A2.4.4 · Network security
Encryption and digital certificates
By the end you can
Describe symmetric and asymmetric encryption, hashing, digital signatures and certificates, and how HTTPS uses them together.
turns readable data (plaintext) into scrambled data (ciphertext) using an algorithm and a key. Anyone who intercepts the ciphertext sees nonsense; only someone with the right key can turn it back. It protects data that crosses a network and data that is stored. Everything in this section is built from two ideas: how the keys are shared, and how to prove who you are.
Symmetric encryption#
In encryption the same key locks and unlocks. If Alice and Bob share a secret key, Alice encrypts “Meet me at noon”, sends the ciphertext over any channel, and Bob decrypts it with the same key. It is fast and light on processing, so it is the way to encrypt large amounts of data. The weakness is the key exchange problem: how do two people far apart agree a secret key without anybody overhearing it? If an eavesdropper gets the key, everything is open. (The shift cipher below is the simplest symmetric cipher, and it also shows another weakness: with only 25 keys it can be broken by trying them all. Real ones such as AES have keys so large that trying them all is impossible.)
Asymmetric encryption#
(public-key) encryption solves that problem with a pair of keys. The public key can be given to anybody and is used to encrypt; the matching private key never leaves its owner and is the only thing that can decrypt. To send Bob a secret, you lock it with Bob's public key, and only Bob's private key opens it. No secret has to be shared beforehand. The price is speed: the mathematics (RSA uses very large prime numbers) is slow, so asymmetric encryption is used for small jobs: exchanging a key, signing, and certificates.
The usual answer is to combine them: use asymmetric encryption (or a key-agreement method such as Diffie-Hellman, shown below) to agree a secret key, then switch to fast symmetric encryption for the data. That is what HTTPS does.
Ciphertext sent over the internet
Rjjy rj fy stts
The receiver uses the same key to decrypt: shifting back by 5 gives “Meet me at noon”. That is symmetric encryption, and the weakness is plain: how do you get the key to the receiver safely? And with only 25 possible keys, an eavesdropper can simply try them all.
These are toys: the numbers are tiny so you can check them by hand. Real keys are hundreds of digits long, which is the whole point.
Hashing and digital signatures#
A turns any input into a short, fixed-length “fingerprint” (a digest). It is one way: you cannot get the input back from the digest, and changing even one character of the input changes the digest completely. That makes hashes ideal for checking data has not changed, and for storing passwords safely.
A proves who wrote a document and that it has not been altered. The sender hashes the document, then encrypts the hash with their private key: that is the signature, sent with the document. The receiver decrypts the signature with the sender's public key to recover the hash, hashes the document received, and compares. If they match, only the holder of the private key could have signed it, and not a single bit changed. Notice that signing uses the keys the opposite way round from secret messages.
Digital certificates#
But how do you know a public key really belongs to your bank and not to an imposter? A is an electronic document that binds a public key to an identity. It is issued by a , a trusted organisation that checks the owner and then digitally signs the certificate. Your browser comes with a list of CAs it trusts, so it can check the signature and know the server really is who it claims. Certificates are also used to sign software (so you know who wrote it and that it was not tampered with), to sign documents, to authenticate VPNs and for SSH keys.
Do not mix up the two: a digital signature proves who sent a particular document and that it is unchanged; a digital certificate proves that a public key belongs to a particular person or website.
Putting it together: HTTPS#
- The browser connects and the server sends its certificate (with its public key), signed by a CA.
- The browser checks the CA's signature. Now it knows the key belongs to the real site.
- Using asymmetric methods, the two agree a shared secret key, without ever sending it in the open.
- From then on, all the traffic is encrypted with that key using fast symmetric encryption. That is TLS, the successor to SSL.
Encrypting a 5 GB backup quickly, with a key you keep to yourself.
Two strangers need to start a secret conversation with no prior meeting.
Storing a password so that even the site cannot read it back.
Proving that a contract came from you and was not altered afterwards.
Proving to a browser that this public key belongs to the real bank.
0 of 5 matched
Check yourself
Encryption and certificates
Quick questions, made fresh every time and marked here. Do a few until they feel easy.
Exam practice
Paper 1-style questions
5 questions · 20 marks
Write your answer as you would in the exam, then show the mark points and tick each one your answer made. These are our own questions in the style of the exam, not past-paper questions.
1.State what encryption does and why it is used on a network.
[2]State: Give a short answer, no explanation needed.
2.Distinguish between symmetric and asymmetric encryption, emphasising their differences and applications.
[6]Distinguish: Make the differences between two things clear.
3.Describe the role of a digital certificate.
[4]Describe: A detailed account: say what happens, step by step if it is a process.
4.Describe how a digital signature is created and checked.
[4]Describe: A detailed account: say what happens, step by step if it is a process.
5.Explain how a browser and a web server use encryption and a certificate to set up a secure HTTPS connection.
[4]Explain: Give reasons: say what happens AND why, or how one thing causes another.
Past papers
Old exam questions on this topic
From HL Paper 1, May 2014 to November 2025. These papers were set on the previous syllabus, so the wording may differ from today's exam, but the topic is the same. Find the questions and markschemes in your school's past-paper pack.
| Paper | Question | Marks | About |
|---|---|---|---|
| May 2024 TZ1 | 12(b) | 3 | How encryption protects data (same in TZ2) |
| May 2023 TZ1 | 11(d) | 2 | Encryption inside a VPN (same in TZ2) |
| November 2019 | 10(d) | 1 | What encryption is |
In a nutshell
- Encryption turns plaintext into ciphertext using a key, so intercepted data is unreadable. Hashing is different: a one-way fixed-length fingerprint that cannot be reversed.
- Symmetric: one shared secret key. Fast, good for bulk data, but the key must be shared securely first.
- Asymmetric: a public key (to encrypt, shared with everyone) and a private key (to decrypt, kept secret). Slower; used for key exchange, signatures and certificates.
- A digital signature is a hash encrypted with the sender’s private key: it proves who sent a document and that it is unchanged. A digital certificate binds a public key to an identity, signed by a trusted certificate authority.
- HTTPS combines them: the certificate proves the server, asymmetric methods agree a key, then fast symmetric encryption protects the data.