ExamFinch.com My Study

Study guide

9.4 Cryptography Fundamentals

Practice this exam

EC-Council Certified Ethical Hacker CEH

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 CEH Exam Format, Cost & Eligibility 1.2 The Five Phases of Ethical Hacking 1.3 Information Security Fundamentals 1.4 Ethical Hacking Concepts, Scope & Legal Framework 1.5 The CEH Domains & Your Study Priority Map

2 Reconnaissance, Footprinting, Scanning & Enumeration

2.1 Footprinting & Reconnaissance Concepts 2.2 Footprinting Sources & Techniques 2.3 Network Scanning Concepts 2.4 Banner Grabbing, OS Fingerprinting & Scanning Beyond IDS/Firewall 2.5 Enumeration 2.6 Vulnerability Scanning & Countermeasures

3 Vulnerability Analysis & System Hacking Phases

3.1 Vulnerability Analysis Concepts 3.2 System Hacking Methodology Overview 3.3 Gaining Access: Password Attack Concepts 3.4 Privilege Escalation Concepts 3.5 Maintaining Access: Backdoors, Rootkits & Persistence 3.6 Covering Tracks, Anti-Forensics & Blue-Team Detection

4 Malware Threats, Sniffing & Social Engineering

4.1 Malware Concepts and Taxonomy 4.2 Malware Analysis and Detection 4.3 Sniffing Concepts and Layer 2 Attacks 4.4 Sniffing Countermeasures and Detection 4.5 Social Engineering Types and Human Psychology 4.6 Social Engineering and Insider Threat Defenses

5 Network & Perimeter Hacking

5.1 Denial of Service and DDoS Attacks 5.2 Session Hijacking 5.3 Evading IDS and IPS (Defensive Focus) 5.4 Evading Firewalls 5.5 Evading Honeypots and Defensive Deception 5.6 Network Security Controls and Architecture 5.7 Packet Analysis and Secure Protocols for Defenders

6 Web Server & Web Application Hacking

6.1 Web Server Attacks & Hardening 6.2 OWASP Top 10 Overview 6.3 Injection: SQL Injection & Command Injection 6.4 Cross-Site Scripting (XSS) & CSRF 6.5 Authentication, Session & Access-Control Flaws 6.6 API & Web App Security Testing Concepts

7 Wireless Network Hacking

7.1 Wireless Concepts and Standards 7.2 Wireless Encryption 7.3 Wireless Threats and Attack Concepts 7.4 Wireless Security Countermeasures

8 Mobile Platform, IoT & OT Hacking

8.1 Mobile Platform Threats & Security Models 8.2 Mobile Attack Vectors & Risks 8.3 Mobile Device Management & Enterprise Defense 8.4 IoT Hacking Concepts & Defense 8.5 OT, ICS & SCADA Security

9 Cloud Computing & Cryptography

9.1 Cloud Computing Concepts 9.2 Cloud Threats & Attack Surfaces 9.3 Cloud Security Controls 9.4 Cryptography Fundamentals 9.5 PKI & Cryptographic Applications 9.6 Cryptanalysis, Crypto Attacks & Best Practices

9.4 Cryptography Fundamentals

Key Takeaways Explain This Topic AI

Symmetric encryption uses one shared secret key and is fast; asymmetric uses a public/private key pair and is slower but solves key distribution and enables signatures

AES is the dominant symmetric block cipher (128/192/256-bit keys); RSA, ECC, and Diffie-Hellman are the dominant asymmetric algorithms, with ECC giving equivalent strength at smaller key sizes

Hash functions (SHA-2, SHA-3) are one-way and fixed-length and provide integrity; MD5 and SHA-1 are collision-broken and must not be used for security

HMAC adds a secret key to a hash to provide integrity plus authentication; salting defeats precomputed rainbow-table attacks on passwords

Diffie-Hellman lets two parties derive a shared secret over an insecure channel without ever transmitting the key itself

Last updated: June 2026

Why Cryptography Is on the CEH

Cryptography is its own domain on the CEH. Questions test definitions and properties — which algorithm provides confidentiality, which provides integrity, which solves key distribution — not implementation math. The fastest way to answer is to know the security service each primitive provides: confidentiality (encryption), integrity (hashing), authentication (HMAC/signatures), and non-repudiation (digital signatures). Match the service the scenario needs to the primitive that provides it.

Symmetric vs Asymmetric Encryption

Symmetric (secret-key) encryption uses the same key to encrypt and decrypt. It is fast and ideal for bulk data, but both parties must already share the key — the key distribution problem — and the number of keys explodes as parties are added (n(n-1)/2 keys for n parties).

Asymmetric (public-key) encryption uses a mathematically linked key pair : a public key (shared freely) and a private key (kept secret). Data encrypted with one key is decrypted only with the other. It is far slower but solves key distribution and enables digital signatures.

In practice, real systems are hybrid : slow asymmetric crypto securely exchanges a symmetric session key, then fast symmetric crypto encrypts the bulk data. TLS works exactly this way.

  • Property Symmetric Asymmetric
  • Keys One shared secret key Public/private key pair
  • Speed Fast (bulk data) Slow (small data, key exchange)
  • Key distribution Hard — must pre-share the key Easy — public key is shareable
  • Typical algorithms AES, DES, 3DES, ChaCha20, Blowfish/Twofish, RC4 RSA, ECC, Diffie-Hellman, ElGamal, DSA
  • Provides Confidentiality Confidentiality, key exchange, digital signatures
  • Scaling n(n-1)/2 keys for n parties One key pair per party

Core Symmetric and Asymmetric Algorithms

AES (Advanced Encryption Standard) — the standard symmetric block cipher ; 128-bit block with 128/192/256-bit keys (the Rijndael algorithm). It replaced the weak/broken DES and is the default for bulk encryption today.

DES (Data Encryption Standard) — legacy 56-bit-key block cipher, now insecure and brute-forceable in hours; do not use.

3DES (Triple DES) — applies DES three times for an effective ~112-bit strength; deprecated and slow, retained only for legacy compatibility.

RSA — asymmetric algorithm based on the difficulty of factoring large composite numbers ; used for key transport and digital signatures (use 2048-bit keys or larger).

Diffie-Hellman (DH) — asymmetric key agreement based on the discrete logarithm problem ; establishes a shared key but does not itself encrypt or authenticate.

ECC (Elliptic Curve Cryptography) — asymmetric scheme that delivers equivalent strength to RSA at much smaller key sizes (a 256-bit ECC key is comparable to a 3072-bit RSA key), making it efficient for mobile and constrained devices.

Hashing, HMAC, and Salting

A cryptographic hash function is a one-way function producing a fixed-length digest . Properties: deterministic, irreversible (preimage-resistant), collision-resistant, and the avalanche effect — a tiny input change drastically changes the output. A hash provides integrity , not confidentiality.

  • Algorithm Digest Size Status
  • MD5 128-bit Broken (collisions) — do not use
  • SHA-1 160-bit Broken (collisions, SHAttered 2017) — do not use
  • SHA-2 (SHA-256/384/512) 224–512-bit Recommended, widely deployed
  • SHA-3 (Keccak) 224–512-bit Recommended, different internal design

HMAC (Hash-based Message Authentication Code) combines a hash with a secret key to provide integrity plus authentication — proving the message was not altered and came from a party holding the shared key.

Salting adds unique random data to each password before hashing so identical passwords hash differently. This defeats precomputed rainbow-table attacks and slows mass cracking. Pair salting with a slow, purpose-built password hash (bcrypt, scrypt, Argon2, PBKDF2) — never a fast bare hash.

Diffie-Hellman Key Exchange (Concept)

Diffie-Hellman lets two parties agree on a shared secret over an insecure channel without ever transmitting the secret itself . Each party combines public values with its own private value so both independently compute the same shared key, while an eavesdropper who sees only the public exchange cannot. It provides key agreement only — not encryption or authentication — so it is typically authenticated by signatures or certificates (otherwise it is vulnerable to man-in-the-middle).

Ephemeral Diffie-Hellman (DHE/ECDHE) generates fresh keys per session, providing forward secrecy so a future key compromise cannot decrypt past sessions.

Block Ciphers, Stream Ciphers, and Modes

Symmetric ciphers come in two forms. A block cipher (AES, DES, 3DES) encrypts fixed-size blocks; a stream cipher (ChaCha20, the broken RC4) encrypts a continuous keystream bit-by-bit, useful for real-time data. Block ciphers need a mode of operation to handle data longer than one block, and the mode choice matters for security:

ECB (Electronic Codebook) — encrypts each block independently; identical plaintext blocks produce identical ciphertext, leaking patterns. Avoid ECB.

CBC (Cipher Block Chaining) — chains each block with the previous using an Initialization Vector (IV), hiding patterns but vulnerable to padding-oracle attacks if unauthenticated.

CTR / GCM — counter-based modes; GCM (Galois/Counter Mode) is AEAD , providing confidentiality and integrity in one step, and is the modern default.

The exam trap: ECB is insecure because it reveals structure, while AES-GCM (authenticated encryption) is the recommended choice.

The Four Security Services (Summary)

Map each goal to its primitive: confidentiality = encryption (AES/RSA); integrity = hashing (SHA-2/3); authentication = HMAC or digital signatures; non-repudiation = digital signatures only (a shared symmetric key cannot provide non-repudiation because both parties hold it).