ACL Cryptography & Encryption 2 — Questions and Answers
Question 1: Which encryption mode of operation turns a block cipher into a stream cipher by XORing plaintext with an encrypted counter value?
- CBC
- ECB
- CTR (Correct answer)
- CFB
Correct answer: CTR
Counter (CTR) mode encrypts a sequentially incrementing counter and XORs the result with plaintext, effectively creating a keystream like a stream cipher.
Question 2: In an ACL environment, what is the primary purpose of a Key Encryption Key (KEK)?
- Encrypting user data directly
- Encrypting other cryptographic keys for secure storage or transmission (Correct answer)
- Generating digital signatures
- Authenticating users to the network
Correct answer: Encrypting other cryptographic keys for secure storage or transmission
A KEK is used to encrypt other keys (such as data encryption keys), enabling secure key distribution without exposing the keys in plaintext.
Question 3: Which property ensures that an encrypted message cannot be linked to the plaintext even if an attacker sees multiple ciphertexts of the same message?
- Semantic security (IND-CPA) (Correct answer)
- Perfect forward secrecy
- Non-repudiation
- Key escrow
Correct answer: Semantic security (IND-CPA)
IND-CPA (indistinguishability under chosen-plaintext attack) ensures that encrypting the same plaintext twice yields ciphertexts that an attacker cannot distinguish.
Question 4: A network administrator wants to ensure that session keys are not compromised even if the server's long-term private key is later stolen. Which technique provides this?
- Certificate pinning
- Perfect forward secrecy (PFS) (Correct answer)
- Key stretching
- Data at rest encryption
Correct answer: Perfect forward secrecy (PFS)
Perfect forward secrecy uses ephemeral key exchanges (e.g., DHE or ECDHE) so that each session generates a unique key that is not derivable from the long-term private key.
Question 5: Which hashing algorithm is considered cryptographically broken and should NOT be used for integrity verification in modern ACLs or security policies?
- SHA-256
- SHA-3
- MD5 (Correct answer)
- BLAKE2
Correct answer: MD5
MD5 is considered cryptographically broken due to demonstrated collision attacks, making it unsuitable for security-critical integrity verification.
Question 6: When RSA is used for encryption, what makes it computationally infeasible to decrypt without the private key?
- The difficulty of factoring large prime products (Correct answer)
- The discrete logarithm problem
- The AES key schedule complexity
- The difficulty of solving hash reversals
Correct answer: The difficulty of factoring large prime products
RSA security relies on the integer factorization problem: it is easy to multiply two large primes but computationally hard to factor their product back into primes.
Question 7: Which certificate field specifies the cryptographic algorithms that a Certificate Authority used to sign a digital certificate?
- Subject Public Key Info
- Signature Algorithm (Correct answer)
- Subject Alternative Name
- Key Usage
Correct answer: Signature Algorithm
The Signature Algorithm field in an X.509 certificate identifies the algorithm (e.g., SHA-256 with RSA) that the CA used to produce the certificate's digital signature.
ACL Cryptography & Encryption 2
Which encryption mode of operation turns a block cipher into a stream cipher by XORing plaintext with an encrypted counter value?