Encryption is the process of scrambling data using an algorithm and a key, so that it becomes unreadable to anyone without the correct decryption key. It protects data in transit and at rest.
Plaintext: the original, readable data
Ciphertext: the encrypted, unreadable version
Encryption key: a value used with an algorithm to encrypt/decrypt data
Symmetric Encryption
In symmetric encryption, the same key is used to both encrypt and decrypt the data.
Fast and efficient
Problem: the key must be shared securely between parties — if intercepted, security is broken
Example: AES (Advanced Encryption Standard)
Asymmetric Encryption (Public Key Encryption)
In asymmetric encryption, there are two mathematically linked keys:
Public key: shared openly — anyone can use it to encrypt a message
Private key: kept secret by the owner — only they can decrypt messages encrypted with their public key
Solves the key-sharing problem of symmetric encryption
Used in HTTPS/SSL, digital signatures
Slower than symmetric — often used to securely exchange a symmetric key, then symmetric encryption takes over
How HTTPS Uses Encryption
When you visit a HTTPS website:
The server sends its public key (in a digital certificate)
Your browser uses the public key to encrypt a symmetric session key
The server decrypts it with its private key
From then on, the symmetric session key encrypts all communication
Authentication
Authentication is the process of verifying that a user or system is who they claim to be.
Method
Description
Examples
Something you know
Knowledge-based
Password, PIN, security questions
Something you have
Possession-based
Smart card, token, phone (2FA code)
Something you are
Biometric
Fingerprint, face ID, iris scan, voice recognition
Two-Factor Authentication (2FA)
2FA requires two different types of authentication (from two different categories above). This makes accounts much more secure because an attacker would need both factors.
Example: password (something you know) + text message code (something you have)
Even if a password is stolen, 2FA prevents access without the second factor
Digital Certificates
A digital certificate is issued by a trusted Certificate Authority (CA) to verify that a public key belongs to a legitimate website. Browsers check certificates to establish trust before connecting.
Exam tip: Know the difference between symmetric (same key) and asymmetric (public + private key pair). For authentication, know all three factors. HTTPS uses a combination of both encryption types.
⚠️ Common Mistakes
Confusing symmetric (same key) with asymmetric (two different keys)
Thinking the public key decrypts messages — only the private key can decrypt what was encrypted with the public key
Confusing authentication (who you are) with authorisation (what you're allowed to do)
Not knowing that 2FA requires factors from TWO different categories
✅ Notes completed!
▶
Video coming soon
Click slide or press arrow keys to navigate
✍️
Worksheet — 4.2 Encryption & Authentication
8 Edexcel-style questions · instantly marked
Q1What is encryption?[2]
✅ Mark scheme
Encryption is the process of scrambling/converting data using an algorithm and a key [1]; so it becomes unreadable (ciphertext) to anyone who intercepts it without the correct decryption key [1].
Q2Explain the difference between symmetric and asymmetric encryption.[4]
✅ Mark scheme
Symmetric encryption uses the same key for both encryption and decryption [1]; it is fast but the key must be shared securely [1]; asymmetric encryption uses two mathematically linked keys — a public key (to encrypt) and a private key (to decrypt) [1]; solves the key-sharing problem as the public key can be openly shared [1].
Q3In asymmetric encryption, what is the role of the public key and the private key?[2]
✅ Mark scheme
The public key is shared openly and used to encrypt messages [1]; the private key is kept secret and is the only key that can decrypt messages encrypted with the matching public key [1].
Q4What are the three types of authentication factors? Give one example of each.[3]
✅ Mark scheme
Something you know (e.g. password, PIN) [1]; something you have (e.g. phone/token for 2FA code, smart card) [1]; something you are — biometric (e.g. fingerprint, face ID) [1].
Q5Explain what two-factor authentication (2FA) is and why it is more secure than a password alone.[3]
✅ Mark scheme
2FA requires two different types of authentication from two different categories [1]; e.g. a password plus a one-time code sent to a phone [1]; even if a password is stolen/compromised, the attacker still cannot access the account without the second factor [1].
Q6Why is symmetric encryption considered less secure than asymmetric for key exchange?[2]
✅ Mark scheme
In symmetric encryption, the same key must be shared between sender and receiver [1]; if this key is intercepted during transmission, the attacker can decrypt all data encrypted with it [1].
Q7What is a digital certificate and why is it important for HTTPS?[2]
✅ Mark scheme
A digital certificate is issued by a trusted Certificate Authority (CA) to verify that a public key belongs to a legitimate website [1]; browsers check digital certificates to ensure the HTTPS connection is secure and genuine, not a fake site [1].
Q8Explain why HTTPS uses both asymmetric and symmetric encryption.[3]
✅ Mark scheme
Asymmetric encryption is used to securely exchange a symmetric session key [1]; because asymmetric encryption is slow, the faster symmetric encryption is then used for the actual data transfer [1]; this combines the security of asymmetric with the speed of symmetric encryption [1].
Topic Quiz
Q 1 of 15
You scored
out of 15
Click to reveal definition
🎉
Session complete!
Term
Definition
🎯
Mini Test — Encryption & Authentication
Timed exam-style test.
⏱10:00
Section A — Multiple Choice [5 marks]
Q1Symmetric encryption uses:[1]
Q2In asymmetric encryption, which key decrypts a message?[1]
Q3A fingerprint scan is an example of:[1]
Q4Which term describes the original, unencrypted data?[1]
Q5Two-factor authentication is more secure because:[1]
Section B — Short Answer
Q6Explain the difference between symmetric and asymmetric encryption. Include how HTTPS uses both.[3]
Mark schemeSymmetric: same key for encrypt/decrypt [1]; fast but key must be shared securely [1]; Asymmetric: public key encrypts, private key decrypts [1]; HTTPS uses asymmetric to securely share a symmetric session key [1]; then uses symmetric for actual data transfer (faster) [1].
Q7Describe two-factor authentication (2FA) and give one real-world example.[2]
Mark scheme2FA requires two different types of verification from two different categories [1]; e.g. a password (something you know) + a one-time code sent to a phone (something you have) [1].