📚 Encryption Key Points for IGCSE Edexcel Computer Science | IGCSE Edexcel 计算机：加密 考点精讲
Encryption is a fundamental topic in IGCSE Edexcel Computer Science. This article covers the core concepts you need to know: symmetric and asymmetric encryption, hashing, digital signatures, and how they secure modern communications like HTTPS. Understanding these principles will help you answer both theory and scenario‑based questions confidently.
加密是 IGCSE Edexcel 计算机科学中的基础主题。本文涵盖你需要掌握的核心概念：对称加密与非对称加密、哈希、数字签名，以及它们如何保护像 HTTPS 这样的现代通信。理解这些原理将帮助你自信地应对理论和场景题。
1. Introduction to Encryption | 加密简介
Encryption is the process of converting readable data, called plaintext, into an unreadable format known as ciphertext. This transformation is performed using an algorithm and a key. The primary purpose is to ensure confidentiality: only authorised parties with the correct key can decrypt the ciphertext back into plaintext. Encryption also supports data integrity and authentication when combined with hashing and digital signatures.
加密是将可读数据（称为明文）转换为不可读格式（即密文）的过程。这种转换通过算法和密钥进行。其主要目的是确保机密性：只有持有正确密钥的授权方才能将密文解密回明文。当与哈希和数字签名结合时，加密还支持数据完整性和身份认证。
In modern computing, encryption is used in countless applications: online banking, messaging apps, wireless networks, and file storage. Without encryption, sensitive information such as passwords and payment details would be transmitted openly and could be intercepted by attackers.
在现代计算中，加密被用于无数应用：网上银行、即时通讯应用、无线网络和文件存储。没有加密，密码和支付详情等敏感信息就会被公开传输，并可能被攻击者截获。
2. Key Terminology | 关键术语
To master encryption, you must first understand the basic vocabulary. The original readable message is the plaintext. After encryption, it becomes ciphertext. The algorithm (or cipher) is the mathematical procedure used to scramble the data. The key is a piece of secret information that controls the encryption and decryption process. The same plaintext encrypted with different keys will produce completely different ciphertexts.
要掌握加密，你首先必须理解基本词汇。原始的可读消息是明文。加密后，它变成密文。算法（或密码）是用于打乱数据的数学过程。密钥是控制加密和解密过程的秘密信息。用不同密钥加密相同明文会产生完全不同密文。
Key length is measured in bits (e.g., 128‑bit, 256‑bit) and determines the number of possible keys. A longer key makes brute‑force attacks exponentially harder. In symmetric encryption, the same key is used for both encryption and decryption; in asymmetric encryption, different but mathematically related keys are used.
密钥长度以位度量（如 128 位、256 位），决定了可能的密钥数量。更长的密钥使得暴力破解在难度上呈指数级增长。在对称加密中，同一个密钥既用于加密也用于解密；在非对称加密中，则使用不同但数学相关的密钥。
3. Symmetric Encryption | 对称加密
Symmetric encryption uses a single shared secret key. Both the sender and receiver must possess this key securely before communication begins. The sender encrypts with the key, and the receiver decrypts with the same key. Symmetric ciphers are generally very fast and efficient, making them suitable for encrypting large volumes of data, such as files or network streams.
对称加密使用单一的共享秘密密钥。发送方和接收方必须在通信开始前安全地持有该密钥。发送方用密钥加密，接收方用同一个密钥解密。对称密码通常速度很快且高效，因此适合加密大量数据，如文件或网络流。
Examples of symmetric algorithms you may encounter include AES (Advanced Encryption Standard), which is widely used today, and older ciphers like DES (Data Encryption Standard). However, the major drawback is the key distribution problem: how do you share the secret key with the intended recipient without an attacker intercepting it? This challenge led to the development of asymmetric encryption.
你可能遇到的对称算法示例包括如今广泛使用的 AES（高级加密标准）和旧的密码如 DES（数据加密标准）。然而，其主要缺陷是密钥分发问题：你如何与预期接收者共享秘密密钥而不被攻击者截获？这一挑战推动了非对称加密的发展。
Because symmetric encryption depends on a single key, if that key is compromised, all messages encrypted with it can be read. Therefore, key management and regular key changes are crucial in symmetric systems.
由于对称加密依赖于单一密钥，如果该密钥被泄露，所有用它加密的消息都可能被读取。因此，在对称系统中密钥管理和定期更换密钥至关重要。
4. The Caesar Cipher – A Simple Symmetric Example | 凯撒密码——简单的对称示例
The Caesar cipher is a historical substitution cipher that shifts each letter in the plaintext by a fixed number of positions down the alphabet. For example, with a shift key of 3, A becomes D, B becomes E, and so on. The encryption formula can be expressed as:
凯撒密码是一种历史上的替换密码，它将明文中每个字母按固定位数在字母表中向后移位。例如，移位密钥为 3 时，A 变成 D，B 变成 E，依此类推。加密公式可表示为：
C = (P + K) mod 26
where P is the plaintext letter’s position (A=0, B=1, …), K is the shift, and C is the ciphertext letter’s position. To decrypt, the receiver uses the same shift key but subtracts: P = (C – K) mod 26. This is symmetric because both parties know the shared shift value.
其中 P 是明文字母的位置（A=0, B=1, …），K 是移位量，C 是密文字母的位置。解密密文时，接收者使用相同的移位密钥但进行减法：P = (C – K) mod 26。这是对称的，因为双方都知道共享的移位值。
The Caesar cipher is extremely weak by modern standards. With only 25 possible shifts, it can be broken instantly by brute force. Moreover, it preserves letter frequencies, making it vulnerable to frequency analysis. The concept, however, illustrates the core components of any cipher: algorithm, key, plaintext, and ciphertext.
以现代标准来看，凯撒密码极其脆弱。它仅有 25 种可能的移位，可被暴力破解瞬间攻破。此外，它保留了字母频率，使其容易受到频率分析攻击。然而，这一概念演示了任何密码的核心组成部分：算法、密钥、明文和密文。
5. Asymmetric Encryption (Public Key Cryptography) | 非对称加密（公钥密码学）
Asymmetric encryption solves the key distribution problem by using a pair of mathematically linked keys: a public key and a private key. The public key can be shared openly with anyone, while the private key must be kept secret by its owner. A message encrypted with the public key can only be decrypted by the corresponding private key, and vice versa.
非对称加密通过使用一对数学关联的密钥解决了密钥分发问题：公钥和私钥。公钥可以公开分享给任何人，而私钥必须由其所有者秘密保管。用公钥加密的消息只能用对应的私钥解密，反之亦然。
The most famous asymmetric algorithm is RSA (Rivest‑Shamir‑Adleman). Its security relies on the difficulty of factoring large prime numbers. Although asymmetric encryption is more computationally intensive than symmetric encryption, it enables secure key exchange over insecure channels. In practice, hybrid systems are used: asymmetric encryption first shares a temporary symmetric key, then symmetric encryption handles the bulk data.
最著名的非对称算法是 RSA（Rivest‑Shamir‑Adleman）。其安全性依赖于大质数分解的困难性。尽管非对称加密比对称加密计算量更大，但它能在不安全的信道上实现安全的密钥交换。在实际应用中，常使用混合系统：首先用非对称加密分享临时的对称密钥，然后由对称加密处理批量数据。
6. Public and Private Keys in Practice | 公钥与私钥实践
If Alice wants to send Bob a confidential message, she obtains Bob’s public key (which Bob has published, for example on his website or a keyserver). She encrypts her message with Bob’s public key. The resulting ciphertext can only be decrypted by Bob’s private key, which only Bob holds. Even if an eavesdropper intercepts the ciphertext, they cannot decode it without the private key.
如果 Alice 想向 Bob 发送机密消息，她获取 Bob 的公钥（Bob 已发布，例如在他的网站或密钥服务器上）。她用 Bob 的公钥加密消息。产生的密文只能用 Bob 的私钥解密，而该私钥只有 Bob 持有。即使窃听者截获了密文，没有私钥也无法解密。
For authentication, the process can be reversed. Bob can encrypt a message (or a hash of it) with his private key. Anyone who has Bob’s public key can decrypt it. Successful decryption proves that the message came from Bob, because only Bob possesses the private key that matches that public key. This is the basis of digital signatures.
对于身份认证，可以反过来操作。Bob 可以用他的私钥加密一条消息（或其哈希）。任何拥有 Bob 公钥的人都可以解密它。成功解密证明消息来自 Bob，因为只有 Bob 拥有与该公钥匹配的私钥。这就是数字签名的基础。
Key generation involves creating a random public/private pair. It is essential that the private key is stored securely, for example in an encrypted file or a hardware security module. If a private key is lost, all data encrypted for it becomes permanently inaccessible. If it is stolen, the attacker can impersonate the owner.
密钥生成涉及创建一个随机的公钥/私钥对。私钥的安全存储至关重要，例如存储在加密文件或硬件安全模块中。如果私钥丢失，所有使用它加密的数据将永久无法访问。如果私钥被盗，攻击者可以冒充所有者。
7. Hashing and Checksums | 哈希与校验和
Hashing is not encryption, but it is closely related to data security. A hash function takes an input of any length and produces a fixed‑size output called a hash value or digest. Even a tiny change in the input drastically alters the output (the avalanche effect). Common hashing algorithms include SHA‑256 and MD5 (though MD5 is considered broken for security purposes).
哈希不是加密，但与数据安全紧密相关。哈希函数接受任意长度的输入，生成固定大小的输出，称为哈希值或摘要。输入中的任何微小变化都会极大地改变输出（雪崩效应）。常见的哈希算法包括 SHA‑256 和 MD5（尽管 MD5 在安全领域已视为不再安全）。
Hashes are used to verify data integrity. When you download a file, the website may provide its SHA‑256 hash. You can compute the hash of the downloaded file yourself and compare it with the published one. If they match, the file has not been tampered with. Websites also store hashed passwords: when you log in, your password is hashed and compared with the stored hash, so the plain‑text password is never kept.
哈希用于验证数据完整性。下载文件时，网站可能提供其 SHA‑256 哈希值。你可以自己计算所下载文件的哈希值并与公布的哈希值进行比较。如果相等，说明文件未被篡改。网站也存储哈希后的密码：当你登录时，系统对你的密码进行哈希运算并与存储的哈希对比，因此明文密码不会被留存。
A checksum is a simpler form of hash used for error detection rather than cryptographic security. For example, CRC (Cyclic Redundancy Check) can detect accidental changes during transmission but is not resistant to deliberate tampering.
校验和是一种更简单的哈希形式，用于错误检测而非密码学安全。例如，CRC（循环冗余校验）可以检测传输过程中的意外变化，但无法抵抗故意篡改。
8. Digital Signatures | 数字签名
A digital signature provides authentication and non‑repudiation. The sender creates a hash of the message and then encrypts that hash with their private key. The encrypted hash is the digital signature, which is attached to the message. The receiver decrypts the signature using the sender’s public key to obtain the hash, then independently hashes the original message and compares the two hashes.
数字签名提供认证和不可否认性。发送者对消息创建哈希，然后用其私钥加密该哈希。加密后的哈希就是数字签名，附在消息之后。接收者使用发送者的公钥解密签名以得到哈希，然后独立地对原始消息求哈希并比较两个哈希值。
If the hashes match, the receiver knows two things: the message has not been altered (integrity), and the message truly came from the claimed sender (authentication). Because only the sender’s private key could have encrypted the hash correctly, the sender cannot later deny having sent the message (non‑repudiation). Digital signatures are widely used in software distribution, email security, and blockchain technology.
如果哈希匹配，接收者就知道两件事：消息未被篡改（完整性），以及消息确实来自声称的发送者（认证）。因为只有发送者的私钥可以正确地加密哈希，发送者事后无法否认发送过该消息（不可否认性）。数字签名广泛用于软件分发、电子邮件安全和区块链技术。
9. SSL/TLS and HTTPS | SSL/TLS 与 HTTPS
SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are protocols that provide encrypted communication over a network. They are the foundation of HTTPS (HTTP Secure), which you see in the padlock icon of your browser. TLS uses a combination of asymmetric and symmetric encryption to establish a secure session.
SSL（安全套接层）及其后继 TLS（传输层安全）是提供网络加密通信的协议。它们是 HTTPS（安全 HTTP）的基础，也就是你在浏览器地址栏中看到的挂锁图标。TLS 结合使用了非对称和对称加密来建立安全会话。
The process begins with a handshake: the client and server agree on a TLS version and cipher suite. The server presents its digital certificate, which contains its public key and is signed by a trusted Certificate Authority (CA). The client verifies the certificate. Then, the client generates a pre‑master secret, encrypts it with the server’s public key, and sends it to the server. Both sides use this to derive a symmetric session key. All subsequent data is encrypted with fast symmetric encryption.
该过程以握手开始：客户端和服务器商定 TLS 版本和密码套件。服务器出示其数字证书，其中包含其公钥并由受信任的证书颁发机构 (CA) 签名。客户端验证证书。随后，客户端生成预主密钥，用服务器的公钥加密后发送给服务器。双方据此推导出对称会话密钥。此后所有数据都使用快速的对称加密进行保护。
HTTPS thus ensures confidentiality, integrity, and server authentication. When you see a website with a valid certificate, you can be confident that your communication is private and that you are connected to the genuine website, not an impostor.
因此，HTTPS 确保机密性、完整性和服务器认证。当你看到一个拥有有效证书的网站时，你可以确信你的通信是私密的，并且你连接的是真正的网站，而不是冒充者。
10. Encryption Strength, Key Length and Attacks | 加密强度、密钥长度与攻击
The strength of encryption is primarily determined by the algorithm and the key length. For example, AES with a 128‑bit key is considered secure against brute‑force attacks because the number of possible keys (2¹²⁸) is astronomically large. Each additional bit doubles the key space. Modern applications typically use 256‑bit keys for high‑security requirements.
加密强度主要由算法和密钥长度决定。例如，使用 128 位密钥的 AES 被认为可抵御暴力破解攻击，因为可能的密钥数量（2¹²⁸）极其庞大。每增加一位就使密钥空间翻倍。现代应用在需要高安全性时通常使用 256 位密钥。
A brute‑force attack involves trying every possible key until the correct one is found. While impractical for long keys, shorter keys can be broken. Outdated algorithms like DES with its 56‑bit key are no longer safe. Frequency analysis, used against classical ciphers, examines the frequency of letters or patterns in ciphertext to deduce the plaintext or key. Modern ciphers are designed to produce seemingly random output to resist such analysis.
暴力破解攻击会尝试每一个可能的密钥，直到找到正确的那一个。虽然对长密钥不可行，但短密钥却能被破解。像 56 位密钥的 DES 这样的过时算法已不再安全。频率分析用于对抗古典密码，它检查密文中字母或模式的频率以推断明文或密钥。现代密码设计成产生看起来随机的输出，以抵抗这种分析。
Other attacks include man‑in‑the‑middle (MITM), where an attacker intercepts and potentially alters communications, and side‑channel attacks that exploit physical implementations. Using strong protocols like TLS and keeping software up to date protects against many of these threats.
其他攻击包括中间人攻击（MITM），即攻击者截获并可能篡改通信，以及利用物理实现缺陷的侧信道攻击。使用像 TLS 这样的强协议并保持软件更新，可以抵御许多此类威胁。
Published by TutorHao | Computer Science Revision Series | aleveler.com
更多咨询请联系16621398022（同微信）
屏轩国际教育cambridge primary/secondary checkpoint, cat4, ukiset,ukcat,igcse,alevel,PAT,STEP,MAT, ibdp,ap,ssat,sat,sat2课程辅导，国外大学本科硕士研究生博士课程论文辅导Cancel reply