📚 A-Level Computer Science: Encryption Essentials | A-Level 计算机：加密 考点精讲
Encryption is a cornerstone of modern cybersecurity, transforming plaintext into ciphertext to protect data from unauthorised access. In A-Level Computer Science, you will explore symmetric and asymmetric encryption, hashing, digital signatures, and the crucial role of key management. Understanding these concepts not only helps you ace your exams but also equips you with foundational knowledge for real-world security applications.
加密是现代网络安全的基石，它将明文转换为密文，以防止未经授权的访问。在 A-Level 计算机课程中，你将学习对称加密与非对称加密、哈希、数字签名以及密钥管理的关键作用。掌握这些概念不仅能帮助你在考试中取得高分，还能为现实世界中的安全应用打下坚实基础。
1. What is Encryption? | 什么是加密？
Encryption is the process of encoding a message so that only authorised parties can read it. The original readable data is called plaintext, and the encoded unreadable form is ciphertext. A cipher is the algorithm used to perform encryption and decryption, typically requiring a key.
加密是将消息编码，使得只有授权方才能读取的过程。原始可读数据称为明文，编码后不可读的形式称为密文。密码是用于执行加密和解密的算法，通常需要密钥。
In symmetric encryption, the same key is used for both encryption and decryption. In asymmetric encryption, a pair of mathematically related keys—public and private—is used. The strength of encryption depends on the key length and the algorithm’s resistance to attack.
在对称加密中，同一个密钥用于加密和解密。在非对称加密中，使用一对数学上相关的密钥——公钥和私钥。加密的强度取决于密钥长度以及算法抵抗攻击的能力。
2. Symmetric Encryption | 对称加密
Symmetric encryption uses a single shared key to both encrypt and decrypt data. Common symmetric algorithms include AES (Advanced Encryption Standard) and DES (Data Encryption Standard). The main advantage is speed: symmetric ciphers are computationally efficient for large volumes of data.
对称加密使用单一共享密钥来加密和解密数据。常见的对称算法包括 AES（高级加密标准）和 DES（数据加密标准）。其主要优点是速度快：对称密码对于大量数据的处理效率很高。
However, the challenge lies in secure key distribution. If an attacker obtains the shared key, all communication protected by that key is compromised. Therefore, symmetric encryption is often used in combination with asymmetric methods to exchange keys securely.
然而，挑战在于密钥的安全分发。如果攻击者获取了共享密钥，那么由该密钥保护的所有通信都将被破解。因此，对称加密通常与非对称方法结合使用，以安全地交换密钥。
3. Asymmetric Encryption | 非对称加密
Asymmetric encryption, also known as public-key cryptography, uses two different but mathematically linked keys: a public key and a private key. The public key can be freely distributed, while the private key must be kept secret. RSA and Elliptic Curve Cryptography (ECC) are widely used asymmetric algorithms.
非对称加密，也称为公钥加密，使用两个不同但数学相关的密钥：公钥和私钥。公钥可以自由分发，而私钥必须保密。RSA 和椭圆曲线加密（ECC）是广泛使用的非对称算法。
If someone wants to send a secure message, they encrypt it with the recipient’s public key. Only the recipient can decrypt it using their corresponding private key. This resolves the key distribution problem inherent in symmetric systems, but asymmetric encryption is slower and more resource-intensive.
如果有人想发送安全消息，他们会使用接收者的公钥对消息加密。只有接收者可以使用对应的私钥解密。这解决了对称系统中固有的密钥分发问题，但非对称加密速度较慢且资源消耗更大。
4. Hash Functions | 哈希函数
A hash function takes an input (or message) and returns a fixed-size string of bytes, typically a digest that appears random. Good hash functions are one-way (preimage resistant), deterministic (same input always produces same output), collision-resistant (hard to find two different inputs with the same hash), and produce an avalanche effect (a small change in input dramatically changes the output).
哈希函数接收一个输入（或消息）并返回一个固定大小的字节串，通常是一个看起来随机的摘要。好的哈希函数是单向的（原像抗性）、确定性的（相同输入始终产生相同输出）、抗碰撞的（难以找到两个不同输入具有相同哈希值），并产生雪崩效应（输入的微小变化会导致输出的巨大变化）。
Common hashing algorithms include SHA-256 (part of SHA-2 family) and the older MD5 (now considered broken). Hashing is not encryption because it cannot be reversed to retrieve the original message; it is used for integrity checks, password storage, and as part of digital signatures.
常见的哈希算法包括 SHA-256（SHA-2 系列的一部分）和较旧的 MD5（现已被认为不安全）。哈希不是加密，因为它无法逆转以获取原始消息；它用于完整性校验、密码存储以及作为数字签名的一部分。
5. Digital Signatures | 数字签名
A digital signature provides authentication, non-repudiation, and integrity. The sender creates a hash of the message and encrypts that hash with their private key. The recipient decrypts the signature using the sender’s public key to retrieve the hash, and then independently computes the hash of the received message. If the two hashes match, the signature is valid.
数字签名提供身份验证、不可否认性和完整性。发送者创建消息的哈希，并用其私钥加密该哈希。接收者使用发送者的公钥解密签名以恢复哈希，然后独立计算所收到消息的哈希。如果两个哈希匹配，则签名有效。
This process proves that the message originated from the owner of the private key and that it has not been altered in transit. Digital signatures are fundamental to secure email, software distribution, and blockchain technology.
这个过程证明消息来源于私钥所有者，且在传输过程中未被更改。数字签名是安全电子邮件、软件分发和区块链技术的基础。
6. Symmetric vs Asymmetric: Key Differences | 对称与非对称：主要区别
| Feature | Symmetric | Asymmetric |
|---|---|---|
| Keys | Single shared key | Public/private key pair |
| Speed | Fast; suitable for bulk data | Slower; used for small data or key exchange |
| Key distribution | Difficult; must be kept secret | Easy; public key can be openly shared |
| Use cases | Encrypting large files, streaming | Secure email, SSL/TLS handshake, digital signatures |
For A-Level exams, you must be able to compare these two models in terms of strengths, weaknesses, and appropriate use cases. A common hybrid approach: use asymmetric encryption to exchange a symmetric session key, then use that session key for the rest of the communication.
在 A-Level 考试中，你必须能够从优点、缺点和适用场景方面比较这两种模式。一种常见的混合方法是：使用非对称加密交换对称会话密钥，然后使用该会话密钥进行后续通信。
7. SSL/TLS and Encryption in Practice | 实践中的 SSL/TLS 与加密
Secure Sockets Layer (SSL) and its successor Transport Layer Security (TLS) are protocols that provide secure communication over a computer network. The TLS handshake involves client and server agreeing on a cipher suite, authenticating the server using digital certificates, and securely exchanging a session key via asymmetric encryption. After the handshake, symmetric encryption is used for data transfer.
安全套接字层（SSL）及其继任者传输层安全（TLS）是在计算机网络上提供安全通信的协议。TLS 握手涉及客户端和服务器协商密码套件、使用数字证书验证服务器身份，并通过非对称加密安全地交换会话密钥。握手完成后，使用对称加密进行数据传输。
This protocol is the backbone of HTTPS, ensuring that web traffic is encrypted and protected from eavesdropping and tampering. Understanding the role of encryption in TLS is a key syllabus requirement.
该协议是 HTTPS 的支柱，确保网络流量被加密并防止窃听和篡改。理解加密在 TLS 中的作用是教学大纲的关键要求。
8. Digital Certificates and Certificate Authorities | 数字证书与证书颁发机构
A digital certificate binds a public key to an entity (such as a website or person). It contains information about the key, the identity of its owner, and a digital signature from a trusted Certificate Authority (CA). The CA verifies the owner’s identity before issuing the certificate.
数字证书将公钥与实体（例如网站或个人）绑定。它包含有关密钥、其所有者身份的信息，以及来自受信任的证书颁发机构（CA）的数字签名。CA 在颁发证书之前会验证所有者的身份。
When you connect to a secure website, your browser checks that the certificate is valid, signed by a trusted CA, and hasn’t expired or been revoked. This prevents man-in-the-middle attacks by confirming that the public key genuinely belongs to the site you intended to visit.
当你连接到安全网站时，浏览器会检查证书是否有效、是否由受信任的 CA 签名、是否未过期或未被吊销。这通过确认公钥确实属于你想要访问的网站来防止中间人攻击。
9. Common Encryption Algorithms | 常见加密算法
Knowledge of specific algorithms is essential at A-Level. The main symmetric algorithms are:
- AES: block cipher with key sizes of 128, 192, or 256 bits. Widely adopted as a standard by governments and industry.
- DES/3DES: older 56-bit key algorithm now insecure; 3DES applies DES three times for improved security but is slower.
- Blowfish/Twofish: alternative block ciphers with variable key lengths.
了解特定算法在 A-Level 中至关重要。主要的对称算法包括：
- AES：分组密码，密钥长度为 128、192 或 256 位。被政府和工业界广泛采用为标准。
- DES/3DES：较旧的 56 位密钥算法，现已不安全；3DES 对 DES 应用三次以提高安全性，但速度较慢。
- Blowfish/Twofish：具有可变密钥长度的替代性分组密码。
Key asymmetric algorithms are RSA (based on factorisation of large primes), ECC (based on elliptic curves, offering equivalent security with smaller keys), and Diffie-Hellman (used for key exchange).
关键的非对称算法有 RSA（基于大素数分解）、ECC（基于椭圆曲线，能以更小的密钥提供同等安全性）和 Diffie-Hellman（用于密钥交换）。
10. Hashing in Password Storage and Integrity | 哈希在密码存储与完整性中的应用
Passwords should never be stored in plaintext. Instead, systems store the hash of a password combined with a salt (random data added to defend against rainbow table attacks). When a user logs in, the system hashes the entered password with the same salt and compares it to the stored hash.
密码绝不应以明文存储。相反，系统存储密码与盐（添加的随机数据，用于防御彩虹表攻击）组合后的哈希值。当用户登录时，系统对输入的密码使用相同的盐进行哈希处理，并与存储的哈希值进行比较。
For file integrity, hash values detect unauthorised changes. If the hash of a downloaded file matches the official hash published by the author, the file is intact. This is used in software downloads and forensic investigations.
对于文件完整性，哈希值可检测未经授权的更改。如果下载文件的哈希值与作者发布的官方哈希值匹配，则该文件完整无缺。这用于软件下载和取证调查。
11. Attacks on Encryption | 加密攻击
Encryption systems face various threats. Brute-force attacks try every possible key; longer keys make this impractical. Man-in-the-middle attacks intercept and alter communication; TLS with certificate validation defends against them. Side-channel attacks exploit physical implementation weaknesses rather than algorithmic flaws.
加密系统面临各种威胁。暴力攻击尝试所有可能的密钥；更长的密钥使此不切实际。中间人攻击拦截并篡改通信；带有证书验证的 TLS 可防御这些攻击。旁路攻击利用物理实现弱点而非算法缺陷。
Older algorithms like DES and MD5 are vulnerable to collision attacks. Poor key management or reuse of nonces (numbers used once) can also break security. Good practice includes using secure random number generators and always applying proper padding in block ciphers.
DES 和 MD5 等旧算法容易受到碰撞攻击。糟糕的密钥管理或重复使用现时（一次性使用的数字）也可能破坏安全性。良好实践包括使用安全的随机数生成器，并始终在分组密码中应用正确的填充。
12. Exam Tips and Key Recap | 考试技巧与重点回顾
In exam questions, be precise with terminology: distinguish clearly between ‘encryption’ and ‘hashing’, ‘symmetric’ and ‘asymmetric’. Use diagrams to illustrate public/private key exchange and digital signing process. Provide concrete examples like ‘when you visit a bank website, TLS uses asymmetric encryption for key exchange and symmetric for the session’.
在考试题目中，要精确使用术语：清楚地区分“加密”和“哈希”、“对称”和“非对称”。使用图表说明公/私钥交换和数字签名过程。提供具体示例，例如“当你访问银行网站时，TLS 使用非对称加密进行密钥交换，对称加密用于会话”。
Remember that hash functions are not encryption, digital signatures involve encrypting a hash with a private key, and certificates rely on a chain of trust. Practise explaining how TLS uses both types of encryption. Typical mark schemes reward structured comparisons and correct identification of properties.
请记住，哈希函数不是加密，数字签名涉及用私钥加密哈希，证书依赖于信任链。练习解释 TLS 如何使用两种加密类型。典型的评分标准奖励结构化的比较和对属性的正确识别。
Published by TutorHao | Computer Science Revision Series | aleveler.com
更多咨询请联系16621398022（同微信）
屏轩国际教育cambridge primary/secondary checkpoint, cat4, ukiset,ukcat,igcse,alevel,PAT,STEP,MAT, ibdp,ap,ssat,sat,sat2课程辅导，国外大学本科硕士研究生博士课程论文辅导