11.1 Reasons and Requirements for Cryptography
Key Takeaways
- SSCP Domain 5 (Cryptography) is weighted at 9% on the outline effective 1 October 2025. Knowledge area 5.1 is reasons and requirements: confidentiality, integrity and authenticity, data sensitivity (PII, IP, PHI), regulatory and industry best practice (PCI DSS, ISO), and cryptography entropy including quantum cryptography and quantum key distribution.
- Encryption provides confidentiality. It does not, by itself, prove who sent a file or that the ciphertext was not flipped. Integrity and authenticity need hashes, HMAC, authenticated encryption, or digital signatures.
- Personally identifiable information (PII), intellectual property (IP), and protected health information (PHI) are named sensitivity classes on the outline. Classification drives which data must be encrypted, hashed, or tokenized — not a single house algorithm applied blindly.
- PCI DSS Requirement 3 protects stored account data; Requirement 4 requires strong cryptography when cardholder data crosses open, public networks. ISO/IEC 27001/27002 require a cryptography policy and key management inside an information security management system, not a specific exam bit length.
- Protect data in three states: at rest (volume, file, or database encryption), in transit (TLS, IPsec, SSH), and in use (memory, queries, AI training and inference). Quantum key distribution is a physics-based key-exchange method; it is not a substitute for AES on disks, and it is not the same as post-quantum algorithms such as ML-KEM.
Why reasons and requirements come before algorithms
Domain 5 of the ISC2 Systems Security Certified Practitioner (SSCP) exam — Cryptography — is weighted at 9% under the outline effective 1 October 2025. Knowledge area 5.1 is Understand reasons and requirements for cryptography. The outline lists five bullets, and they are the exam's authority:
- Confidentiality
- Integrity and authenticity
- Data sensitivity (personally identifiable information (PII), intellectual property (IP), protected health information (PHI))
- Regulatory and industry best practice (Payment Card Industry Data Security Standard (PCI DSS), International Organization for Standardization (ISO))
- Cryptography entropy (quantum cryptography, quantum key distribution)
The SSCP is a practitioner credential. You are not being asked to invent a block cipher. You are being asked to decide why a file server, a backup, a TLS listener, or an application memory space needs cryptography, which security property that control is supposed to deliver, and which policy or standard makes the control mandatory even when a vice president calls it optional. Knowledge area 5.2 (the next two sections) is where hashing, salting, Advanced Encryption Standard (AES), Rivest–Shamir–Adleman (RSA), elliptic-curve cryptography (ECC), signatures, Hash-based Message Authentication Code (HMAC), and cryptanalysis live. Mixing those layers is a common Computerized Adaptive Testing (CAT) trap: encrypting a password when you needed a salted hash, or hashing a payroll file when you needed confidentiality.
Domain 1.2 already defined the security concepts. This knowledge area is the cryptographic implementation of those concepts plus the compliance and physics constraints that force you to use them.
Confidentiality
Confidentiality is the property that information is not disclosed to unauthorized people, processes, or devices. Cryptography's tool for that property is encryption: a reversible transform that, without the correct key, yields unreadable ciphertext.
On an SSCP shift, confidentiality failures look ordinary:
- A stolen laptop whose disk was never encrypted.
- A backup tape (or object-storage bucket) copied offsite in cleartext.
- Cardholder data posted to a help-desk ticket.
- An application log that prints session tokens.
- An AI training job that slurps production PHI into a lab bucket.
Encryption is necessary and not sufficient. Ciphertext can still be cut-and-paste modified. An attacker who cannot read a database can still scramble rows, replay an old ciphertext, or copy the ciphertext to another host that has the same key. Confidentiality answers "can they read it?" It does not answer "did it change?" or "who sent it?" Those are integrity, authenticity, and non-repudiation — later bullets and later sections.
Authenticated encryption (for example AES in Galois/Counter Mode (GCM)) binds confidentiality to integrity in one construction. Classic cipher-block-chaining (CBC) mode does not, which is why operations still pair older modes with an HMAC. The exam idea is the split of properties, not a mandate to recite every AES mode.
Integrity and authenticity
Integrity means data has not been altered in an unauthorized or undetected way. Authenticity means the data (or the session) came from the claimed source. Cryptography gives you three everyday tools; they are not interchangeable.
| Goal | Typical primitive | What an SSCP can conclude |
|---|---|---|
| Detect change of a known-good file | Cryptographic hash (SHA-256 of a vendor ISO) | The bits match this digest. Anyone who can rewrite the digest store can lie. |
| Detect change and prove a holder of a shared secret produced the message | HMAC | A party without the key cannot forge a valid tag. Either party who has the key can, so HMAC is not non-repudiation. |
| Detect change, prove origin, and support non-repudiation | Digital signature over a hash, using a private key | Only the private-key holder should be able to produce the signature. Certificates bind that key to an identity (knowledge area 5.4). |
A hash of payroll.csv sitting next to the file on the same share is a weak integrity control: the attacker who edits the spreadsheet also edits payroll.csv.sha256. A hash published on a separate, trusted channel — or a signature whose public key is already in the firmware trust store — is the operational pattern.
Scenario. You administer a regional clinic. A vendor drops pacs-update.bin on an HTTPS site. Confidentiality of the download path (TLS) does not prove the vendor built that binary. Integrity of a SHA-256 listed on the same compromised site does not either. Authenticity is a signature you verify with a public key you already trust. That is why 5.1 lists integrity and authenticity together: a hash without a trust anchor is only a checksum with better math.
Data sensitivity: PII, IP, and PHI
The outline names three examples. Sensitivity is not a feeling; it is a classification that drives cryptographic policy.
| Class | What it is | Why cryptography is required | Typical SSCP control |
|---|---|---|---|
| PII | Data that identifies a person (name plus national ID, account number, home address, biometric template) | Privacy law, contract, and breach-cost. Cleartext PII on a laptop or SaaS export is a reportable incident in many jurisdictions. | Encrypt at rest and in transit; tokenize or truncate where the business does not need the raw value; hash identifiers only with a salt or key when the use is matching, not recovery. |
| IP | Trade secrets, source code, chip designs, pricing models, unpublished research | Competitors and insiders. Loss is often undetected until a product ships. | Encrypt repositories and build artifacts; protect keys in a hardware security module (HSM) or cloud key-management service; log and sign access. |
| PHI | Health information tied to an individual (diagnoses, claims, images, device telemetry) | Health privacy regimes (in the United States, the Health Insurance Portability and Accountability Act (HIPAA) Security Rule treats encryption as an addressable specification — if you do not encrypt, you must document an equivalent). Industry practice still encrypts PHI at rest and in transit. | Full-disk or volume encryption on endpoints and servers; TLS for exchanges; no PHI in ticket bodies or model-training sets without a de-identification design. |
Do not treat these classes as one bucket. Hashing a primary account number to make it unreadable is a PCI pattern. Hashing a medical image does not hide the image. Encrypting a password so help desk can decrypt it for the user is the wrong tool for a verifier (5.2). Classification first, primitive second.
Public data (a press release) does not need confidentiality controls. It may still need integrity (so an attacker cannot deface it) and authenticity (so readers know it came from the hospital, not a look-alike domain).
Regulatory and industry best practice: PCI DSS and ISO
Outline 5.1 names PCI DSS and ISO as the example drivers. They are not the only laws that mention crypto, and they are not an SSCP-issued bit-length table. They are why a control exists even when the local team "has not had a breach."
PCI DSS
The Payment Card Industry Data Security Standard applies to entities that store, process, or transmit cardholder data or sensitive authentication data, or that can affect the security of the cardholder data environment. PCI DSS v4.0 / v4.0.1 is the current standard family. Two requirements dominate 5.1 items:
- Requirement 3 — Protect stored account data. Limit retention. Mask the primary account number (PAN) when displayed. Render the PAN unreadable anywhere it is stored using strong cryptography, truncation, index tokens, or a one-way hash based on strong cryptography. Disk or volume encryption of a whole server is not automatically enough if the operating system mounts the volume and the application sees plaintext PAN.
- Requirement 4 — Protect cardholder data with strong cryptography during transmission over open, public networks. Use current protocols (in practice TLS 1.2 or higher; SSL and early TLS are retired). Do not send unprotected PAN through end-user messaging (email, chat, SMS).
PCI DSS also cares about key management: generation, storage, rotation, custody split so that one person cannot both use and steal the data-encrypting key. That detail belongs with knowledge area 5.4, but 5.1 already expects you to know that "we turned on AES" is incomplete if the key sits in C:\keys\aes.key on the same host.
ISO
ISO/IEC 27001 is the management-system standard for information security. ISO/IEC 27002 is the control catalog. Current 27002 control 8.24 Use of cryptography (the 2022 numbering) expects a cryptography policy: which algorithms and key lengths are approved, how keys are generated and protected, how they are changed and destroyed, and who may use them. ISO does not publish "the SSCP number of bits." An ISO-aligned shop still maps its policy to current national guidance (for example NIST-approved AES-128/192/256 and RSA 2048-bit or larger) and to the data classification from the previous heading.
Other ISO work (ISO/IEC 19790 for cryptographic modules, algorithm standards in the 18033 family) exists for specialists. For the CAT item, ISO means: documented policy, approved primitives, and key lifecycle — not a sticker that replaces PCI DSS. A card processor can hold an ISO 27001 certificate and still fail PCI DSS Requirement 3 if PANs are stored in cleartext.
Scenario. You are the security administrator for a mid-size e-commerce firm. Marketing wants order dumps in a shared spreadsheet, including full PAN, emailed to a contractor. PCI DSS Requirement 3 forbids storing readable PAN there; Requirement 4 forbids mailing it unprotected. ISO 27001 does not give marketing a waiver. Truncate or tokenize the PAN, send the contractor an access-controlled report, and keep the data-encrypting keys out of the spreadsheet.
Encryption at rest, in transit, and in use
ISC2's Domain 5 discussion of AI workloads is explicit that practitioners must secure data in use during training and inference, not only ciphertext on disk and on the wire. The three states are an operations checklist.
| State | Meaning | Common SSCP controls | Failure if skipped |
|---|---|---|---|
| At rest | Data on disk, tape, object storage, backups, snapshots, lost laptops | BitLocker / FileVault / LUKS, database transparent data encryption, application-level field encryption, encrypted backup jobs | Stolen media is instantly readable. Snapshots inherit the same mistake. |
| In transit | Data crossing a network, including "internal" links and APIs | TLS for web and APIs, IPsec or TLS VPNs, SSH, server-to-server mutual TLS | On-path attackers read or alter sessions. "The VLAN is trusted" is not a cryptographic argument. |
| In use | Data decrypted for processing: RAM, CPU caches, query results, ML feature stores, prompts | Minimize plaintext lifetime, encrypt application memory where the platform supports it, confidential computing / trusted execution environments, do not dump production PHI into an AI notebook, protect swap and crash dumps | A process dump, a malicious hypervisor, or a training pipeline sees the records you encrypted everywhere else. |
Encrypting a volume and enabling TLS does not encrypt the SQL result set sitting in the application pool, the DICOM image the radiologist has open, or the prompt a support chatbot just received. Homomorphic encryption and secure enclaves exist; most SSCP shops will instead reduce what is decrypted, isolate the processing host, and keep keys out of the application config file.
Cryptography entropy, quantum cryptography, and QKD
Entropy here means unpredictability of keys, initialization vectors, nonces, salts, and session secrets. A mathematically strong algorithm with a guessable key is a weak system. Operations entropy failures are concrete:
- Virtual machines cloned from one gold image that already generated a host key.
- Embedded devices that boot with an empty entropy pool and mint TLS certificates in the first second.
- Passwords or "random" keys derived from timestamps, hostnames, or
Math.random()in a language whose default generator is not cryptographic. - Reused initialization vectors with AES-GCM, which can break authenticity and leak plaintext.
Use an operating-system cryptographically secure pseudorandom number generator (for example getrandom(), /dev/urandom on modern kernels, platform CNG). Seed from hardware random number generators when the platform has them. After cloning a VM, regenerate host keys and machine identities.
Quantum cryptography on the outline is illustrated with quantum key distribution (QKD). QKD uses quantum properties of photons (measurement disturbs the state; unknown states cannot be cloned) so that eavesdropping on the key-exchange channel is detectable. QKD distributes or agrees keys. It is not a disk-encryption algorithm, it is not widely deployed in typical enterprise data centers, and it does not retire AES. After QKD (or any other key-agreement method) you still encrypt bulk data with a symmetric cipher.
Do not confuse QKD with post-quantum cryptography (PQC). PQC is classical software (lattice, hash-based, and related schemes) designed to remain hard even if a cryptographically relevant quantum computer appears. NIST finalized FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA) in August 2024. Shor's algorithm would break RSA and ECC key agreement and signatures; Grover's algorithm weakens symmetric ciphers and hashes, which is why long-lived secrets often prefer AES-256 over AES-128 when quantum risk is in the threat model. No public, practical break of 2048-bit RSA or AES-128 by a quantum computer exists today. The operational worry is harvest now, decrypt later: an attacker records TLS ciphertext this year and waits.
Exam traps for 5.1
- Treating encryption as integrity.
- Treating a hash as confidentiality.
- Claiming PCI DSS is satisfied by whole-disk encryption while PAN is clear in the database the OS has mounted.
- Claiming ISO 27001 replaces PCI DSS for card data.
- Claiming QKD must be installed in every retail store, or that RSA is already broken in production.
- Encrypting at rest and in transit and then pouring PHI into an ungoverned AI training set (data in use).
When the stem names a property, pick the property. When it names PCI DSS or ISO, pick the requirement those frameworks actually impose. When it names quantum, separate QKD (physics key distribution) from PQC (new algorithms) from "AES stopped working this morning."
A hospital stores electronic health records on a file server. Leadership asks for a control that primarily provides confidentiality of PHI at rest. Which action matches SSCP knowledge area 5.1?
A payment processor stores primary account numbers in an application database and emails full PAN to a contractor. Staff argue that an ISO/IEC 27001 certificate and MD5 fingerprints of the database files already cover cryptography requirements. What is correct for SSCP 5.1?
A SOC analyst reports that the electronic health record database is encrypted at rest and that clinic APIs use TLS. A data-science team still copies identifiable PHI into a cleartext notebook for model training. Which 5.1 gap is this?