Start Here
Five review stations, each a different way to practice Chapter 6. Work through them in any order. Nothing here is graded or stored, so use it as many times as you like before the quiz or the exam.
What this chapter asked you to be able to do
- Tell apart encryption, encoding, and obfuscation, and explain why only encryption provides cryptographic security.
- Describe how symmetric and asymmetric encryption work, their strengths and limits, and why the hybrid approach in TLS uses both.
- Explain how hashing and salting protect data without allowing decryption, and identify forensic uses of hash functions.
- Describe how a digital signature establishes authenticity and non-repudiation by encrypting a hash with a private key.
- Explain Public Key Infrastructure as a trust model, including certification authorities, the certificate chain, and revocation through CRL and OCSP.
Your progress this session
These counters update as you check answers on each station. They reset when you reload the page.
Key Terms Flashcards
Select a card to reveal its definition, then select again to flip it back. Try to state the definition before you flip. The counter tracks how many distinct cards you have opened.
Matching a Description to the Encryption Type
Chapter 6 relies on three mechanisms that people often lump together. Read each description and choose whether it is symmetric encryption, asymmetric encryption, or hashing, then check your answer.
Identifying the Security Goal a Mechanism Provides
Encryption alone protects confidentiality. Integrity, authenticity, and non-repudiation each require their own mechanism. Read each situation and choose the goal it primarily provides, then check your answer.
Matching PKI Components to Their Role
Public Key Infrastructure answers a single question: how do you know a public key really belongs to the party you think it does? Read each description and choose the PKI component it defines, then check your answer.
Reference: certificate revocation at a glance
| Method | How it works | Trade-off |
|---|---|---|
| Expiration | Every certificate carries an expiration date, after which it is no longer trusted. | The normal lifecycle end. A new certificate is issued before the old one expires. |
| CRL | The CA publishes a Certificate Revocation List of revoked certificates that browsers download and check. | Lists can be large and refresh periodically, leaving a window where a revoked certificate may still be trusted. |
| OCSP | The browser queries the CA in real time to ask whether one certificate is revoked. | More current, but adds a small delay and needs the OCSP server online. |
| OCSP stapling | The website periodically queries OCSP and includes the signed response in the TLS handshake. | Removes the browser's need to contact the OCSP server on every connection. |
A certificate is revoked early when its private key is compromised, its domain changes ownership, or it was issued in error.
Knowledge Check
Ten multiple-choice questions across the whole chapter. Answer them all, then select Score my answers for feedback and a final total.