Cryptographic Vulnerabilities Explained for Security+ and CySA+

Cryptographic Vulnerabilities Explained: A

 Security+, CySA+, PenTest+, and SecurityX Guide

Sep 27, 2026 · @Ken

What Counts as a Cryptographic Vulnerability

Almost nobody breaks the math. Modern algorithms like AES-256 don't fall to clever cryptanalysis, and exam questions rarely ask you to attack a cipher directly.

What fails is everything around the math. A cryptographic vulnerability is any weakness that lets an attacker defeat the confidentiality, integrity, or authenticity that encryption was supposed to provide — and in practice those weaknesses cluster into four categories:

• Algorithm weakness — the primitive itself is broken or too small. MD5 collisions, 56-bit DES keys.
• Implementation flaws — a sound algorithm used incorrectly. ECB mode, a reused nonce, a predictable random number generator.
• Key management failures — the algorithm and the code are fine, but the key is hardcoded, shared, never rotated, or stored next to the data it protects.
• Protocol weakness — the negotiation is exploitable even when both endpoints support strong crypto. Downgrade attacks live here.

That four-way split is worth memorizing, because it is also a diagnostic. When a scenario describes encrypted data being read by an attacker, working out which category failed usually eliminates two or three answer options immediately.

Deprecated Algorithms and Weak Primitives

These appear constantly as wrong answers, and occasionally as the thing a scenario is quietly telling you is broken.

Primitive	Problem	What replaced it
DES	56-bit key, brute-forceable	AES
3DES	Small block size, sunset by NIST	AES
RC4	Keystream biases; prohibited in TLS	AES-GCM, ChaCha20
MD5	Practical collisions	SHA-256 or better
SHA-1	Practical collisions since 2017	SHA-256, SHA-3
RSA-1024	Key length too short	RSA-2048 minimum, 3072+ preferred
WEP	RC4 plus a tiny reused IV	WPA2, WPA3
TKIP	Built to patch WEP on old hardware	CCMP/AES, WPA3
SSL 2.0/3.0, TLS 1.0/1.1	Structural flaws, weak ciphers	TLS 1.2 minimum, TLS 1.3 preferred

Two distinctions the exams lean on:

Broken is not the same as deprecated. MD5 and SHA-1 are broken — collisions are demonstrable, so they must not be used for signatures or certificates. 3DES is deprecated — not practically broken, but retired on schedule. MD5 also survives legitimately as a non-security checksum for detecting accidental corruption, which is why "MD5 is always wrong" is a trap.

Hashing is not encryption. Hashing is one-way and provides integrity. Encryption is reversible and provides confidentiality. Questions frequently offer a hashing answer to an encryption problem, or the reverse, and the wording is deliberately close.

The Attacks the Exams Name

Collision attack. Two different inputs produce the same hash. Once collisions are findable, a hash can no longer prove integrity — an attacker can substitute a malicious file whose hash matches the legitimate one. This is what killed MD5 and SHA-1 for signatures and certificates.

Birthday attack. The mathematical reason collisions are easier to find than intuition suggests. Named for the birthday paradox: in a room of 23 people there is a better-than-even chance two share a birthday. The practical consequence is that finding any collision takes roughly the square root of the search space — so a 128-bit hash offers only about 64 bits of collision resistance.

Keep those two straight. Birthday is the principle; collision is the attack it makes feasible.

Downgrade attack. The attacker forces both parties to negotiate a weaker protocol or cipher suite that they still support for backward compatibility, then attacks the weaker option. POODLE, FREAK, and Logjam all work this way. Note the shape: nothing about the strong crypto failed — the attacker simply arranged for it not to be used.

Brute force. Trying every possible key or password. Defeated by key length, not cleverness, which is why key size appears so often in answer options.

Rainbow tables. Precomputed hash lookups that turn password cracking into a fast search. The specific defense is salting — a unique random value per password, which makes precomputation useless because every instance of the same password hashes differently.

If a question describes password hashes being cracked quickly in bulk, the answer is almost always that they were unsalted.

Implementation and Key Management Failures

This is where most real-world cryptographic failures actually happen — strong algorithms, used wrong.

• ECB mode. Electronic Codebook encrypts identical plaintext blocks to identical ciphertext blocks, so the data's structure survives encryption. The classic demonstration is an encrypted bitmap where the original image is still recognizable. Use an authenticated mode such as GCM instead.
• IV and nonce reuse. Initialization vectors and nonces must never repeat under the same key. Reuse breaks stream ciphers outright and is catastrophic for AES-GCM. WEP's fatal flaw was a 24-bit IV that cycled quickly enough to collect collisions off a busy network.
• Weak entropy. Keys are only as unpredictable as the random number generator that produced them. A seeded or low-entropy PRNG yields guessable keys no matter how long they are.
• Hardcoded and committed keys. API keys and private keys embedded in source or pushed to a repository. Rotation is the only real remediation once exposed — removing the commit does not help, because it is already cloned.
• Unsalted or fast password hashes. Salting defeats precomputation. Beyond that, general-purpose hashes like SHA-256 are too fast for passwords. Use a deliberately slow function: bcrypt, scrypt, Argon2, or PBKDF2. Key stretching is the term the exams use.
• Improper certificate validation. Accepting expired, self-signed, revoked, or hostname-mismatched certificates — or disabling validation in code to make an integration work. This turns TLS into encryption without authentication, which is exactly what a machine-in-the-middle needs.

That last one is the quiet one. The connection is encrypted, the padlock appears, and the traffic is still being read.

Harvest Now, Decrypt Later

One cryptographic risk is unusual: the vulnerability is in the future, but the exposure is today.

Harvest now, decrypt later describes an adversary capturing encrypted traffic they cannot currently read, storing it, and waiting for a cryptographically relevant quantum computer to break it retroactively. Shor's algorithm threatens the asymmetric algorithms underpinning key exchange and digital signatures — RSA, Diffie-Hellman, and elliptic curve. Symmetric crypto is far less affected; doubling the key length is broadly sufficient, which is part of why AES-256 is recommended over AES-128 for long-lived data.

The practical consequence: data with a long confidentiality lifetime — medical records, classified material, intellectual property — is already at risk, even though no such computer is known to exist.

NIST finalized the first post-quantum standards in August 2024:

• ML-KEM (FIPS 203), derived from CRYSTALS-Kyber, for key encapsulation
• ML-DSA (FIPS 204), derived from CRYSTALS-Dilithium, for digital signatures
• SLH-DSA (FIPS 205), derived from SPHINCS+, a hash-based signature alternative

The concept that ties this together is cryptographic agility — designing systems so an algorithm can be swapped without re-architecting everything around it. Organizations that hardcoded RSA throughout their stack face a painful migration.

Detection and Mitigation

Control	What it addresses
Cipher suite policy	Disable SSL and TLS 1.0/1.1, remove export and NULL ciphers, require TLS 1.2 minimum and prefer 1.3. Removing weak options is what actually stops downgrade attacks
TLS and configuration scanning	nmap --script ssl-enum-ciphers, sslscan, testssl.sh and standard vulnerability scanners surface weak protocols and ciphers on live services
Certificate lifecycle management	Inventory, monitor expiry, automate renewal, verify revocation. Expired certificates are the most common crypto finding in any real environment
Hardware-backed key storage	HSMs, TPMs, and secure enclaves keep private keys out of application memory and off disk
Secrets scanning in CI/CD	Catches hardcoded keys before they reach a repository, with rotation as the response when one gets through
Strong password hashing	bcrypt, scrypt, Argon2 or PBKDF2 with a unique salt per credential
Cryptographic inventory	Knowing which algorithms and key lengths are in use where — the prerequisite for any migration, and the foundation of crypto agility

The recurring theme is that mitigation is about removing options, not adding protection. A server that supports both TLS 1.3 and SSL 3.0 is as weak as its weakest supported option, because the attacker chooses which one gets negotiated.

Security+ (SY0-701) Exam Tips

Security+ is where this topic carries the most weight, and it splits the material across two domains:

• Domain 1, General Security Concepts — the cryptographic solutions themselves: PKI, symmetric versus asymmetric, key exchange, algorithms and key length, hashing, salting, digital signatures, key stretching, certificates
• Domain 2, Threats, Vulnerabilities, and Mitigations — the cryptographic attacks, named explicitly as downgrade, collision, and birthday

What to drill:

• Those three attack names. They are called out in the objectives, so expect at least one question that hinges on telling them apart. Birthday is the principle, collision is the attack, downgrade is the negotiation trick.
• Symmetric versus asymmetric, cold. Which is fast, which solves key distribution, which does digital signatures, and why TLS uses both — asymmetric to exchange a key, symmetric for the bulk data.
• Salting versus key stretching. Salt defeats precomputation. Key stretching makes each guess slow. Questions treat them as distinct controls because they are.
• The certificate vocabulary: CA, intermediate, root of trust, CSR, CRL, OCSP, wildcard, SAN, self-signed. Certificate questions are common and mostly test vocabulary precision.
• Recognize the deprecated list on sight. Seeing DES, RC4, MD5, SHA-1, or WEP in a scenario usually tells you where the weakness is.

One timing note. SY0-701 launched in November 2023 and remains current. CompTIA has signaled SY0-801, with availability expected late 2026 or early 2027 and SY0-701 retiring around mid-2027. Anything you study now still applies — cryptographic fundamentals are the most stable material on the exam — but check CompTIA's site before booking if you are planning far ahead.

CySA+ (CS0-004) Exam Tips

CySA+ moved to CS0-004 in June 2026. CS0-003 retires on 22 December 2026 in English, with translated versions following in March 2027 — so if you are studying older material, check that date before you book.

CS0-004 domains: Security Operations (34%), Vulnerability Management (26%), Incident Response and Management (24%), Reporting and Communication (16%).

CySA+ does not teach cryptography. It tests what an analyst does when crypto findings land in a queue, which is a different skill:

• Read the finding, not the algorithm. "SSL Medium Strength Cipher Suites Supported" or "SSL Certificate Expired" are scanner outputs you should recognize and be able to explain to a system owner.
• Prioritization is the real exam skill. Vulnerability Management is 26% of the exam, and it is mostly about triage. A weak cipher on an internet-facing payment system outranks the same finding on an isolated internal host, and CVSS base score alone does not tell you that — exposure, data sensitivity, and compensating controls do.
• Expect false positives. Crypto findings generate them heavily. A scanner flagging TLS 1.0 on a port where the service enforces 1.2 at the application layer is a finding you validate before escalating.
• Expired certificates are an availability incident too. They break integrations and take services down, which puts them in Incident Response as often as Vulnerability Management.
• Reporting and Communication is 16%. Being able to explain to a non-technical owner why a deprecated cipher matters, and what the remediation costs are, is explicitly examined.

If you are studying both, the division is clean: Security+ teaches you what the crypto is; CySA+ teaches you what to do when it shows up broken in a report.

PenTest+ (PT0-003) Exam Tips

PenTest+ maps cryptographic weaknesses into the Attacks and Exploits domain, and the framing shifts from recognizing to exploiting.

• Know the enumeration tools by name. nmap --script ssl-enum-ciphers, sslscan and testssl.sh for protocol and cipher discovery. Expect them as answer options in scenario questions.
• Password cracking is crypto exploitation. Hashcat and John the Ripper are the two to know, along with why a captured NTLM or WPA2 handshake is worth cracking offline — no rate limiting, no lockout, no alerting.
• Hash identification matters. Recognizing what you have captured — NTLM, bcrypt, MD5 — determines whether cracking is worth attempting at all. A bcrypt hash with a high work factor is usually not.
• Padding oracle attacks appear as a named technique against improperly implemented CBC-mode encryption.
• Certificate validation weaknesses enable a man-in-the-middle during an engagement, particularly against mobile and thick-client applications that accept any certificate.
• Scope and authorization still apply. Cracking captured hashes offline may fall outside the rules of engagement even when capturing them was in scope. PenTest+ tests that boundary regularly.
• Reporting is a domain of its own. The finding is never "weak encryption found." It names the specific protocol or cipher, the affected hosts, what an attacker can achieve with it, and the configuration change that fixes it.

SecurityX (CAS-005) Exam Tips

SecurityX covers the same material at enterprise scale, across Security Architecture (27%) and Security Engineering (31%), with governance implications in Governance, Risk and Compliance (20%).

The shift is from "which algorithm is weak" to "how do you run cryptography across an estate":

• Cryptographic agility is a core concept. Expect scenarios about migrating off a deprecated algorithm, and answers that favor abstraction and inventory over point fixes.
• Post-quantum planning is in scope. Know harvest-now-decrypt-later as a present risk, that asymmetric crypto is the exposed part, and that NIST standardized ML-KEM, ML-DSA, and SLH-DSA in 2024.
• Enterprise key management. HSMs, key ceremonies, escrow, rotation policy, separation of duties, and cloud KMS models — including who holds the keys under bring-your-own-key and hold-your-own-key arrangements.
• Certificate management at scale. Internal CA design, cross-certification, pinning, automated renewal, and revocation strategy across thousands of endpoints.
• Compliance drives the answer more often than it does on Security+. FIPS 140 validation, data residency, and regulated-industry requirements can make the technically strongest option the wrong one.
• Expect trade-off questions. SecurityX frequently gives several workable answers and asks for the best one given cost, compatibility, or regulatory constraints.

Key Takeaways

• Cryptographic vulnerabilities fall into four buckets: weak algorithms, flawed implementations, poor key management, and protocol weaknesses. Identifying which bucket a scenario falls into eliminates most wrong answers.
• Know the deprecated list on sight: DES, 3DES, RC4, MD5, SHA-1, RSA-1024, WEP, TKIP, SSL and TLS 1.0/1.1. Broken (MD5, SHA-1) and deprecated (3DES) are not the same thing.
• The birthday attack is the principle that makes collisions findable. Downgrade attacks defeat strong crypto by making sure it is never negotiated.
• Salting defeats rainbow tables; key stretching makes each guess slow. Two different controls, frequently confused.
• Most real failures are implementation, not math: ECB mode, reused IVs, weak entropy, hardcoded keys, and disabled certificate validation.
• Harvest now, decrypt later makes post-quantum a present-day risk for long-lived data. NIST standardized ML-KEM, ML-DSA, and SLH-DSA in 2024, and cryptographic agility ties the migration together.
• Mitigation means removing weak options, not layering on protection — a server is only as strong as the weakest suite it will still negotiate.
• For example: Security+ teaches the primitives and the three named attacks; CySA+ (CS0-004) tests triage and prioritization of crypto findings; PenTest+ tests exploitation and tooling; SecurityX tests enterprise key management, agility, and post-quantum planning.