Security+ Cryptography Study Notes: Confidentiality Is Only One Goal
Three tools, three different goals
Confidentiality is important, but it is not the whole story in cryptography. For Security+ study, keep this split clear: encryption protects secrecy, hashing checks integrity, and digital signatures support integrity plus proof that a message came from the holder of a signing key. A hash by itself does not authenticate the sender. If two people can both calculate the same hash, the hash alone cannot prove who created the file.
Encryption answers, “Can an unauthorized person read this?” If a stolen backup drive contains encrypted files, the thief may have the data but not the readable content. Hashing answers, “Did the content change?” If even one character in a file changes, the resulting hash value should also change. A digital signature answers, “Was this content signed by the expected sender, and was it altered after signing?” That is different from encryption for confidentiality.
When reviewing core distinctions, a broader review resource like the CompTIA Security+ study guide can help you keep the security goals attached to the correct cryptographic tool instead of memorizing isolated terms.
Study example: a file backup workflow
Study example: A company creates nightly backup files for its finance department.
First, the backup software encrypts the archive before sending it to off-site storage. This step protects confidentiality. If someone intercepts the archive, encryption is meant to prevent easy reading of the contents.
Second, the company calculates a hash of the finished backup file and stores that reference hash in a trusted location protected against unauthorized replacement. The next morning, an administrator recalculates the file hash and compares it with the stored value. If the values match, the file likely was not altered. This supports integrity, not origin authentication.
Third, the backup server signs the hash with its private key before sending a verification record to another internal system. Later, that system uses the backup server’s public key to verify the signature. If verification succeeds, the receiver gains confidence that the signed data came from the private-key holder and was not changed after signing.
Notice the exam trap: signing is not the same as encrypting. A digital signature does not keep the backup secret. Encryption does not automatically prove who created the file.
Practice question with explained answer
Use targeted review from the bank of CompTIA Security+ practice questions and focus on cryptography items that ask what security objective is being met.
A company stores encrypted backups in the cloud. Each backup is also hashed, and the hash is digitally signed by the backup server. Which statement is most accurate?
- A: The hash alone proves the backup server created the file.
- B: Encryption provides confidentiality, while the digital signature helps verify origin and integrity.
- C: The digital signature keeps the backup contents secret from the cloud provider.
- D: Hashing and encryption are interchangeable because both change the data.
Correct answer: B.
Why B is correct: Encryption protects against unauthorized reading. The digital signature, verified with the signer’s public key, helps show that the signed data came from the expected private-key holder and was not modified afterward.
Why the others are wrong: A is wrong because a plain hash does not prove who created the file. C is wrong because signatures are not confidentiality controls. D is wrong because hashing and encryption serve different purposes and are not interchangeable.
Official exam reference: CompTIA Security+ certification information. These study examples are independently written.