryption is reversible (with the right key) — it protects confidentiality.
• Hashing is one-way (cannot be reversed) — it protects integrity, by producing a fixed-length "fingerprint" of data. Change even one character of the input and the hash changes completely.

Hashing is used to check that a downloaded file wasn't corrupted or tampered with, and to store passwords (the system stores the hash, not the password itself, and checks by hashing the login attempt and comparing).

Digital signatures

A digital signature combines hashing + asymmetric encryption to prove two things at once:

1. Authenticity — the message really came from the claimed sender (only their private key could have created a valid signature).
2. Integrity — the message wasn't altered after signing (the hash would no longer match).

Worked example

A software company wants users to be able to verify that a downloaded installer file is genuine and hasn't been tampered with by an attacker. Which cryptographic tool should they use, and why?

They should use a digital signature. The company signs a hash of the installer with their private key; users verify with the company's public key. This confirms both authenticity (it really came from the company) and integrity (the file wasn't modified).

Exam tip

When a question asks "which tool" for a scenario, map the goal to the tool: need confidentiality? → encryption. Need to check nothing was altered? → hashing. Need to prove who sent it and that it's unaltered? → digital signature. Don't default to "encryption" for every crypto question — it's often the wrong answer when the real goal is integrity or authenticity.