Bell-LaPadula vs. Biba

Bell-LaPadula protects confidentiality ("no read up, no write down"); Biba protects integrity ("no read down, no write up": a subject cannot change an object at a higher integrity level). Biba's rules are the duals of Bell-LaPadula's, mirror images of each other, which is exactly why they're confused.[3][4]

Symmetric vs. asymmetric cryptography

Symmetric (AES) is fast and uses one shared key for both operations, but the number of keys needed grows quickly as relationships multiply. Asymmetric (RSA, ECC) uses public/private key pairs and needs fewer keys but is much slower, which is why systems use a hybrid: asymmetric for signatures and initial key establishment, symmetric for bulk encryption. TLS works this way: its handshake establishes shared keying material that the record protocol then uses to protect traffic.[6][7][8][9][19]

Hashing vs. encryption

Hashing is one-way (integrity/verification: recompute and compare); encryption is reversible with the right key (confidentiality). A hash is not "weak encryption," it's a fundamentally different operation with no key and no practical way back from the hash value to the input.[10][11][12]

Security modes of operation

Dedicated, system high, compartmented, and multilevel describe how a system handles users with different clearance levels accessing data of different classifications. Dedicated: every user is cleared, approved, and has need-to-know for all data. System high: every user is cleared and approved for all data, but not everyone has need-to-know. Compartmented: everyone is cleared for the single classification level, but not for every category. Multilevel: two or more levels are handled at once even though some users lack clearance for some of the data.[13][14][15]

Trusted Platform Module (TPM)

A special type of hardware security module that generates cryptographic keys and protects small amounts of sensitive data (passwords, keys, hash measurements). A main use is storing measurements of platform firmware and configuration during boot so platform integrity can be attested later. Related: a Trusted Execution Environment (TEE) is an enclave protected by the processor and underpins confidential computing (protecting data in use).[16][17][18]

Bell-LaPadula vs. Biba (again)

Worth repeating: confidentiality model means read down is OK, write up is OK (a subject reads only objects its clearance dominates and writes only to objects whose classification dominates its clearance, so secrets don't leak down). Integrity model means read up is OK, write down is OK (the dual rules, which protect clean data from corruption by less-trusted sources).[4][5]

Digital signature vs. encryption

A digital signature (the message's hash, cryptographically transformed with the signer's private key) provides authenticity, integrity, and support for non-repudiation; it does not provide confidentiality on its own, since the recipient receives the message alongside the signature. Confidentiality comes from encryption. Confusing "signed" with "encrypted" is a classic mistake.[11][19][20]