Chapter 17 — Cryptography concepts
Lesson map
Lesson 17 published. Map, example, EX049.
flowchart TD
N0["Learning outcomes"]
N1["17.1 Symmetric encryption"]
N2["17.2 Recovery keys"]
N3["17.3 Hashing"]
N4["17.4 TLS"]
N5["17.5 Key management"]
N6["Choosing protectors"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX049"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["17.1 Symmetric encryption"]
N2["17.2 Recovery keys"]
N3["17.3 Hashing"]
N4["17.4 TLS"]
N5["17.5 Key management"]
N6["Choosing protectors"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX049"]
[Learning outcomes]
|
v
[17.1 Symmetric encryption]
|
v
[17.2 Recovery keys]
|
v
[17.3 Hashing]
|
v
[17.4 TLS]
|
v
[17.5 Key management]
|
v
[Choosing protectors]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX049]
Learning outcomes
You will (1) explain symmetric encryption, keys and hashing; (2) describe full-disk encryption; (3) manage recovery keys.
17.1 Symmetric encryption
Full-disk encryption uses a symmetric key to encrypt the disk. The key is protected by the TPM and optionally a PIN.
On Bramley's Windows laptops, BitLocker provides the full-disk encryption described in Microsoft's documentation. The same key encrypts and decrypts every block on the disk, so the laptop runs normally once unlocked. The finance manager's and chief executive's laptops add a start-up PIN, while the rest unlock through the TPM alone. Gareth notes that full-disk encryption protects the laptop only while it is off or locked, because an unlocked session can read the files like any user.
17.2 Recovery keys
If the TPM cannot release the key, a recovery key unlocks the disk. Recovery keys are stored in Bramley's directory, accessible only to IT.
A TPM may refuse to release the key after a firmware update or a hardware change, as the worked example shows. The recovery key is a long number that unlocks the disk in that case, so it must be available to IT but not to anyone who holds the laptop. Aisha checks that each laptop's recovery key is in the directory before rollout continues.
17.3 Hashing
Hashes detect file changes and verify downloads.
A hash is a short fixed-length value computed from a file, and changing even one byte changes the hash. Gareth compares the hash of each downloaded installer with the vendor's published value before deploying it. Aisha also records hashes of her baseline evidence files, so any later change to those files would be detectable. A hash is not encryption: it does not hide the file, it only shows whether the file has changed since the hash was recorded.
17.4 TLS
VPN and web traffic are protected in transit.
The VPN encrypts traffic between home laptops and the office, so file share traffic is not readable on a home or café network. Web traffic to the housing system and email uses HTTPS. Aisha notes one gap in transit: tenant documents emailed to the partner agency, which she marks for review in the system model. Transit protection and disk encryption cover different moments, so Bramley needs both: one for files moving over networks, one for files stored on laptops.
17.5 Key management
Losing recovery keys can lock out data; leaking them defeats encryption.
Bramley stores recovery keys only in the directory, readable by IT, and not on paper in desks. One laptop's key turns out to be missing because it was encrypted by hand before the rollout, which shows why verification must include the keys. Gareth's recovery test on a lab laptop confirms that a key can be found and used quickly. Aisha writes the rule into the encryption runbook: no laptop group is encrypted until the previous group's recovery keys are confirmed in the directory.
Choosing protectors
Encryption keys can be protected by the TPM alone or by the TPM plus a PIN entered at start-up. TPM-only is convenient: the laptop starts normally and the disk unlocks only if the boot components are as expected. A PIN adds protection against some physical attacks but adds a step for staff. Following Microsoft's BitLocker guidance and its own risk, Bramley chooses TPM-only for most laptops and TPM plus PIN for the two laptops used by the finance manager and chief executive, which hold the most sensitive data.
Aisha records the reasoning so the choice can be revisited if risks change.
She also explains hashing with a practical example: Gareth checks the hash of a downloaded installer against the vendor's published value before deploying it, confirming the file was not corrupted or replaced.
Worked example
During rollout, a laptop asks for its recovery key after a firmware update. Gareth retrieves it from the directory in two minutes, demonstrating why escrow matters.
Synthetic case. Synthetic.
Errors and limits
Encryption without recovery planning risks data loss.
Exercises
- EX049 — Key protection. How is the disk key protected? Rubric: 3 = TPM, optional PIN; 2 = partial; 1 = vague; 0 = none.
- EX050 — Recovery storage. Where are recovery keys stored? Rubric: 3 = directory, IT only; 2 = partial; 1 = vague; 0 = none.
- EX051 — Firmware event. What happened after a firmware update? Rubric: 3 = recovery key needed, retrieved; 2 = partial; 1 = vague; 0 = none.
Synthesis
Encrypt and plan for recovery.
Continue studying — chapter 17 of 40
← Chapter 16 (draft) · Course chapter index · Chapter 18 (draft) →