📚 Encryption: Key Concepts for IB AQA Computer Science | IB AQA 计算机：加密 考点精讲
Encryption is the foundation of digital trust, enabling secure communication, e‑commerce, and data protection. In IB and AQA Computer Science, you are expected to explain symmetric and asymmetric algorithms, hash functions, digital signatures, certificates, and the TLS handshake. This article breaks down every essential concept, pairing clear English explanations with Chinese translations to solidify your revision.
加密是数字信任的基石，支撑着安全通信、电子商务和数据保护。在 IB 和 AQA 计算机科学中，你需要解释对称与非对称算法、哈希函数、数字签名、证书及 TLS 握手。本文拆解每一个核心概念，以中英对照的方式帮助巩固复习。
1. What is Encryption? | 什么是加密？
Encryption converts plaintext into ciphertext using an algorithm and a secret key, making data unreadable to unauthorised parties.
加密使用算法和密钥将明文转换为密文，使未授权方无法读取数据。
The three pillars of cryptography are confidentiality, integrity and authentication – often called the CIA triad.
密码学的三大支柱是机密性、完整性和身份验证——通常称为 CIA 三元组。
Kerckhoffs’ principle states that a system should remain secure even if everything about it except the key is public knowledge.
柯克霍夫原则指出，除密钥外系统的一切细节即便公开，系统也应保持安全。
Common terms include plaintext (original message), ciphertext (encrypted output), key (secret value), and cipher (algorithm).
常见术语包括明文（原始消息）、密文（加密输出）、密钥（秘密值）和密码（算法）。
2. Symmetric Encryption | 对称加密
In symmetric encryption, the same key is used for both encryption and decryption. It is fast and efficient for bulk data.
对称加密使用同一密钥进行加密和解密，速度快，适合海量数据。
The main challenge is secure key distribution – if the key is intercepted, all communication is compromised.
主要挑战是密钥的安全分发——如果密钥被截获，所有通信都将被攻破。
A classic example is the Caesar cipher, which shifts each letter by a fixed amount; it is easily broken by frequency analysis.
经典例子是凯撒密码，将每个字母平移固定位数；它很容易被频率分析破解。
Modern symmetric ciphers like AES operate on blocks of bits and use multiple rounds of substitution and permutation.
现代对称密码如 AES 以比特块为单位运算，并采用多轮替换和置换。
Common symmetric algorithms: DES (insecure), 3DES, AES, Blowfish, ChaCha20. Key length is critical – AES‑128, AES‑192, AES‑256.
常见对称算法：DES（不安全）、3DES、AES、Blowfish、ChaCha20。密钥长度至关重要——AES‑128、AES‑192、AES‑256。
3. Asymmetric Encryption | 非对称加密
Asymmetric encryption uses a key pair: a public key (shared freely) and a private key (kept secret).
非对称加密使用一对密钥：公钥（自由共享）和私钥（保密）。
Data encrypted with the public key can only be decrypted by the matching private key, solving the key distribution problem.
用公钥加密的数据只能由对应的私钥解密，从而解决了密钥分发难题。
It also enables digital signatures: a message encrypted with the private key can be verified by anyone holding the public key.
它还支持数字签名：用私钥加密的消息可由任何持有公钥的人验证。
Asymmetric algorithms rely on mathematically hard problems, such as integer factorisation (RSA) or discrete logarithms (ECC).
非对称算法依赖于数学难题，例如大整数分解（RSA）或离散对数（ECC）。
Compared to symmetric encryption, it is computationally slower and not suitable for encrypting large volumes of data directly.
与对称加密相比，其计算速度较慢，不适合直接加密大量数据。
4. Hashing | 哈希函数
A hash function takes an input of arbitrary length and produces a fixed‑size digest. It is a one‑way process – irreversible.
哈希函数接受任意长度的输入，生成固定大小的摘要。这是一个单向过程——不可逆。
Key properties: deterministic (same input always gives same hash), fast to compute, pre‑image resistant, collision resistant, avalanche effect.
关键特性：确定性（相同输入总产生相同哈希）、快速计算、抗原像、抗碰撞、雪崩效应。
Common hash functions: MD5 (broken), SHA‑1 (broken), SHA‑256, SHA‑3. They are used in password storage and file integrity checks.
常见哈希函数：MD5（已破解）、SHA‑1（已破解）、SHA‑256、SHA‑3。用于密码存储和文件完整性校验。
Salting adds a random prefix to passwords before hashing, defeating rainbow table attacks.
加盐是在哈希前为密码添加随机前缀，挫败彩虹表攻击。
Hashing alone does not provide confidentiality; it is used for verification, not hiding data.
单独的哈希不提供机密性；它用于验证而非隐藏数据。
5. Digital Signatures | 数字签名
A digital signature uses asymmetric cryptography to bind a message to the sender, ensuring authenticity, integrity and non‑repudiation.
数字签名利用非对称密码学将消息与发送者绑定，确保真实性、完整性和不可否认性。
The process: sender hashes the message, encrypts the hash with their private key. The receiver decrypts the signature with the sender’s public key and compares the hash.
过程：发送者对消息求哈希，用私钥加密哈希。接收者用发送者公钥解密签名，并比对哈希值。
If the hashes match, the message is intact and genuinely from the holder of the private key.
如果哈希匹配，则消息完整无缺，且确实来自私钥持有者。
Digital signatures are crucial for software distribution, financial transactions, and legal documents.
数字签名对软件分发、金融交易和法律文件至关重要。
Algorithms like RSA‑PSS, DSA, and ECDSA are standard for creating digital signatures.
RSA‑PSS、DSA 和 ECDSA 等算法是创建数字签名的标准。
6. Public Key Infrastructure (PKI) and Digital Certificates | 公钥基础设施与数字证书
PKI is a framework of roles, policies, and procedures needed to manage digital certificates and public‑key encryption.
PKI 是管理数字证书和公钥加密所需的角色、策略和程序框架。
A digital certificate binds an identity (such as a domain) to a public key. It is issued by a trusted Certificate Authority (CA).
数字证书将身份（如域名）与公钥绑定，由可信任的证书颁发机构 (CA) 签发。
Certificates contain: owner details, public key, validity period, CA signature. Browsers come pre‑loaded with root CA certificates.
证书包含：所有者信息、公钥、有效期、CA 签名。浏览器预装根 CA 证书。
The chain of trust extends from a root CA through intermediate CAs to the end‑entity certificate, enabling verification.
信任链从根 CA 经中间 CA 延续到终端实体证书，实现验证。
If a CA is compromised or a certificate expires, the trust is broken. Certificate revocation lists (CRLs) and OCSP handle this.
如果 CA 被攻破或证书过期，信任即被破坏。证书吊销列表 (CRL) 和 OCSP 处理此类情况。
7. Transport Layer Security (TLS) | 传输层安全
TLS (successor to SSL) provides encrypted communication over networks. HTTPS is HTTP over TLS, shown by the padlock icon.
TLS（SSL 的继任者）提供网络加密通信。HTTPS 即 HTTP over TLS，以挂锁图标显示。
The TLS handshake uses asymmetric cryptography to authenticate the server and agree on a shared symmetric session key.
TLS 握手使用非对称密码学验证服务器身份，并协商出一个共享的对称会话密钥。
Typical steps: client hello, server hello with certificate, key exchange (e.g., Diffie‑Hellman), session keys derived, and bulk data encrypted symmetrically.
典型步骤：客户端问候、服务器问候及证书、密钥交换（如 Diffie‑Hellman）、衍生会话密钥、对称加密传输批量数据。
TLS 1.3 simplifies the handshake, removes obsolete ciphers, and mandates forward secrecy – session keys are not compromised even if the private key is later leaked.
TLS 1.3 简化握手，移除过时密码，并强制前向保密——即使私钥事后泄露，会话密钥也不会被破解。
8. Common Encryption Algorithms: AES and RSA | 常见加密算法：AES 与 RSA
AES (Advanced Encryption Standard) is the most widely used symmetric block cipher. It operates on 128‑bit blocks with key sizes of 128, 192, or 256 bits.
AES（高级加密标准）是最广泛使用的对称分组密码。它对 128 位分组进行操作，密钥长度为 128、192 或 256 位。
It performs rounds of SubBytes, ShiftRows, MixColumns, and AddRoundKey; AES‑128 uses 10 rounds, AES‑256 uses 14.
它执行多轮字节替换、行移位、列混淆和轮密钥加；AES‑128 使用 10 轮，AES‑256 使用 14 轮。
RSA is an asymmetric algorithm based on the difficulty of factoring the product of two large primes.
RSA 是一种非对称算法，基于分解两个大素数乘积的困难性。
Key generation: choose primes p and q, n = p × q, choose e coprime to (p‑1)(q‑1), compute d such that e × d ≡ 1 mod (p‑1)(q‑1).
密钥生成：选取素数 p 和 q，n = p × q，选择 e 与 (p‑1)(q‑1) 互质，计算 d 使 e × d ≡ 1 (mod (p‑1)(q‑1))。
Encryption: c = me mod n Decryption: m = cd mod n
RSA keys are typically 2048 or 4096 bits long. Shorter keys are vulnerable to factorisation advances and quantum computers.
RSA 密钥通常长 2048 或 4096 位。较短密钥易受因子分解进展和量子计算机的威胁。
9. Key Exchange: Diffie‑Hellman | 密钥交换：迪菲‑赫尔曼
Diffie‑Hellman allows two parties to establish a shared secret over an insecure channel without prior knowledge of each other’s secrets.
Diffie‑Hellman 允许双方在不安全的信道上建立共享秘密，无需事先知晓对方秘密。
Both agree on public parameters: a large prime p and a generator g. Each generates a private number (a, b) and sends their public value: A = ga mod p, B = gb mod p.
双方约定公开参数：大素数 p 和生成元 g。各自生成私密数（a, b）并发送公开值：A = ga mod p, B = gb mod p。
The shared secret is computed by raising the received value with their own private number: s = Ba mod p = Ab mod p.
共享秘密通过将收到的值进行自己的私密指数运算得出：s = Ba mod p = Ab mod p。
An eavesdropper only sees p, g, A and B; deducing a or b from A and B is the discrete logarithm problem, which is computationally infeasible for large p.
窃听者只能看到 p、g、A 和 B；从 A、B 求出 a 或 b 是离散对数问题，对大质数计算上不可行。
Modern TLS often uses Ephemeral Diffie‑Hellman (DHE/ECDHE) to provide forward secrecy.
现代 TLS 常用临时 Diffie‑Hellman (DHE/ECDHE) 以提供前向保密。
10. Vulnerabilities and Attacks | 漏洞与攻击
Brute‑force attacks try every possible key. Longer keys exponentially increase the attack time; AES‑256 offers 2²⁵⁶ possible keys.
暴力破解尝试所有可能密钥。更长的密钥使攻击时间呈指数增长；AES‑256 有 2²⁵⁶ 种可能的密钥。
Dictionary attacks use common passwords or pre‑computed hash tables; salting and key stretching (bcrypt, scrypt) are countermeasures.
字典攻击使用常见密码或预计算哈希表；加盐与密钥拉伸（bcrypt, scrypt）是对策。
Man‑in‑the‑middle (MITM) attacks intercept communication; TLS certificates and mutual authentication mitigate this risk.
中间人攻击 (MITM) 拦截通信；TLS 证书和相互认证减轻这一风险。
Side‑channel attacks exploit timing, power consumption or electromagnetic emissions; implementations must be constant‑time and shielded.
侧信道攻击利用时序、功耗或电磁辐射；实现应采用恒定时间并加以屏蔽。
Weak random number generators can compromise key generation. Cryptographically secure pseudo‑random number generators (CSPRNG) are essential.
弱随机数生成器可能危及密钥生成。必须使用密码学安全伪随机数生成器 (CSPRNG)。
11. Real‑world Applications and Ethical Considerations | 实际应用与伦理考量
Encryption protects everyday technologies: HTTPS, VPNs, wireless WPA3, encrypted messaging (Signal, WhatsApp), full‑disk encryption, and blockchain.
加密保护日常技术：HTTPS、VPN、无线 WPA3、加密即时通讯（Signal、WhatsApp）、全盘加密和区块链。
End‑to‑end encryption ensures only the communicating users can read messages; even the service provider cannot access the content.
端到端加密确保只有通信用户能读取消息；即使服务提供商也无法访问内容。
Debate surrounds government access to encrypted data. ‘Backdoors’ weaken security for everyone and are opposed by security experts.
围绕政府访问加密数据存在争议。“后门”削弱所有人的安全性，遭到安全专家反对。
Quantum computing threatens many current asymmetric algorithms; post‑quantum cryptography research is developing quantum‑resistant schemes.
量子计算威胁许多当前的非对称算法；后量子密码学研究正在开发抗量子方案。
Ethical considerations also include the balance between privacy and national security, and the responsibility of developers to implement cryptography correctly.
伦理考量还包括隐私与国家安全之间的平衡，以及开发者正确实现密码学的责任。
Published by TutorHao | Computer Science Revision Series | aleveler.com
更多咨询请联系16621398022（同微信）
屏轩国际教育cambridge primary/secondary checkpoint, cat4, ukiset,ukcat,igcse,alevel,PAT,STEP,MAT, ibdp,ap,ssat,sat,sat2课程辅导，国外大学本科硕士研究生博士课程论文辅导Cancel reply