17 Encryption and digital certificates
Distinguish symmetric and asymmetric encryption, explain TLS and assess the role of certificates and quantum cryptography.
Section 17 · Encryption and digital certificates
Mapped to Cambridge International AS & A Level Computer Science 9618, 2027–2029 Version 2. These original lessons and self-checks are independent study support; they are not Cambridge papers, official marks or grades. The course does not yet provide a timed four-paper simulation or a locked-down Paper 4 programming environment.
Before you begin
- Use the 2027–2029 syllabus for your exam year. AS candidates study Sections 1–12; A Level candidates study Sections 1–20. Paper 4 uses a programming language chosen from Python, Java or Visual Basic in console mode.
Work on paper. Try each question before revealing help, and explain why your method works.
Quick readiness check
What does TLS help protect?
What you will learn
- Explain the key representations, structures or processes in this syllabus section
- Apply the method to a new computer-science example
- Justify a design choice and check its limits
Keys support confidentiality and authenticity in different ways
Symmetric cryptography uses the same secret key to encrypt and decrypt; it is efficient for large data but the parties need a secure way to share the key. Asymmetric cryptography uses a public/private key pair.
To send a private message to an organisation, a sender encrypts with the recipient's public key; the recipient uses its private key to decrypt. To provide a verifiable signature, the sender signs with its private key and others use the public key to verify. Confidentiality and authentication are distinct goals.
TLS combines mechanisms for a secure session
TLS protects client-server communication using certificates to authenticate a server and establish or protect session keys. A certificate binds an identity to a public key and is signed by a certificate authority trusted through a chain.
A digital signature supports integrity and authenticity but does not by itself make a message confidential. Quantum cryptography uses quantum effects to detect some interception attempts, but it has cost, distance and deployment limitations; it does not automatically solve every security problem.
Pause and explain
What does a digital certificate primarily bind?
Worked example
A client wants to send a confidential session key to a server whose certificate it has verified. Which key encrypts the key, and which decrypts it?
Show the worked solution
- Use the server's authenticated public key to encrypt.
- Only the corresponding private key should decrypt that asymmetric ciphertext.
- The session key can then protect the bulk data efficiently with symmetric encryption.
Answer Encrypt with the server's public key; the server decrypts with its private key.
Try a topic test
Choose Easy, Normal or Difficult. Save your answers and open worked review after finishing.
Test this topic →From guided practice to a new situation
Write your answer and reasoning first. Use a hint only if you are stuck. The model solution is for self-checking; your written work is not automatically marked.
A sender signs a message using a private key. Which key lets a recipient verify the signature, and what security property does verification support?
Give me a hint
Use the matching public key and distinguish a signature from encryption for secrecy.
Compare my reasoning
- The recipient uses the sender's public key.
- Successful verification supports the claim that the signature matches the message and the sender's private key.
- It does not by itself hide the message contents.
The sender's public key; verification supports authenticity and integrity, not confidentiality by itself.
Look for these in your work
- Matching key identified
- Signature purpose explained
- Confidentiality distinguished
A browser receives a certificate for example.org. State two checks it should make before trusting the server's public key.
Give me a hint
Check identity and whether the certificate chains to a trusted issuer and is valid.
Compare my reasoning
- Check that the certificate names the requested domain.
- Check issuer trust, validity period and revocation status as supported by the system.
- Then use the authenticated key during the secure handshake.
Verify the domain identity and certificate chain/validity before relying on the public key.
Look for these in your work
- Name matched
- Trust and validity checked
- Key use connected
A company compares quantum key distribution with ordinary public-key key exchange for a global service. Give one potential benefit and two deployment limits.
Give me a hint
Do not equate detection properties with universal security or unlimited distance.
Compare my reasoning
- Quantum key distribution can reveal some interception attempts on the quantum channel.
- It needs specialised equipment and a suitable communication channel.
- Distance, infrastructure cost and endpoint security still matter.
Potentially detect interception of key distribution, but specialised infrastructure, distance and endpoint risks limit deployment.
Look for these in your work
- Benefit qualified
- Two limits
- Endpoint caveat included
Common mistakes
- Encrypting with a private key and calling that confidential delivery to the key owner.
- Assuming a certificate proves a site is trustworthy in every respect.
- Claiming quantum cryptography makes all communication unbreakable.
What can you explain now?
Which key does a sender use to encrypt confidential data for a recipient in asymmetric cryptography?
Compare with the explanation
The recipient's public key
The recipient's paired private key is needed to decrypt the message.
After trying it yourself, choose your next review. This is your self-assessment.
Your review choice appears on Today. Sign in to sync it across devices.
Make it stick
How do public/private keys, symmetric session keys, TLS and certificates support different security goals?
If you needed the solution, close it and solve the problem again from a blank page. A correct answer is stronger when you can explain the reason for each step.