If you send a private message over the internet and anyone else can read it, your passwords, bank details, and personal secrets are completely exposed. Cryptography is the ancient art of scrambling that message so only the intended recipient can unscramble it, and it is the single most important defence you have as a security professional. For the SSCP exam, you must understand the simplest but most widely used form of this protection: symmetric encryption, where the same secret key locks and unlocks the data.
Jump to a section
A simple way to picture Cryptography Basics and Symmetric Encryption
A head chef at a busy restaurant kitchen has a single, heavy-duty safe bolted to the floor near the pass.
This safe uses one master key that the chef keeps on a lanyard around her neck. When a line cook needs to lock away a special sauce recipe, the chef uses that same key to lock the safe. When the sous-chef needs to retrieve the expensive truffle oil, the chef uses that same key again to unlock it. Everyone in the kitchen who needs to secure or retrieve an ingredient must come to the chef, who uses the single key for both locking and unlocking.
The key itself is the shared secret. If a rival chef from another restaurant steals a copy of that key, they can open the safe and steal the recipes or the truffle oil. This is why the chef guards the key with her life, never leaves it on the counter, and changes the lock immediately if the key is ever lost, even for a moment.
In exactly the same way, symmetric encryption uses one shared secret key to both lock (encrypt) and unlock (decrypt) your digital data. The security of everything inside the safe depends entirely on keeping that single key private.
Cryptography comes from the Greek words kryptos (hidden) and graphein (to write). At its simplest, it is the practice of turning a readable message (called plaintext) into scrambled nonsense (called ciphertext) so that an eavesdropper cannot understand it. The process of turning plaintext into ciphertext is called encryption. The reverse process, turning ciphertext back into plaintext, is called decryption.
Symmetric encryption is the oldest and most intuitive form of encryption. The defining characteristic is that both encryption and decryption use the same exact key. Think of the key as a digital password or a physical key to a padlock: you use the same key to lock it and to unlock it. This single shared key must be kept secret between the sender and the receiver. If an attacker obtains that key, they can decrypt every message ever sent using that key.
Why does this matter for the SSCP? You will be responsible for choosing, configuring, and managing the encryption systems that protect an organisation's data. Symmetric encryption is fast and efficient, which is why it is used to encrypt bulk data like entire hard drives, database contents, and large files. The downside is the key distribution problem: how do you securely share that single key with someone on the other side of the world before you start encrypting messages?
There are several important symmetric encryption algorithms you need to know for the exam:
DES (Data Encryption Standard): Developed in the 1970s, DES uses a 56-bit key. This is now considered hopelessly weak because a modern computer can crack a 56-bit key in less than a day.
3DES (Triple DES): An improvement that applies DES three times with two or three different keys. It is more secure than DES but much slower and is being phased out in favour of AES.
AES (Advanced Encryption Standard): The current gold standard. AES uses key sizes of 128, 192, or 256 bits. A 128-bit key would take billions of years to brute-force with today's technology. AES is used everywhere, from Wi-Fi (WPA2/WPA3) to government classified data.
Blowfish and Twofish: Older but still secure algorithms. Blowfish uses key sizes from 32 to 448 bits and is known for its speed. Twofish is a newer version that was a finalist in the competition to become AES.
All symmetric algorithms rely on two key operations: substitution (replacing one piece of data with another according to the key) and permutation (reordering the data bits according to the key). Together, these operations create confusion and diffusion, making the ciphertext statistically unrelated to the plaintext.
The size of the key (measured in bits) directly determines how hard it is to break the encryption by trying every possible key, a method called brute force. Doubling the key length does not just double the security; it squares it. A 64-bit key has 2 to the power of 64 possible combinations, while a 128-bit key has 2 to the power of 128, which is an astronomically larger number.
In practice, symmetric encryption is always used with a mode of operation, which defines how the algorithm processes data that is longer than its block size (e.g., AES uses 128-bit blocks). Common modes you will see on the SSCP:
ECB (Electronic Codebook): The simplest mode, but dangerous because identical plaintext blocks produce identical ciphertext blocks, leaking patterns. Do not use ECB for anything important.
CBC (Cipher Block Chaining): Each plaintext block is XORed (a binary operation) with the previous ciphertext block before encryption. This removes patterns but requires an initialisation vector (IV) for the first block.
GCM (Galois/Counter Mode): Combines encryption with authentication, providing both confidentiality and integrity. GCM is very popular for network security (e.g., TLS 1.3).
You will also need to understand the concept of a cryptographic primitive: the basic building block of a cryptographic system. For symmetric encryption, the primitive is the block cipher itself (like AES), and the mode of operation turns that block cipher into a stream cipher that can handle messages of any length.
1. Plaintext Input
You start with the original readable message, called plaintext. This could be a document, an email, a file, or any digital data. For example, the message 'HELLO' is plaintext. The entire encryption process depends on the plaintext being binary data (a sequence of 0s and 1s) that the computer can manipulate.
2. Key Generation
A secret key is generated, typically using a cryptographically secure random number generator (CSPRNG). The key is a random sequence of bits of a fixed length, such as 128, 192, or 256 bits for AES. This key must be kept completely secret and shared only with the intended recipient through a separate secure channel.
3. Encryption Algorithm Applied
The symmetric encryption algorithm (e.g., AES-128) takes the plaintext and the key as inputs. It runs the plaintext through multiple rounds of substitution, permutation, and XOR operations, as defined by the specific algorithm and its mode of operation (e.g., CBC or GCM). The output is ciphertext, which looks like random gibberish.
4. Ciphertext Transmission or Storage
The ciphertext is now safe to send over an insecure channel (like the internet) or store on an untrusted device (like a cloud server). An eavesdropper who intercepts the ciphertext cannot read it because they do not have the secret key. The original plaintext is effectively hidden.
5. Key Exchange (Secure)
Before the recipient can decrypt the ciphertext, they must obtain the same key. This step is the Achilles' heel of symmetric encryption. The key must be exchanged via a secure method, such as in person, over a separate encrypted channel, or using an asymmetric encryption method (like Diffie-Hellman key exchange) to wrap the symmetric key.
6. Decryption
The recipient receives the ciphertext and uses the same shared secret key with the identical symmetric algorithm. The algorithm reverses the substitution, permutation, and XOR steps (because they are mathematically invertible with the same key) to recover the original plaintext. The recipient can now read the message.
7. Key Destruction or Rotation
After the message is decrypted, the key should be securely erased for ephemeral communications. For stored data, the key must be kept securely (e.g., in a key vault) and rotated periodically according to organisational policy. If the key is lost, the data is permanently unrecoverable, which is why key management is a critical responsibility.
Imagine you are the junior IT administrator at a mid-sized accounting firm. The company has just been hit with a ransomware attack that encrypted all financial records for the past decade. The attackers are demanding 50 bitcoins. Your boss asks you: how do we protect against this happening again?
Your first task is to implement full-disk encryption on every company laptop. You use AES-256, the strongest symmetric encryption algorithm widely available. Here is what you do step by step:
You choose a tool like BitLocker (for Windows) or FileVault (for macOS).
You configure the tool to use AES with a 256-bit key.
The tool generates a random key, which it uses to encrypt every bit of data written to the hard drive.
You back up that key to the company's hardware security module (HSM) in a safe in the server room.
You enforce a policy that the encryption key is never stored on the same laptop.
Now, when an attacker steals a laptop and tries to read the hard drive by connecting it to another computer, they see only ciphertext: random garbage. The files are completely useless without the key stored securely in the office.
Next, you must secure email communication between your accountants and clients. You cannot use symmetric encryption alone here because you would need to send the key to the client securely (the key distribution problem). So you combine symmetric encryption with asymmetric encryption (which you will learn in the next chapter). For the exam, just know that in practice, symmetric encryption is almost always used to encrypt the actual message (bulk data), while asymmetric encryption is used to securely exchange the symmetric key.
Your final task is to encrypt the company's backups stored in the cloud. The backup service allows you to provide your own encryption key. You generate a 256-bit key, encrypt the backups locally on your server before upload, and store the key in a cloud key management service (KMS). Even if the backup provider suffers a data breach, the attackers cannot read your data.
The real-world lesson is that you, as the IT professional, are responsible for:
Selecting the correct encryption algorithm and key length for the use case.
Ensuring the key is generated using a trusted random number generator.
Storing the key in a secure location (never in the same place as the encrypted data).
Rotating the key periodically (changing it to a new one) to limit the damage if a key is ever compromised.
Documenting which data is encrypted with which key, so you can recover it later.
The SSCP exam will test your understanding of symmetric encryption in several specific ways. You must know the algorithms, their key sizes, their strengths, and their weaknesses. The examiners love to create confusion between similar-sounding terms and to set traps around deprecated algorithms.
Here are the exact concepts you must master:
Know the key sizes: DES (56-bit), 3DES (112 or 168 bits), AES (128, 192, 256 bits).
Know that DES is broken and never used in modern systems.
Know that 3DES is considered legacy and is being deprecated; NIST (National Institute of Standards and Technology) officially removed it from the approved list in 2023.
Know that AES is the current standard and is required by U.S. government agencies for classified data (up to TOP SECRET with 192- or 256-bit keys).
Understand the difference between a block cipher (processes data in fixed-size blocks) and a stream cipher (processes data one bit at a time). AES is a block cipher; RC4 is an example of a stream cipher, but RC4 is now considered broken.
Common exam traps:
They will ask you to identify which algorithm uses the smallest key and is therefore the weakest. The answer is DES with 56 bits.
They will present a scenario where a company is using an outdated encryption standard. You must recommend AES as the replacement.
They will ask you what problem symmetric encryption introduces. The answer is key distribution: how do you get the shared key to both parties securely?
They will ask about modes of operation. You must know that ECB is unsafe because it leaks patterns, and that GCM provides authentication in addition to encryption.
They will test your understanding that symmetric encryption provides confidentiality (keeping data secret) but not authentication (proving who sent it) or integrity (proving it was not altered). Those other properties require additional mechanisms like a message authentication code (MAC) or digital signatures.
Exam topics to memorise:
The four types of symmetric algorithm transformations: substitution, permutation/transposition, product ciphers (combining substitution and permutation), and XOR operations.
The concept of a cryptovariable: the key used in the algorithm.
The concept of initialisation vector (IV): a random value used to ensure that encrypting the same plaintext twice produces different ciphertext.
The concept of work factor: the amount of computational effort required to break an algorithm. Larger key sizes increase the work factor exponentially.
The exam will also test the historical progression: why DES was replaced by 3DES, and why 3DES was replaced by AES. The answer is always that DES's key was too short to withstand brute-force attacks with modern hardware.
Symmetric encryption uses one shared secret key for both encryption and decryption, which is both its strength (speed) and its weakness (key distribution).
AES with a 128-bit or 256-bit key is the modern standard for symmetric encryption, and DES is completely broken and must never be used.
The key size (in bits) determines how long it takes an attacker to break the encryption via brute force; doubling the key length squares the difficulty.
ECB mode is unsafe because identical plaintext blocks produce identical ciphertext blocks, leaking patterns in the data.
Symmetric encryption provides confidentiality only — it does not provide authentication or integrity on its own.
The biggest practical challenge of symmetric encryption is securely distributing the shared key to both parties without an eavesdropper intercepting it.
3DES is being deprecated and should not be used in new systems; migrate to AES wherever possible.
A strong encryption algorithm with a weak key (e.g., one generated by a flawed random number generator) is no more secure than a weak algorithm.
These come up on the exam all the time. Here's how to tell them apart.
Symmetric Encryption
Uses the same key for encryption and decryption
Much faster and more efficient for large data
Key distribution is a major challenge
Asymmetric Encryption
Uses a public key for encryption and a private key for decryption
Slower and used mainly for key exchange and digital signatures
Key distribution is easier because the public key can be shared openly
Block Cipher (e.g., AES)
Encrypts data in fixed-size blocks (e.g., 128 bits)
More secure when properly implemented
Requires a mode of operation (CBC, GCM, etc.)
Stream Cipher (e.g., RC4)
Encrypts data one bit or byte at a time
Faster in hardware but often less secure
Vulnerable to certain attacks if the same key is reused
AES-128
Uses a 128-bit key
Currently considered secure for all non-classified data
Faster than AES-256 because it uses 10 rounds instead of 14
AES-256
Uses a 256-bit key
Required for U.S. government TOP SECRET data
Slightly slower due to 14 rounds of processing
ECB Mode
Each block encrypted independently
Produces identical ciphertext for identical plaintext blocks
Vulnerable to pattern analysis; should not be used
CBC Mode
Each plaintext block is XORed with the previous ciphertext block
Requires an initialisation vector (IV) for the first block
Hides patterns; considered more secure than ECB
Confidentiality
Ensures data cannot be read by unauthorised parties
Provided by encryption algorithms (symmetric and asymmetric)
Does not detect if data has been altered
Integrity
Ensures data has not been modified in transit or storage
Provided by hashing or message authentication codes (MACs)
Does not keep data secret
Key Size (56-bit DES)
2^56 possible keys (about 72 quadrillion)
Broken in less than a day with modern hardware
Obsolete for any secure use
Key Size (256-bit AES)
2^256 possible keys (immensely larger than 2^56)
Would take billions of years to brute-force
Current standard for all sensitive data
Mistake
Encryption means the data is completely unhackable and no one can ever access it.
Correct
Encryption only provides confidentiality against unauthorised parties while the key remains secret. If the key is stolen, guessed, or if the algorithm has a known vulnerability, the data can be decrypted. Encryption is a powerful tool, but it is not a magic shield.
Vendors and the media often describe encryption as 'unbreakable', which creates an unrealistic sense of security. In reality, poor key management or weak algorithms can completely bypass the protection.
Mistake
A longer key always means a more secure system.
Correct
A longer key increases resistance to brute-force attacks, but if the random number generator used to create the key is flawed, or if the algorithm has a mathematical weakness, the security collapses regardless of key length. Key generation quality and implementation correctness are equally critical.
People naturally assume more is better, but security is a chain with many links. A weak random number generator (like the one famously broken in early Android devices) can produce predictable keys that can be guessed in seconds, even if they are 256 bits long.
Mistake
Symmetric encryption and asymmetric encryption are interchangeable; you can use either for any task.
Correct
They serve different purposes. Symmetric encryption is fast and efficient for bulk data encryption (like whole hard drives or large files). Asymmetric encryption is slow and is primarily used for key exchange, digital signatures, and small data. In practice, they are combined: asymmetric encryption securely shares the symmetric key, and symmetric encryption encrypts the data.
Both terms contain the word 'encryption', so beginners assume they are just two flavours of the same thing. The confusion persists because many consumer tools hide the complexity, making the underlying architecture invisible.
Mistake
Once encrypted, you can never change the data without decrypting it first.
Correct
Some modes of operation, like GCM and CCM, are authenticated encryption modes that also detect tampering, but the underlying encrypted data is essentially a sequence of bits. However, modern encryption systems often allow key rotation or re-encryption without decrypting the entire dataset, using techniques like envelope encryption.
The idea of 'locking' something away implies it is static and untouchable. In reality, data often needs to be processed or migrated, so the industry has developed sophisticated methods to manage encrypted data at scale.
Mistake
If a file is encrypted, the filename and the date it was created are also hidden.
Correct
Symmetric encryption typically only scrambles the contents of the file (the data itself). Metadata such as the filename, folder structure, file size, and timestamps often remain visible without encryption, unless special measures (like whole-disk encryption or a tool that encrypts metadata) are taken.
Movies and TV shows often depict encryption as a magical process that hides everything. In reality, the file system stores metadata separately, and standard encryption tools leave that visible unless explicitly configured otherwise.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Encryption is a two-way process: you can encrypt plaintext into ciphertext and then decrypt it back to plaintext using a key. Hashing is a one-way process: it turns data into a fixed-size hash that cannot be reversed to recover the original data. Hashing is used for verifying integrity (e.g., password storage), not for secrecy.
No, you should use a different key for each purpose or each data set. If one key is compromised, only the data encrypted with that key is exposed. Using a single key across all systems is called key reuse and is a critical security risk. The SSCP exam will test you on the importance of key separation.
If you lose the key, the encrypted data becomes permanently unrecoverable. There is no backdoor or 'forgot password' option in symmetric encryption. This is why key management and backup are essential roles for an IT professional. Always store a backup copy of the key in a separate secure location.
No, although they are conceptually similar. A password is often used to derive a symmetric key through a key derivation function (KDF). But a symmetric key itself is a random sequence of bits, not a human-memorisable word. Key length is measured in bits (e.g., 256 bits), while passwords are measured in characters.
DES uses a key of only 56 bits. In 1999, a supercomputer cracked a DES key in 22 hours. Today, even a modest consumer computer can break a 56-bit key in hours using brute-force attack (trying every possible key). Any organisation still using DES is vulnerable to immediate data exposure.
A block cipher encrypts data in fixed-size blocks (e.g., AES encrypts 128 bits at a time). A stream cipher encrypts data one bit or one byte at a time, like a continuous stream. Some block ciphers can be turned into stream ciphers by using a mode of operation like CTR (counter mode). The SSCP expects you to know which is which.
You've finished Cryptography Basics and Symmetric Encryption. Continue through the SSCP study guide to build a complete picture of the exam.
Done with this chapter?