The big idea: Encryption turns readable data into something meaningless without the right key.
The data still travels across the network where others can see it — but what they see is useless to them.
The awkward question: If both ends need the same key, how does the key get there safely?
Sending it across the same network anyone can watch defeats the whole point. Everything below is the answer to that.
Free preview
This is the free notes preview
You're reading the free notes. Aimnova Pro unlocks the full study experience — and you can try it with your first topic free to keep:
- FlashcardsLock in vocabulary and key terms with spaced repetition.
- Practice questionsAnswer exam-style questions and get instant AI marking.
- Mock exams & past-paper vaultSit full mocks and see exactly how examiners award marks.
- Personalised study planA daily plan built around your exam date and weak areas.
One key or two, what a certificate adds, and what HTTPS actually does. Step through all four.
Interactive diagram
Explore the labelled diagram, charts and maps for this topic in full study mode.
Symmetric
- One key locks and unlocks
- Fast, and efficient on large amounts of data
- Both ends must already have that key
- Getting it to the other end safely is the hard part
- Everyone you share with needs a key, so the number grows quickly
Asymmetric
- Two matched keys — a public one and a private one
- Anything locked with the public key opens only with the private one
- The public key can be given to anyone; the private one never leaves
- Nothing secret has to travel
- Much slower, so it is not used for bulk data
Why both are used together: Asymmetric solves the key problem but is slow. Symmetric is fast but needs a shared key.
So asymmetric is used once, to agree a symmetric key safely — and everything after that is symmetric. HTTPS does exactly this.
Study smarter, not longer
Most students waste 40% of study time on topics they already know. Our AI tracks your progress and optimizes every minute.
A public key alone proves nothing: Anyone can publish a public key and claim it belongs to a bank.
A digital certificate is that public key together with an identity, signed by a certificate authority the browser already trusts.
What the certificate contains
Who this is, their public key, and a signature from a certificate authority.
The browser ships with a list of authorities it trusts, so it can check the signature without asking anyone.
What that buys
Two guarantees, not one. Encryption means nobody in between can read the conversation. Identity means the server really is who it claims to be.
Without the second, you might have a perfectly encrypted conversation with an impostor.
Key management
Keys must be generated properly, stored where nobody else can reach them, replaced periodically, and revoked immediately if they leak.
A private key that escapes makes every message ever sent with it readable.
Why management is the weak point
The mathematics is not usually what fails. What fails is a key left in a shared folder, an expired certificate nobody renewed, or a leaked key never revoked.
Strong encryption with poor key management is not strong.
How this is tested — you must describe the PROCESS — which key does what, in what order. It comes up two ways:
Paper 1 Section A
- Describe encryption or certificates, 3-5 marks
- Distinguish symmetric from asymmetric
- Explain the role of a certificate authority
Paper 1 Section B — case study
- Explain how the case study secures its connections
- Discuss the risks in how they manage keys
The classic trap: Saying the private key encrypts and the public key decrypts. For confidentiality it is the other way round: anyone can lock with the public key, and only the holder of the private key can open it.
Describe what happens when a browser connects to a bank's website using HTTPS.
Model answer plan
See the answer broken into clear points, with guidance on how each point earns marks.