Glossary

252 terms from Change Records, Cryptography and PKI, in plain words, each with the chapter that teaches it.

Search the glossary

#

3DES (Triple DES): An old symmetric block cipher that runs DES three times. NIST has disallowed it for encryption since 2024, so a card terminal still using it, like the café's, must be upgraded.

A

AES (Advanced Encryption Standard): The standard symmetric block cipher, using 128-, 192- or 256-bit keys. It encrypts disks, databases and the bulk of every TLS connection, such as orders on shop.kettleandcrane.com.
algorithm: The public math recipe used to encrypt, hash or sign data. Its security comes from the secret key, not from hiding the recipe, so never invent your own.
Always Encrypted: A Microsoft SQL Server feature where the application encrypts chosen columns before sending them, so the database server only ever stores and sees ciphertext.
application: A program that people or other programs use directly, such as Kettle & Crane's online shop or shipping program.
application restart: Stopping a program and starting it again so it reads new settings, certificates or patched files. It ends sessions and can lose unsaved work, so a change plan must schedule it and test afterward.
Argon2id: A deliberately slow password hashing method, used with a salt, that makes each guess expensive for an attacker. Alex moves the shop's customer passwords to a method such as Argon2id or bcrypt.
asymmetric encryption: Encryption that uses a key pair: what the public key locks, only the matching private key unlocks. It solves key distribution and enables signatures but is slow.
audit trail: The complete recorded history of who changed what and when. Reverting a bad commit keeps it intact; deleting history destroys it.
authentication: Proof of who someone or something is. A digital signature authenticates the sender because only the holder of the private key could have made it.
Authority Information Access (AIA): A certificate field that holds addresses such as the CA's OCSP responder, so a client knows where to ask about the certificate's status.

B

backout plan: The prepared steps to undo a change quickly if it breaks something, as Alex did for the warehouse PC when the old protocol was turned off.
Base64: A way of writing binary data as plain text characters. PEM certificate files are Base64 text.
bcrypt: A slow, salted password hashing method used to store passwords so that each guess takes the attacker much longer.
BitLocker: Windows' built-in encryption for the C: volume and other volumes. It can keep its key in the TPM and creates a recovery key that can be escrowed.
BitLocker To Go: The BitLocker version that encrypts a removable volume such as a USB stick, protecting files like the price list Jo lost.
bits of security: NIST's way of comparing strength across algorithm types: for example AES-128, RSA 3072 and 256-bit ECC all give about 128 bits of security. Today's minimum is 112 bits.
block cipher: A symmetric cipher that encrypts data in fixed-size blocks, such as AES working on 128 bits at a time.
Blowfish: An older symmetric block cipher with a 64-bit block; it is legacy and has been replaced by AES.
branch: A separate line of work inside a Git repository where a change is made before it is reviewed and merged into the main branch.
brute-force attack: Trying every possible key until one works. Each extra bit of key length doubles the work, which is why 128-bit AES is far beyond brute force.

C

CA/Browser Forum: The group of certificate authorities and browser makers that sets the rules for public certificates, such as the 200-day maximum lifetime since March 2026.
certificate authority (CA): An organization that checks a requester's identity and signs certificates with its own private key, so anyone who trusts the CA can trust the certificate.
certificate pinning: An app accepts only one known certificate or public key for its server, defending against a rogue CA but breaking if the server changes keys without an app update.
certificate signing request (CSR): A file holding your public key and the names you want, signed with your private key, which you send to a CA to get a certificate. The private key never leaves the server.
certificate store: Operating system software, such as the Windows certificate store or macOS Keychain, that stores certificates and keys for the system and its apps; you use it to install or export a certificate.
certificate types: The same X.509 format serves different jobs: a TLS server certificate for a website, a code signing certificate for software, an S/MIME certificate for email, a user certificate for logging in, and a machine or device certificate that identifies a laptop or phone.
certutil -hashfile: A Windows command that calculates a file's hash, for comparing with a published value.
ChaCha20: A current symmetric stream cipher, common on phones, usually paired with Poly1305 to detect tampering.
chain of trust: The links from a website's certificate through intermediate CAs up to a root CA in the trust store; the browser checks each signature along the chain.
change advisory board: The group that reviews and approves changes, taught in the first book of the course; here it approves turning off the old protocol.
change management: The process that plans, approves and records every change. A change is only finished once restarts, dependencies, diagrams, procedures and version history have all been handled.
cipher suite: The set of algorithms agreed for one TLS connection, for example TLS_AES_256_GCM_SHA384: AES-256 in GCM mode with SHA-384.
ciphertext: The scrambled, unreadable form of data after encryption; without the key it is useless.
code obfuscation: Rewriting a program so it still runs but is hard for humans to read, for example renaming things to a1 and b2. Software makers use it to slow copying; malware uses it to hide.
code signing: Signing programs and updates with a private key so computers can check they are genuine and unchanged; a code signing certificate proves who published the program.
collision: Two different inputs that give the same hash. If attackers can make collisions, they can get one document signed and swap in another, which is why MD5 and SHA-1 are broken.
collision resistant: The property that it is practically impossible to find two different inputs with the same hash.
column-level encryption: Record encryption applied to chosen columns (fields), such as the wholesale tax number field.
commit: One saved change in a Git repository, with a short message explaining why; Kettle & Crane starts each message with the change ticket number, like CHG-0157.
common name (CN): The main name in a certificate's Subject field, such as CN = shop.kettleandcrane.com.
community string: The plaintext password that SNMP versions 1 and 2c send; SNMPv3 replaces it with real authentication and encryption.
compensating controls: Controls that reduce a risk when the normal fix isn't possible, such as isolating the unpatchable warehouse PC so only the scale can reach it.
CompTIA Security+: An entry-level IT security certification from CompTIA that tests core security knowledge such as security controls, change management, cryptography and PKI. Its current exam version is SY0-801.
confidentiality: The security goal of keeping data secret from people who shouldn't read it. Encryption gives confidentiality; a digital signature alone does not.
CRL (certificate revocation list): A CA-signed list of the serial numbers of revoked certificates, published at regular intervals; it can grow large and be out of date until the next update.
CRL distribution point (CDP): The certificate field giving the address where the CA publishes its CRL.
cryptography: The use of math to protect information: keeping it secret, showing it hasn't changed and proving who sent it.

D

data at rest: Stored data, as opposed to data moving across a network. Full disk encryption and TDE protect data at rest.
data flow diagram: A drawing that shows where data travels, for example orders moving from the shop to the payment provider.
data in transit: Data crossing a network, such as a browser loading a page; transport encryption protects it.
data masking: Hiding part of a value when it is shown or copied, such as **** **** **** 4417, or using fake names in a test copy. It is usually not reversible from the masked copy.
database: A store of organized data, usually in tables of records and fields, like Kettle & Crane's order database.
database encryption: Encrypting a database as a whole, including its data files, logs and backups, usually with TDE.
decryption: Turning ciphertext back into readable plaintext with the right key.
dependency: Something a system needs in order to work, such as the order database the shop relies on. When it changes or stops, the dependent system can fail even though nobody touched it.
dependency map: A list or diagram showing which systems need which, used in impact analysis.
deprecated: Still allowed but being phased out, like TLS 1.0 and 1.1 or RSA after 2030. Disallowed means no longer allowed at all.
DER: A binary file format for certificates, holding the same data as PEM.
DES (Data Encryption Standard): An old symmetric cipher with a 56-bit key that was brute-forced in under a day in 1999; it is broken and should never be used.
deterministic: Always giving the same output for the same input; a hash function is deterministic.
Diffie-Hellman (DH): The classic key agreement method: both sides combine public and secret values so they calculate the same secret, which never crosses the network (like mixing paint colors).
digest: Another name for a hash: the short, fixed-size output of a hash function.
digital certificate: A small signed file that binds a public key to an identity such as shop.kettleandcrane.com. A CA signs it so others can trust the key inside.
digital signature: A value made by signing the hash of some data with the sender's private key; anyone can check it with the public key. It gives integrity, authentication and non-repudiation, but not confidentiality.
disallowed: No longer allowed for use by a standard such as NIST's; 3DES has been disallowed for encryption since 2024.
disk: The physical storage device, such as a laptop's solid-state drive.
DNS (Domain Name System): The service that turns names such as shop.kettleandcrane.com into network addresses. Almost every system depends on it.
DNSSEC (DNS Security Extensions): Signs DNS records so forged answers are caught. It gives integrity, not secrecy: anyone can still read the lookups.
DoH / DoT (DNS over HTTPS / TLS): Protocols that encrypt DNS lookups for privacy, on ports 443 and 853.
domain validation (DV): The lightest CA check: only that you control the domain name, for example via a file on the site or a DNS record. It is fast, often free and used by most sites.
DSA (Digital Signature Algorithm): An older asymmetric signature-only algorithm; FIPS 186-5 now allows it only for verifying old signatures.

E

ECB (Electronic Codebook): An old block cipher mode that encrypts identical blocks to identical ciphertext, so patterns show through. Never use it.
ECC (elliptic curve cryptography): Asymmetric cryptography based on elliptic curve math, giving the same strength as RSA with much smaller keys; the shop's P-256 key is ECC. It is quantum-vulnerable.
ECDH (Elliptic Curve Diffie-Hellman): Diffie-Hellman key agreement done with elliptic curve math and smaller numbers; X25519 is a popular curve for it.
ECDSA (Elliptic Curve Digital Signature Algorithm): A digital signature algorithm using elliptic curves; the shop's certificate and TLS server proof use it.
Ed25519: A current elliptic curve signature algorithm.
EFS (Encrypting File System): Windows file encryption for individual files and folders; protection stays only while the file remains on a file system that supports EFS.
ElGamal: A rarely used asymmetric encryption algorithm that is quantum-vulnerable.
encryption: Turning readable plaintext into unreadable ciphertext with an algorithm and a key, so only someone with the right key can read it.
encryption level: How much stored data one encryption covers: the whole disk, a partition, a volume, a single file, a whole database or chosen records. The level decides which threat is stopped and what stays exposed.
end-to-end encryption: Data stays encrypted all the way from sender to final receiver, so servers in between can't read it, as with S/MIME email.
ephemeral: A key exchange whose secret values are thrown away after each session (DHE, ECDHE), giving perfect forward secrecy.
extended validation (EV): The deepest level of CA identity checks; browsers no longer show it differently, so most sites use DV.

F

field: One column in a database table, such as a customer's email address.
file encryption: Encrypting individual files or folders so they stay protected while the computer runs and even when sent, such as Jo's files on a shared PC.
file system: The structure an operating system uses to store files inside a volume.
FileVault: macOS's built-in full disk encryption, using XTS-AES-128.
FIPS (Federal Information Processing Standard): US government standards published by NIST, such as FIPS 203 for ML-KEM and FIPS 186-5 for digital signatures.
FIPS 140-3: The US standard that HSMs and other cryptographic modules are tested against.
firewall rule: A line that allows or blocks traffic, such as allowing the shipping server to reach database port 5432. Kettle & Crane keeps its rules in Git.
FTP (File Transfer Protocol): An old file transfer protocol that sends files and the login password in plaintext.
FTPS (FTP over TLS): FTP wrapped in TLS, normally on port 990. It is secure but a different protocol from SFTP.
full disk encryption (FDE): Encrypts everything on a drive, protecting a lost or stolen device while it is powered off. It does not protect data once the user has logged in.

G

GCM (Galois/Counter Mode): A mode for AES that encrypts and also detects tampering; TLS uses it.
Get-FileHash: A Windows PowerShell command that calculates a file's hash to check a download.
Git: The most common version control tool. It keeps a repository of files with their full history of commits.
git diff: A Git command that shows exactly which lines changed between two versions; added lines start with + and removed lines with -.
git log: A Git command that lists commits, newest first; --oneline shows each with its short ID and message.
git revert: A Git command that makes a new commit undoing an earlier one, keeping both in the history so the record stays complete.
GnuPG (PGP): Software that encrypts and signs files and email with each person's key pair, for sending a file only one person can open.

H

hardware root of trust: A chip whose built-in keys the rest of the system trusts, such as a TPM; everything else is checked from it.
harvest now, decrypt later: Attackers record encrypted traffic today hoping to decrypt it once quantum computers exist, which is why key exchange is upgraded to post-quantum first.
hash: A short, fixed-size fingerprint calculated from data; any change to the data gives a completely different hash. Used for integrity checks, signatures and password storage.
hash function: A one-way function that turns data of any size into a fixed-size hash. Unlike encryption it uses no key and can't be reversed.
HEAD: In Git, the newest commit; HEAD~1 is the one before it.
hexadecimal: Base-16 numbers written with digits 0 to 9 and a to f; keys, serial numbers and hashes are often shown this way. Each hex character holds 4 bits.
HMAC (hash-based message authentication code): A hash mixed with a shared secret key, proving a message came from someone with the key and wasn't changed. Because the key is shared, it gives no non-repudiation.
HSM (hardware security module): A dedicated, tamper-resistant device or cloud service that creates, stores and uses high-value keys for many systems; Alex stores the internal root CA key in one.
HTTP (Hypertext Transfer Protocol): The protocol for the web, which sends everything in plaintext.
HTTPS (HTTP over TLS): Web traffic protected by TLS, normally on port 443, as on shop.kettleandcrane.com.
hybrid encryption: Using asymmetric math once to set up a symmetric session key, then fast symmetric encryption for all the data, as every secure website does.

I

IMAP / POP3: Protocols for reading email; the plain versions are insecure, while IMAPS and POP3S add TLS on ports 993 and 995.
impact analysis: The step in change planning that asks what a change will affect, including legacy systems and every dependency, to decide who to tell and what to test.
integrity: The security goal of showing data hasn't been changed. Hashes, HMACs and digital signatures provide it.
intermediate CA: A CA whose certificate is signed by a root CA and which signs everyday certificates such as the shop's. Servers must send it so browsers can build the chain.
internal CA: A CA an organization runs for itself; it installs its self-signed root in its own computers' trust stores, so its certificates are trusted inside the company only.
IPsec (Internet Protocol Security): Encrypts traffic at the network layer, protecting every application at once; the usual choice for a VPN.

K

key: A long secret number fed into an algorithm; it is what keeps encrypted data secret.
key agreement: Key exchange where both sides contribute a value and calculate the same secret, which never crosses the network, as in Diffie-Hellman.
key compromise: When a private key may have leaked or been stolen; it is the usual reason to revoke a certificate.
key distribution: The problem of getting a shared secret key safely to the other side; symmetric encryption struggles with it and asymmetric encryption solves it.
key escrow: Keeping a copy of an encryption key with a trusted party so data can be recovered, like Alex's stored BitLocker recovery keys. Signing keys usually aren't escrowed because that weakens non-repudiation.
key exchange: How two sides get a shared session key without anyone on the path learning it, by key transport or key agreement.
key length: The size of a key in bits; each extra bit doubles the possible keys. Lengths can only be compared within one type of algorithm.
key pair: Two keys that belong together, a public key and a private key: what one locks, only the other unlocks.
key rotation: Replacing keys on a schedule; a KMS automates it.
key stretching: The SY0-701 name for slow password hashing methods like bcrypt or PBKDF2; SY0-801 no longer lists the term.
key transport: Key exchange where one side makes the session key and sends it encrypted with the other's public key, as older TLS did with RSA.
KMS (key management system): Software or a cloud service that manages keys through their whole life (create, store, give out, rotate, revoke, destroy) and logs each use; it usually keeps master keys in HSMs.

L

label: One part of a domain name between dots; a wildcard asterisk stands for exactly one label.
LDAP (Lightweight Directory Access Protocol): The protocol for looking up users in a directory; plain LDAP is insecure, while LDAPS adds TLS on port 636.
legacy application: An old program the business still depends on but that is hard to change, often unsupported and unpatchable, like the warehouse inventory program.
Let's Encrypt: The largest free public CA; it turned off its OCSP service in August 2025 and relies on CRLs.
library: A shared piece of code written by others that programs use; updating it can break every program that depends on it.
LUKS (Linux Unified Key Setup): Linux's disk and partition encryption; LUKS2 defaults to AES with a 256-bit key.

M

maintenance window: An agreed time when changes and restarts may happen with least disruption.
malware: Malicious software. Full disk encryption doesn't stop malware running after login, and security tools spot known malware by its hash.
MD5 (Message Digest 5): An old 128-bit hash algorithm that is broken because collisions are easy; never use it for security.
measured boot: The TPM records measurements of the start-up process so it can tell if boot software was tampered with.
merge: Combining a branch's change into the main branch, usually after someone reviews it.
merge conflict: When two branches changed the same lines, Git stops and a person decides the final lines, as with Alex's and Priya's SSH rule edits.
ML-DSA and SLH-DSA: Post-quantum digital signature methods that NIST standardized in 2024 (FIPS 204 and 205) to replace RSA and ECC signatures.
ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism): A post-quantum key exchange method standardized by NIST in 2024 as FIPS 203; browsers combine it with X25519 as X25519MLKEM768.
mode: How a block cipher such as AES handles data longer than one block; GCM is good, ECB is unsafe.

N

network diagram: A drawing of how systems connect (devices, links, addresses and security zones); it must be updated when a change is closed, unlike the stale one that hid the moved printer.
NIST (National Institute of Standards and Technology): The US agency that sets cryptography standards, such as which algorithms, key lengths and password rules US agencies may use.
non-repudiation: Proof that a signer can't credibly deny signing, because only they hold the private key; digital signatures give it, HMACs don't.

O

obfuscation: Making data or code hard to understand without necessarily making it impossible to recover; useful as an extra layer but weak alone.
OCSP (Online Certificate Status Protocol): A protocol to ask a CA about one certificate's status (good, revoked or unknown) and get a current signed answer.
OCSP responder: The CA's server that answers OCSP questions with a signed status; its address is in the AIA field.
OCSP stapling: The web server fetches its own signed OCSP answer and attaches it to the connection, so the browser needn't contact the CA, protecting privacy.
one-way: The hash property that you can't work backward from a hash to the original data.
OpenSSL: A free, open-source cryptography toolkit and command-line tool. You can use it to make key pairs and certificate signing requests (CSRs), run a test certificate authority (CA), sign and hash data, and test TLS connections.
openssl ca: The OpenSSL command that runs a simple CA, used here to revoke the shop certificate and publish a CRL.
openssl dgst: OpenSSL command that hashes a file and, with -sign or -verify, signs the hash with a private key or checks it with a public key.
openssl genpkey: OpenSSL command that generates a new key pair, such as the shop's P-256 key.
openssl ocsp: OpenSSL command used in the lab to build an OCSP request, answer it as a responder and read the reply.
openssl passwd: OpenSSL command that creates a salted password hash in the Linux format; -6 selects the SHA-512 based method.
openssl req: OpenSSL command that builds or prints a certificate signing request.
openssl s_client: OpenSSL command that connects to a server like a browser and reports the TLS version, cipher suite, certificate and key exchange it agreed.
openssl verify: OpenSSL command that checks a certificate against a trusted CA and, with -crl_check, against a CRL.
organization validation (OV): A CA check that the organization behind the domain is real, using business records.
out of band: Exchanging keys through a different channel than the data, such as in person or by phone; slow but useful for a few high-value keys.

P

partition: A fixed section of a disk, marked out in the disk's partition table.
partition encryption: Encrypting one partition of a disk, such as a Linux server's data partition, while the rest stays plaintext.
PBKDF2 (Password-Based Key Derivation Function 2): A deliberately slow password hashing method used with a salt.
PEM: A certificate file format in Base64 text that starts -----BEGIN CERTIFICATE-----.
pepper: One extra secret value, kept outside the database, mixed into every password hash; unlike a salt it is secret and shared by all users.
perfect forward secrecy: Old recorded sessions can't be decrypted even if the server's long-term private key is stolen later, because ephemeral key exchange made the session keys.
PFX/P12 (PKCS #12): A password-protected file format that bundles a certificate with its private key, used to move a certificate to another server. A .cer or .crt file never holds the private key.
PIN (personal identification number): A short secret number, such as the one Priya enters to unlock their BitLocker laptop at start-up.
PKI (public key infrastructure): The people, rules, software and certificates that bind public keys to their real owners, so you know whose key you are using.
plaintext: The readable form of data before encryption or after decryption. Insecure protocols such as Telnet send everything in plaintext.
policy: A rule set by management saying what must happen, such as "all laptops must be encrypted".
Poly1305: An algorithm paired with ChaCha20 to detect tampering with the encrypted data.
port: The numbered door a service listens on, such as 443 for secure websites, 22 for SSH and 5432 for the database.
post-quantum: Cryptography designed to resist future quantum computers, such as ML-KEM, ML-DSA and SLH-DSA.
private key: The half of a key pair only its owner holds. It decrypts data sent to the owner and makes signatures; if it leaks, it must be replaced and the certificate revoked.
procedure: Step-by-step instructions for a task; the formal kind is a standard operating procedure. Changes must update it, like the leaving procedure after the switch to key cards.
protocol: A set of agreed rules two systems follow to talk; many have an insecure plaintext form and a secure encrypted form.
public key: The half of a key pair you share with everyone. It encrypts data for its owner and checks the owner's signatures, but by itself proves nothing about who owns it.

Q

quantum computer: A future type of computer that, if large enough, could break RSA, DH and ECC and roughly halve symmetric key strength.

R

rainbow table: A huge precomputed list of common passwords already hashed, letting attackers look up stolen unsalted hashes instantly; salting defeats it.
RC4: An old symmetric stream cipher that is broken; never use it.
record: One row in a database table, such as one customer.
record encryption: Encrypting individual records or fields inside a database so even people who can query it, like a contractor admin, see ciphertext for protected data.
recovery key: A key Windows creates when BitLocker is turned on, used to unlock a laptop that won't start normally; storing it centrally is key escrow.
registration authority (RA): An organization that checks a requester's identity for a CA but never signs certificates.
repository: A Git folder plus its full history of changes.
revocation: Cancelling a certificate before it expires, for example after its private key leaks; clients learn of it through CRLs or OCSP.
RFC (Request for Comments): One of the documents that define internet standards; RFC 9846 is the updated TLS 1.3 standard published in July 2026.
root CA: The top CA, whose self-signed root certificate sits in trust stores. Its private key is kept offline, often in an HSM, and it signs intermediate CAs.
root of trust: Something trusted by default from which all other trust is built; for certificates, the root CAs in the trust store.
RSA: A common asymmetric algorithm, named after Rivest, Shamir and Adleman, used for encryption and signatures; current at 2048 bits or more but quantum-vulnerable.
RTP / SRTP: RTP carries voice and video calls; SRTP (Secure Real-time Transport Protocol) encrypts those streams.

S

S/MIME (Secure/Multipurpose Internet Mail Extensions): Encrypts and signs individual email messages with certificates, protecting them end to end, not just between servers.
SAE (Simultaneous Authentication of Equals): The WPA3 personal-mode method that resists password-guessing attacks better than WPA2.
salt: A random value, different for every password, added before hashing and stored next to the hash; it need not be secret.
salting: Adding a unique random salt to each password before hashing, so identical passwords like Sam's and Priya's get different hashes and rainbow tables fail.
scrypt: A deliberately slow password hashing method used with a salt.
secure enclave: A protected area inside a processor, isolated from the main operating system, that keeps secrets like fingerprint data and phone unlock keys safe even if the OS is hacked.
security through obscurity: Relying on an attacker not knowing your trick; weak protection on its own.
self-encrypting drive (SED): A drive that encrypts itself in hardware.
self-signed certificate: A certificate signed by its own private key, with the same subject and issuer. Browsers warn about it, so it suits labs and tests, not the public wholesale portal.
serial number: A number unique among one issuer's certificates; CRLs and OCSP identify revoked certificates by it.
service: A background program managed by the operating system, such as a print spooler, as opposed to an application people work in.
service account: An account an application uses to log in to another system, such as the shop logging in to the order database; changing its password breaks the application until updated.
session: The period a user stays logged in; an application restart usually ends every session.
session key: A short-lived symmetric key agreed at the start of a connection and used only for that session.
SFTP: Secure file transfer that runs inside SSH on port 22; Alex switches the nightly stock files from FTP to it. It is not the same as FTPS.
SHA-1: A 160-bit hash algorithm broken by collisions shown in 2017; NIST is phasing it out by the end of 2030.
SHA-256: Part of the SHA-2 family of current hash algorithms (SHA-256, SHA-384, SHA-512); use SHA-256 or stronger for integrity and signatures.
SHA-3: A current family of hash algorithms with a different design, kept as a backup to SHA-2.
sha256sum: A Linux command that prints a file's SHA-256 hash, used to check a download or show that a one-character change alters the whole hash; md5sum and sha1sum do the same with MD5 and SHA-1.
SMTP (Simple Mail Transfer Protocol): The protocol for sending email; secure use adds TLS on port 465 or 587.
SNMP (Simple Network Management Protocol): A protocol that lets tools monitor switches, routers and printers; versions 1 and 2c send a plaintext community string.
SNMPv3: The secure version of SNMP, adding real authentication and encryption, on UDP ports 161/162.
SP 800-57: NIST Special Publications: 800-57 gives equal-strength key lengths across algorithm types; 800-63B-4 (July 2025) sets password rules such as salts of at least 32 bits.
SSH (Secure Shell): An encrypted protocol for remote command-line login and file transfer, on port 22; it replaces plaintext Telnet.
SSL (Secure Sockets Layer): The older name for TLS; every SSL version is broken and banned.
steganography: Hiding data inside other files such as photos; it was on SY0-701 but isn't listed for SY0-801.
stream cipher: A symmetric cipher that encrypts a continuous stream of data rather than fixed blocks, such as ChaCha20.
Subject: The certificate field naming who the certificate is for, e.g. CN = shop.kettleandcrane.com.
Subject Alternative Name (SAN): The certificate field listing every name it covers, which browsers check. A SAN certificate lists each name exactly, an alternative to a wildcard.
SY0-801: The exam code for the current version of the CompTIA Security+ certification exam. It replaced the earlier SY0-701 version.
symmetric encryption: Encryption that uses one secret key to both encrypt and decrypt. It is very fast for bulk data, but sharing the key safely is hard.

T

TDE (Transparent Data Encryption): Database encryption where the engine encrypts data files, logs and backups as it writes them, without application changes; anyone who can query still sees plaintext.
Telnet: An old remote command-line login protocol that sends everything in plaintext; SSH replaces it.
third-party certificate: A certificate issued by an outside CA, such as a commercial CA or Let's Encrypt, whose root is already in browsers' trust stores, so customers trust it with no setup.
TLS (Transport Layer Security): The main protocol that encrypts connections such as web traffic and email between servers; use TLS 1.2 or 1.3, as 1.0, 1.1 and SSL are unsafe.
token: A random stand-in for a sensitive value, like tok_8F3K... in place of a card number; only the token vault can map it back.
token vault: The protected store that holds real values and alone can map tokens back to them.
tokenization: Replacing a sensitive value such as a card number with a random token; unlike encryption there is no key, only the vault can get the value back.
TPM (Trusted Platform Module): A security chip in one computer that generates and stores keys that never leave it and checks start-up integrity; BitLocker uses it to hold the disk key.
transport encryption: Encryption that protects data while it travels across a network, between the two ends of one connection, using TLS, IPsec or SSH; each hop needs its own.
trust store: The built-in list of root certificates an operating system or browser accepts.
Twofish: A sound symmetric block cipher, an AES finalist, rarely required.

U

UDP: User Datagram Protocol, a fast, connectionless network transport protocol that sends data without setting up a connection first; SNMP uses UDP ports 161 and 162.
USB (Universal Serial Bus): The standard connector for removable drives; a file copied to a USB stick leaves full disk encryption behind.

V

validity: The certificate fields giving the first and last dates it may be used; public certificates may now last at most 200 days.
VeraCrypt: A tool that can create an encrypted volume inside a single container file, which mounts like a drive when unlocked.
version control: Recording every change to a file so you can see who changed what, when and why, compare versions and go back; it works for code, configs and documents.
volume: A storage area the operating system mounts and uses with a file system, such as C:; it may span partitions or disks or live inside a file.
volume encryption: Encrypting one mounted volume, such as C:, a data drive D: or a USB stick with BitLocker To Go.
VPN (virtual private network): An encrypted tunnel across the internet between two sites or between a laptop and the office, usually built with IPsec.

W

Wi-Fi Enhanced Open (OWE): Adds encryption to open guest Wi-Fi that has no password.
wildcard certificate: A certificate whose name starts with an asterisk to cover every name one label under a domain, such as *.kettleandcrane.com; it doesn't cover the bare domain and spreads one private key across many servers.
WPA3 (Wi-Fi Protected Access 3): The current Wi-Fi security protocol that encrypts traffic over the air, replacing the older WEP, WPA and WPA2.

X

X.509: The standard format for digital certificates.
X25519: A popular elliptic curve for ECDH key exchange, shown as the Server Temp Key in the shop's TLS connection.
XTS: A disk encryption mode of AES used by BitLocker and FileVault.