Recommended Free Tools
Cryptography is a set of tools for different security jobs: encryption protects secrecy, hashes help detect changes, digital signatures support integrity and signatory authentication, certificates connect public keys to identities, and key exchange establishes shared keying material. They are not interchangeable. A secure system combines the right tools and manages their keys and trust relationships.
What does each cryptographic tool do?
The quickest way to understand cryptography is to start with the job a mechanism performs. A hash, for example, can reveal that data changed, but it does not by itself prove who created that data. A signature can help establish who signed data, but it does not hide the data. Encryption addresses confidentiality.
As an Amazon Associate I earn from qualifying purchases.
| Mechanism | Main job | Key model | Important distinction |
|---|---|---|---|
| AES | Confidentiality | Shared secret key | Key distribution, the mode of operation and authentication all matter. |
| RSA | Signatures or key establishment, depending on the scheme | Public/private key pair | Signing and establishing keys are distinct uses with separate standards. |
| ECC | Key agreement or signatures, depending on the technique | Public/private key pair based on elliptic-curve mathematics | ECDH and ECDSA perform different operations. |
| Plain hash | Produce a digest for change detection and other constructions | No secret key | Alone, it does not authenticate a sender. |
| Digital signature | Integrity checking and signatory authentication | Private key to sign; corresponding public key to verify | It does not encrypt the signed content. |
| PKI certificate | Bind a public key to an identity through an issuer’s signature | Public data signed by a trusted certification authority | A certificate is not the corresponding private key. |
| Key exchange | Establish shared keying material | Depends on the protocol | It sets up material for protection; it does not itself encrypt an entire session. |
How are AES, RSA and ECC different?
AES is symmetric cryptography: communicating parties use the same secret key. RSA and elliptic-curve cryptography (ECC) are public-key families, which use related public and private keys. Public-key methods can support different operations, so the family name alone does not tell you whether a particular scheme is encrypting, signing or establishing keys.
AES: shared-key encryption
AES stands for Advanced Encryption Standard. It is a block cipher, not a complete communications protocol. Both parties need access to the shared secret key, so distributing and protecting that key is part of the security problem. In practical systems, the cipher is used with a mode of operation; nonce or initialization-vector handling and authentication requirements also matter.
#1 Best Overall
NIST’s FIPS 197, originally published in 2001, was updated on May 9, 2023. NIST said the update modernized editorial material and made no technical changes to the AES algorithm.
RSA: a public-key family with separate uses
RSA uses a mathematically related public and private key. NIST treats RSA signatures and RSA-based key establishment separately: FIPS 186-5 covers RSA digital signatures, while SP 800-56B Rev. 2 covers RSA-based key establishment, including key agreement and key transport. The latter was reaffirmed as current by NIST on January 6, 2026.
Do not assume that an RSA signature operation and an RSA key-establishment operation are the same thing just because both involve RSA keys. Their goals and applicable standards differ.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →ECC: a family, not one operation
ECC uses elliptic-curve mathematics for public-key cryptography. ECDH is a key-agreement technique; ECDSA is a signature scheme. EdDSA is another signature technique that uses Edwards curves. These names describe different operations, not interchangeable labels for one general-purpose algorithm.
NIST SP 800-56A Rev. 3, published in April 2018, covers discrete-logarithm key establishment over finite fields and elliptic curves. On January 6, 2026, NIST announced plans to update the publication, including changes addressing widely adopted x-coordinate-only ECC key-agreement implementations. That announcement is a planned update, not a replacement standard already in force.
What does hashing do, and how is it different from encryption?
A cryptographic hash function maps a message of any supported length to a fixed-length digest. If a message changes, its digest should change with very high probability. That makes digests useful for detecting changes and as components in signatures, message-authentication codes and other mechanisms.
Hashing is not encryption. Encryption is designed to protect data so that an authorized party with the right key can recover it; a hash is not intended to be reversed to recover the original message. A plain hash also does not prove who made the message: anyone who can change the message can generally calculate a new digest for it.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
NIST FIPS 180-4 specifies SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224 and SHA-512/256. The standard’s NIST page notes that a revision was planned in March 2023. Which hash is appropriate depends on the use case and current transition guidance; the list of algorithms in a standard is not, by itself, a recommendation to use every one for every purpose.
What does a digital signature prove?
A signer uses a private key to generate a signature, and a verifier uses the corresponding public key to check it. A valid signature can help detect unauthorized changes and authenticate the signatory when the public key is reliably associated with that person or organization. It does not conceal the signed message.
NIST’s FIPS 186-5 specifies RSA, ECDSA and EdDSA for digital-signature generation and verification. Its abstract describes the document this way: “This standard specifies a suite of algorithms that can be used to generate a digital signature.” NIST published FIPS 186-5 on February 3, 2023; a 2025 planning note identifies issues for future correction or revision, so consult the standard’s current status and errata when implementing it.
A hash and a signature often work together, but they are not the same mechanism. A digest summarizes data; a signature operation uses a private key to create a value that can be checked with the corresponding public key. That public-key check does not automatically tell the verifier whose key it is. Identity binding and trust are separate concerns.
What are certificates and PKI?
A public-key certificate is data that identifies a public key and its authorized owner, signed by a trusted certification authority (CA) to bind the key to that owner. The certificate contains the public key and identity claims; the corresponding private key is held separately and must remain under its owner’s control.
PKI, or public key infrastructure, is the broader system that helps users make and validate those associations. It includes CAs, policies, software, and certificate validation and revocation processes. A certificate is one part of PKI, not another name for the whole system. NIST’s glossary entry for “Public key certificate” describes the certificate’s identity-and-key binding; the entry was accessed October 7, 2026.
When a system checks a certificate, it is evaluating whether it can trust the binding under the relevant rules—not merely whether the certificate exists. A valid certificate also does not mean the private key is embedded in it or that the holder has proved possession of that key in every context.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What is key exchange, and why is it not enough on its own?
Key exchange, also called key establishment, lets parties produce shared keying material. A protocol can then use that material in later steps to protect a conversation. The setup mechanism and the bulk protection of the session have different jobs.
NIST SP 800-56A Rev. 3 covers finite-field and elliptic-curve discrete-logarithm key-establishment schemes, including Diffie-Hellman variants. SP 800-56B Rev. 2 covers schemes based on integer-factorization cryptography, particularly RSA. These are separate standards for different mathematical approaches.
Best Value
Establishing shared material does not, by itself, establish that the other endpoint is the intended person or server. A complete protocol must also address peer authentication—for example, by validating a certificate and checking a signature as part of the protocol. Otherwise, parties may establish keys without having reliably established with whom they are communicating.
How do these pieces fit into a secure system?
A typical design assigns each mechanism a narrow role: authenticate the peer, establish shared keying material, and use that material with an appropriate symmetric protection scheme. Hashes and signatures may support integrity checks and authentication along the way. The exact composition depends on the protocol; simply adding cryptographic algorithms does not guarantee a secure design.
- For confidentiality: identify the encryption scheme and how its secret key is protected.
- For change detection: determine whether a plain digest is sufficient or whether an authenticated construction is required.
- For identity: check how a public key is associated with the claimed person or service and how that association is validated.
- For key setup: distinguish key establishment from the protection of the later session, and determine how the peer is authenticated.
- For maintenance: track standard revisions and plan algorithm or key-length transitions rather than assuming a choice remains suitable indefinitely.
NIST SP 800-131A Rev. 2, published March 21, 2019, provides guidance for transitioning cryptographic algorithms and key lengths and includes post-quantum algorithms in its scope. Transition planning is a reason to review systems as guidance evolves; it is not evidence that every system using a current algorithm is immediately vulnerable.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
