Chapter 2 · Cybersecurity
2-1 Cryptographic Technologies and Authentication
Every time you log in to a bank app, buy something online, or open a website with a small padlock in the address bar, hidden technologies are keeping your information safe. Messages are scrambled so no one else can read them, the website proves that it is genuine, and your identity is checked before you are let in.
Guiding question
How do cryptographic technologies and authentication work together to keep online communication and services secure?
Learning outcome. Explain how HTTPS secures communication — how the TLS handshake uses public-key cryptography to share a key safely, and how common-key cryptography then protects the data — and describe how authentication, including multi-factor authentication, is used in real services.
With a partner. Think of one account you both have. Write down every step you take to get into it. Then ask: if someone learned your password, which of those steps would still stop them? Keep your answer — this lesson is about exactly that question.
HTTPS and the TLS handshake
HTTPS (HTTP Secure) … a communication protocol that adds TLS encryption to HTTP. By providing encryption, detection of tampering, and verification of the communication partner, it protects users from eavesdropping, tampering and impersonation.
The procedure for establishing a secure communication is called the TLS handshake.
HTTPS combines common-key (symmetric-key) cryptography and public-key cryptography, taking advantage of the strengths of both.
| Stage | What happens | Cryptographic method |
|---|---|---|
| ① Connection | The web server sends a digital certificate and a public key to the browser. The browser verifies the server’s authenticity through a certificate authority (CA). | Public-key cryptography |
| ② Key exchange | The browser creates a common key for communication, encrypts it with the server’s public key, and sends it. The server decrypts it with its private key to obtain the common key. | Public-key cryptography |
| ③ Data communication | Data is encrypted and exchanged using the shared common key. | Common-key cryptography |
A note the book itself adds. The exchange above shows one way a common key can be shared. Current versions of TLS use Diffie-Hellman key agreement instead. The syllabus examines the version in the table — but it is worth knowing the book is telling you it has simplified.
The one sentence to remember.
Public-key cryptography is used to “share keys safely”, and common-key cryptography is used to “exchange large amounts of data quickly”. That division of roles is what makes both security and speed possible.
Press ① to start the TLS handshake — the procedure for setting up a secure connection. Watch which kind of cryptography each stage uses.
The obvious question about that table is one the book does not stop to answer: why use two different kinds of cryptography at all? If public-key is the secure one, why not use it for everything? And if common-key is the fast one, why not just use that?
Step 1 of 6 — The easy part — scrambling the message
You want to send your card number to a shop. So you scramble it using a key — a shared secret number. Anyone listening on the wire now sees only nonsense. This is common-key cryptography, and it is fast, which matters when there is a lot to send.
The padlock is the one comparison that gets the important bit right: closing it and opening it are different jobs, needing different things. That is what makes public-key cryptography asymmetric. Keep it in mind for digital signatures, where the direction is deliberately reversed — the private key signs and the public key checks the signature, which is how anyone can verify a message that only one person could have produced.
Common-key (also called symmetric): one key, used for both scrambling and unscrambling. Fast — but both sides must already have the same key, and getting it to them is the whole problem.
Public-key (also called asymmetric): a matched pair. What one key locks, only the other unlocks. One is published to the world; the other is never shared with anybody. This solves the delivery problem — and it is far slower, which is why it is not used for everything.
The book’s wording, which is what an exam wants: Public-key cryptography is used to “share keys safely”, and common-key cryptography is used to “exchange large amounts of data quickly”. (p.35)
🧮 A second reason for public keys — counting how many keys you would need
- 1
With common-key cryptography, every PAIR of people who want to talk privately needs its own shared key. Two people need 1 key.
Why this step: It must be their own key and nobody else’s — if two people used a key that a third also held, that third person could read everything. So the count is a count of pairs.
- 2
Count the pairs among n people: each of the n can pair with n − 1 others, and each pair would otherwise be counted twice, so the total is n(n − 1) ÷ 2.
Why this step: Dividing by 2 is the step people miss. The pair “you and Ali” and the pair “Ali and you” are the same key, not two — so counting n × (n − 1) doubles every one of them.
- 3
Try it for a small group: 10 people need 10 × 9 ÷ 2 = 45 keys.
Why this step: Still manageable — you could imagine handing those out in person. This is why common-key cryptography worked perfectly well for centuries, when the people who needed to talk secretly could meet first.
- 4
Now a small town of 1000 people: 1000 × 999 ÷ 2 = 499,500 keys.
Why this step: A hundred times the people, but more than eleven thousand times the keys — because the count grows with n squared, not with n. And every one of those keys still has to reach both holders somehow, secretly, before any message can be sent.
Most people slip here: Do the multiplication before the division: 1000 × 999 = 999,000, then halve it. Halving 1000 first gives 500 × 999 which happens to work here, but the habit will fail you on odd numbers.
- 5
Compare with public-key: each person makes ONE pair of keys and publishes half of it. 1000 people → 1000 key pairs.
Why this step: Nothing has to be delivered secretly and nothing has to be arranged in advance, because the public half is meant to be public. The count grows with n rather than n², so it keeps working at the size of the whole internet.
Where the comparison breaks down: A real postbox does not prove whose it is — and neither does a public key on its own, which is exactly the gap the digital certificate and the certificate authority fill in stage ① of the handshake. Without them an attacker could publish their own padlock, label it with the shop’s name, and read everything you sent.
It does not mean the site is honest. A criminal can obtain a valid certificate for a site they control, and most fake shopping and banking pages now have a perfectly good padlock. The padlock answers “am I really talking to the owner of this address, privately?” — it says nothing about whether the address is the one you meant to visit. Which is why the advice is to check the domain name, not the padlock.
How every browser in use today handles HTTPS.
Authentication in real services
Multi-factor authentication … combining two or more of the three factors of authentication — knowledge, possession and biometric.
When only one factor is used, an unauthorised party can gain access if that factor is broken. By combining multiple factors, even if one is broken, another can still prevent access.
For example: if only a password (knowledge) is used, an unauthorised login becomes possible the moment the password leaks. But if a notification to a smartphone (possession) is also required, an attacker cannot log in without the device, even holding the password.
| Service | Examples of authentication used |
|---|---|
| Online banking | Password (knowledge) + one-time password (possession) |
| SNS login | Password (knowledge) + SMS authentication (possession) |
| Company laptop login | Smart card (possession) + fingerprint authentication (biometric) |
| Online shopping | Password (knowledge) + one-time code from 3-D Secure (possession) |
Two steps is not the same as two factors. Classify each half before you judge the pair — that habit is what the question is testing.
The three factors are knowledge (something you know), possession (something you have) and biometric (something you are). Multi-factor means two or more different factors — not simply two steps.
Password
One-time password on a device
Combinations of security technologies
Safe communication and services are achieved not by a single technology, but by combining several.
| Technology | Effect |
|---|---|
| Encryption (common-key, public-key) | Prevents communication content from being read by third parties |
| Digital signature | Detects data tampering or impersonation of the sender, and makes it impossible for the sender to deny having sent the data afterward (non-repudiation) |
| Digital certificate | Verifies that the communication partner is authentic |
| Multi-factor authentication | Prevents unauthorised logins |
All four at once — buying something online:
By combining technologies this way, four different threats — eavesdropping, tampering, impersonation and unauthorised login — are addressed at the same time. Each technology answers one of them; none of them answers all four.
How the real paper is built
The ministry sets half multiple choice and half written answer in every subject. The two halves are not the same skill. In the multiple-choice half you have to spot the wrong options quickly — and the wrong options are built out of the mistakes students really make. In the written half nobody gives you the answer to recognise; you have to produce it, in your own words, with a reason.
Practise both. Being good at one half and weak at the other costs you exactly half the paper.
- HTTPS
- — HTTP with TLS encryption added.
- public-key cryptography
- — shares a key safely.
- common-key cryptography
- — exchanges data quickly.
- TLS handshake
- — the procedure that sets up a secure connection.
- digital signature
- — detects tampering; gives non-repudiation.
- digital certificate
- — proves a site is genuine.
- multi-factor authentication
- — two or more of knowledge, possession, biometric.
Worked Example
(1) Mark each statement with ○ if it is true or × if it is false.
A HTTPS communication uses both public-key cryptography and common-key cryptography.
B HTTPS communication exchanges all data using public-key cryptography.
C Multi-factor authentication combines two or more of the three factors of authentication.
D An example of multi-factor authentication is setting two passwords.
(2) Match each threat (a–c) with the technology that addresses it: A Encryption, B Digital signature, C Digital certificate.
a I want to prevent communication content from being read by third parties
b I want to verify that data has not been altered during communication
c I want to verify that the communication partner is authentic
1 · Answer the following questions.
2(1) · For each service, which combination of authentication factors is used?
Match each description with the choice that fits it.
Password + one-time password
Password + fingerprint authentication
Password + SMS authentication
Face recognition + smart card
2(2) · Which is NOT an appropriate description of combinations of security technologies?
Mark each statement with ○ if it is true or × if it is false.
Encryption is a technology that prevents communication content from being read by third parties.
Digital signatures are a technology that improves communication speed.
Digital certificates are a system for verifying that the communication partner is authentic.
By combining multiple security technologies, various threats can be addressed.
Think as an Engineer — Investigate & Decide
A school in your city is building an online portal where students check their grades and pay fees. You must choose how students log in. Which is the better choice for this service?
1 · Collect data.
Ask ten classmates which login methods they use and trust — password, one-time password, SMS, fingerprint or face. Record the results in a table and find the most common answer.2 · Analyze the stakeholders.
For each group — a student, the school, and a student with no smartphone — note one benefit and one drawback of requiring a second factor.3 · Decide.
Recommend one login method for the portal and give two reasons based on your survey and your table. In pairs, compare your recommendations and agree together on the single strongest reason before you write it down. Give evidence for your answer.
The third group is the awkward one again. A second factor makes almost everyone safer — and locks out the student who has no phone to receive it. Good security design has to answer that, not ignore it.
In a New Context
Lesson Question — Answered
The lesson asked how cryptographic technologies and authentication keep communication and services secure. HTTPS combines public-key cryptography — used to share a key safely — with common-key cryptography — used to exchange data quickly — so communication is both secure and fast.
Beyond communication, services stay safe by combining several technologies: encryption hides content, digital certificates prove a site is genuine, digital signatures detect tampering, and multi-factor authentication blocks unauthorised logins. Security online therefore comes from layering these technologies so that many threats are addressed at the same time.
1 · Quiz yourself first.
Cover the Point! sections and say the three handshake stages with the cryptography each uses, the three authentication factors, and the four security technologies with their effects.
2 · Read the passage and answer each question.
HTTPS communication, used to access websites safely, combines multiple cryptographic technologies. First, the web server sends a ( a ) and a public key to the browser. The browser verifies whether the server is authentic through ( b ). Next, the browser creates a ( c ) for communication and encrypts it with the server’s public key before sending. After this, all data communication is encrypted using this ( c ).
3(1) · For each threat, which technology is primarily used to address it?
Match each description with the choice that fits it.
A password is leaked and unauthorised login occurs
Data is altered during communication
A user is led to a fake website
Communication content is intercepted by a third party
3(2) · Which is NOT an appropriate example of multi-factor authentication?
Mark ○ for each one that IS multi-factor authentication, and × for the one that is not.
Password + smartphone notification
Password + secret question
Fingerprint authentication + smart card
Password + SMS authentication
Reflect: Which of these protections do you rely on most when you go online?
Challenge: Suggest one extra security measure an online shop could add, and one threat it would still not remove.
Keep reading — this lesson marks itself done automatically.