CAIE 9618 · Paper 3 · Topic 3.5.2

Encryption
& Digital
Certificates

Symmetric · Asymmetric · TLS/SSL Handshake · Digital Signatures · PKI

CSZone Cambridge International AS & A Level Computer Science 9618

Symmetric Encryption

One Key for Both Ends

Plaintext

→

Encrypt
shared secret key

→

Ciphertext

→ (sent over network) →

Decrypt
same key

→

Plaintext

KEY FACTS

Same key encrypts and decrypts

Very fast — suitable for bulk data encryption

Examples: AES (128/256-bit), DES (obsolete)

Used to encrypt the actual data in TLS (after handshake)

KEY DISTRIBUTION PROBLEM

Both parties must have the same key — but how do you safely share the key over an untrusted network?

If the key is intercepted in transit, all encrypted communications are compromised

Solution: use asymmetric encryption to securely exchange the symmetric key (hybrid approach in TLS)

Asymmetric Encryption

Public & Private Key Pair

A mathematically linked pair of keys — what one key encrypts, only the other can decrypt. You share the public key freely; keep the private key secret.

ENCRYPTION (CONFIDENTIALITY)

Message

→

Encrypt with
Recipient's PUBLIC key

→

Ciphertext

→

Decrypt with
Recipient's PRIVATE key

→

Message

Only the recipient (who holds the private key) can decrypt.

DIGITAL SIGNATURE (AUTHENTICITY)

Message hash

→

Encrypt with
Sender's PRIVATE key

→

Signature

Recipient decrypts signature with sender's PUBLIC key → verifies origin & integrity.

COMPARISON

	Symmetric	Asymmetric
Keys	1 shared key	Public + private pair
Speed	Fast	Slow (100x)
Key share	Problem	Public key freely shared
Use case	Bulk data	Key exchange, signatures
Example	AES-256	RSA-2048, ECC

TLS / SSL Handshake

How HTTPS Secures a Connection

TLS (Transport Layer Security) — successor to SSL. Used every time you visit an HTTPS site. Hybrid: asymmetric to exchange a session key, then symmetric for the data.

1. Client Hello — browser sends TLS version, list of cipher suites it supports, and a random number (client random)

2. Server Hello — server chooses cipher suite, sends its digital certificate (contains server's public key, signed by a CA)

3. Certificate Verification — browser checks the CA signature, confirms the certificate is valid and not expired, confirms domain matches

4. Key Exchange — browser generates a pre-master secret, encrypts it with the server's public key, sends it; server decrypts with private key

5. Session Keys Derived — both sides independently derive the same symmetric session key from the client random + server random + pre-master secret

6. Encrypted Data Transfer — all further traffic encrypted symmetrically (AES) using the session key; fast and secure

Digital Signatures & Certificates

Authentication & Trust

DIGITAL SIGNATURE — How It Works

Sender hashes the message (e.g. SHA-256) → produces a fixed-length digest

Sender encrypts the hash with their private key → this is the signature

Recipient decrypts signature with sender's public key → recovers hash

Recipient re-hashes the message and compares — if equal: message is authentic and unmodified

Provides: authenticity (sender is who they claim), integrity (message not altered), non-repudiation (sender cannot deny sending)

DIGITAL CERTIFICATE — What It Contains

Owner's name and domain (e.g. *.bank.co.uk)

Owner's public key

Valid from / expiry date

Issuing Certificate Authority (CA) name

CA's digital signature over the above data

CA = trusted third-party (DigiCert, Let's Encrypt). Browser has built-in list of trusted CAs. If CA signed it → you can trust the public key inside.

Exam Practice

Cambridge-style questions

Question 1

Explain the difference between symmetric and asymmetric encryption, stating one advantage of each. [4]

1

Symmetric encryption uses a single shared key for both encryption and decryption; asymmetric uses a mathematically linked key pair — a public key (shared freely) and a private key (kept secret).

1

Advantage of symmetric: it is much faster, making it suitable for encrypting large amounts of data (e.g. bulk file encryption, streaming).

1

Advantage of asymmetric: solves the key distribution problem — the public key can be distributed openly without risk, so two parties who have never met can establish secure communication.

1

Accept also: asymmetric enables digital signatures (non-repudiation / authenticity), or that TLS uses both in a hybrid approach.

Common Mistakes

Don't lose easy marks

1

Saying "a digital signature encrypts the whole message" — a digital signature encrypts only the hash of the message, not the message itself. The message is sent separately (often in plaintext or encrypted by another means).

2

Confusing which key is used for what: to send an encrypted message to Bob, you use Bob's public key. Bob uses his private key to decrypt. For a digital signature (from Alice), Alice signs with her own private key; anyone verifies using Alice's public key.

3

Saying "SSL and TLS are the same thing" — SSL (Secure Sockets Layer) is the older, deprecated protocol with known vulnerabilities. TLS (Transport Layer Security) is the modern, secure replacement. HTTPS today uses TLS 1.2 or 1.3, not SSL — the term "SSL certificate" is a historical misnomer.

Topic Summary — 3.5.2

What You Need to Know

SYMMETRIC

One shared key, fast, used for bulk data (AES). Problem: key distribution. TLS uses symmetric (AES) for the bulk data after key exchange.

ASYMMETRIC

Public/private key pair. Encrypt with recipient's public key. Slow but solves key distribution. RSA-2048/ECC. Used for TLS key exchange and digital signatures.

TLS HANDSHAKE

Client Hello → Server Certificate → Verify CA → Key Exchange (asymmetric) → Derive session key → Symmetric encryption for data.

DIGITAL SIGNATURE / CERT

Sign = hash message → encrypt hash with private key. Verify = decrypt with public key → compare hashes. Certificate: CA-signed document binding identity to a public key.

CSZone

Next Video

3.5.3

Cybersecurity Ethics

Pen Testing · Digital Forensics · Chain of Custody

Head to CSZone.co.uk for the complete worksheet, quiz, and interactive tools