CAP Cryptography & Encryption 3 — Questions and Answers
Question 1: What is the primary purpose of a Hash-based Message Authentication Code (HMAC)?
- To encrypt data for confidentiality
- To provide both data integrity and authentication using a shared secret (Correct answer)
- To generate asymmetric key pairs
- To replace digital certificates in PKI
Correct answer: To provide both data integrity and authentication using a shared secret
HMAC combines a cryptographic hash function with a secret key to verify both the integrity and authenticity of a message.
Question 2: Under NIST SP 800-57, what is the recommended minimum RSA key size for protecting data through 2030?
- 512 bits
- 1024 bits
- 2048 bits (Correct answer)
- 4096 bits
Correct answer: 2048 bits
NIST SP 800-57 recommends a minimum of 2048-bit RSA keys to provide adequate security through 2030.
Question 3: Which attack exploits weaknesses in the CBC mode of operation by manipulating ciphertext blocks to alter decrypted plaintext?
- Birthday attack
- Padding oracle attack (Correct answer)
- Rainbow table attack
- Meet-in-the-middle attack
Correct answer: Padding oracle attack
A padding oracle attack exploits CBC mode by sending modified ciphertexts and observing padding validation errors to decrypt data without the key.
Question 4: What does 'perfect forward secrecy' (PFS) ensure in a cryptographic protocol?
- Past session keys remain secure even if the long-term private key is later compromised (Correct answer)
- Future sessions are protected by rotating certificates automatically
- All traffic is encrypted end-to-end without metadata leakage
- The server's identity is verified before any data is exchanged
Correct answer: Past session keys remain secure even if the long-term private key is later compromised
PFS ensures that compromise of a long-term private key does not expose previously recorded encrypted sessions, because ephemeral keys were used.
Question 5: Which algorithm is commonly used for key derivation from passwords to slow down brute-force attacks?
- MD5
- SHA-256
- PBKDF2 (Correct answer)
- RC4
Correct answer: PBKDF2
PBKDF2 (Password-Based Key Derivation Function 2) applies a pseudorandom function many times to stretch a password, making brute-force attacks computationally expensive.
Question 6: In asymmetric encryption, which operation is typically performed with the recipient's public key?
- Decrypting the ciphertext
- Signing the plaintext
- Encrypting the plaintext (Correct answer)
- Generating the key pair
Correct answer: Encrypting the plaintext
The sender encrypts a message using the recipient's public key so that only the recipient, who holds the corresponding private key, can decrypt it.
Question 7: What is the primary vulnerability addressed by using authenticated encryption (e.g., AES-GCM) instead of AES-CBC?
- Key length limitations
- Lack of ciphertext authentication, enabling tampering attacks (Correct answer)
- Inability to encrypt large files
- Slow key generation speed
Correct answer: Lack of ciphertext authentication, enabling tampering attacks
Authenticated encryption modes like AES-GCM combine confidentiality with an authentication tag that detects any tampering with the ciphertext.
CAP Cryptography & Encryption 3
What is the primary purpose of a Hash-based Message Authentication Code (HMAC)?