Click the padlock in your browser, check a downloaded file's hash, unlock a BitLocker drive, or click past a "publisher could not be verified" warning, and you've touched cryptography four times before lunch. Technicians use it all day without explaining it, and then the A+ exam asks exactly that: what's the difference between encrypting a file, hashing it, and signing it? The three sound alike and answer completely different questions.
CompTIA A+ Core 2 (220-1202) covers cryptography in the Security domain, under the objective that asks you to summarize security measures and their purposes. You aren't expected to do the math or run a certificate server. You are expected to know what symmetric and asymmetric encryption are, what a hash does, how digital signatures work, and which tool solves which problem, because scenario questions almost always hinge on one distinction: confidentiality, integrity, or authenticity.
Encryption exists to keep data confidential
Encryption scrambles readable data, called plaintext, into unreadable ciphertext that only someone holding the correct key can reverse. The recipe is a cipher, or encryption algorithm, and it's the key, not the algorithm, that carries the secrecy: modern algorithms are published openly, and systems stay secure because keys stay private.
The goal encryption serves is confidentiality: keeping data private from anyone not authorized to read it. The exam names two situations. Data at rest sits on storage, like files on a laptop's drive, and encrypting it protects against device theft. Data in transit moves across a network, like credentials traveling to a web server, and encrypting it defeats eavesdropping.
Draw one boundary right away: encryption is always reversible by design. With the right key, you get the plaintext back. That fact is the clean dividing line between encryption and hashing, and the exam loves to test it.
Symmetric encryption uses one shared key and does the heavy lifting
Symmetric encryption uses a single secret key for both jobs: the same key that encrypts also decrypts. Like a door key, anyone holding a copy can lock or unlock, so everything rests on controlling who has copies.
The standard symmetric algorithm today is AES, the Advanced Encryption Standard, with key lengths of 128, 192, or 256 bits; AES-256 is the common "strong" configuration. Skip the internals; recognize AES as the workhorse behind BitLocker, WPA2 and WPA3 wireless security, VPN (virtual private network) tunnels, and the bulk of every HTTPS session.
Symmetric encryption has one enormous strength and one stubborn weakness. The strength is speed: symmetric ciphers are computationally cheap, so encrypting a whole drive or a video stream causes no noticeable slowdown, which is why every system that encrypts large amounts of data uses a symmetric cipher for the payload.
The weakness is key distribution. Both parties need the same secret key, so how do you get it to the other side? Send it unprotected and an interceptor can read everything that follows, and every pair of parties needs its own key, so the key count explodes as a group grows. Remember this limitation above all, because it's the exact problem asymmetric encryption was invented to solve.
Asymmetric encryption splits the job between a public key and a private key
Asymmetric encryption, also called public key cryptography, uses two different keys generated together as a mathematically linked pair. What one key encrypts, only the other can decrypt, and there's no practical way to calculate the private key from the public key.
The private key stays secret with its owner and is never shared. The public key can be handed out freely and published anywhere, because knowing it doesn't help an attacker decrypt or forge anything.
This split enables a trick symmetric encryption can't do. A stranger encrypts a secret with your public key, and from that moment only your private key can open it, not even the sender can. Two parties who have never met can communicate confidentially: the key distribution problem is solved. The pair also works in reverse, anything processed with your private key can be verified by anyone holding your public key, the foundation of digital signatures.
Two algorithm names matter at the concept level. RSA (Rivest-Shamir-Adleman) is the classic asymmetric algorithm, built on the difficulty of factoring very large numbers, with keys commonly 2048 bits or longer. ECC (elliptic curve cryptography) achieves equivalent security with much shorter keys, which is why it dominates on phones and mobile devices. On the exam, treat both as asymmetric and don't overthink the math.
Asymmetric encryption has its own weakness: it's far slower than AES and only works efficiently on small pieces of data. Nobody encrypts a hard drive with RSA. Real systems use asymmetric encryption for the small, high-value jobs, exchanging keys and proving identity, and hand the bulk work to a symmetric cipher. That division of labor is the pattern to burn in.
| Property | Symmetric (AES) | Asymmetric (RSA, ECC) |
|---|---|---|
| Keys used | One shared secret key | Key pair: public + private |
| Same key encrypts and decrypts? | Yes | No, one key reverses the other |
| Speed | Fast, handles bulk data | Slow, small data only |
| Key distribution | Hard, secret must be shared safely | Easy, public key is freely shared |
| Typical use | Disk encryption, Wi-Fi, session data | Key exchange, digital signatures, certificates |
A hash proves integrity, not secrecy
A cryptographic hash function takes input of any size, a short password or a 6 GB disk image, and produces a fixed-length output called a hash, digest, or checksum. The same input always produces the identical hash; change a single bit and the output changes completely and unpredictably.
Here's the part students trip on: hashing is not encryption, because there is no key and no way back. A hash is a one-way function. You cannot "decrypt" a hash to recover the original data, and that's not a limitation, it's the entire point. A hash is a fingerprint, not a locked box.
The dominant family is SHA (Secure Hash Algorithm), with SHA-256 as the everyday standard and SHA-3 as a newer alternative. Recognize two older names, MD5 (Message Digest 5) and SHA-1, as deprecated: both have collision weaknesses, meaning two different inputs can be crafted to produce the same hash, which breaks the fingerprint guarantee.
What is a hash for? Integrity checking: proving data hasn't been altered. The concrete example is file-hash verification. Vendors often list a download's SHA-256 hash next to the link. After downloading, you compute the hash yourself, on Windows with Get-FileHash tool.iso in PowerShell or certutil -hashfile tool.iso SHA256. A character-for-character match means the file is bit-for-bit identical to what the vendor released; any difference means corruption or tampering, and you don't run it.
Notice the hash hid nothing; the file was never secret. It answered one question only: is this data unchanged?