CBCP Cryptography and Security Questions and Answers — Questions and Answers
Question 1: In public-key cryptography as used in blockchain, what is the primary function of the private key?
- To encrypt the hash of a transaction, creating a digital signature. (Correct answer)
- To be shared publicly for verifying transactions.
- To decrypt messages that were encrypted with the public key.
- To generate a new public key for every transaction.
Correct answer: To encrypt the hash of a transaction, creating a digital signature.
The private key is used to create a digital signature by encrypting the hash of a transaction's data. This signature serves as proof that the transaction was authorized by the owner of the private key, ensuring authenticity and non-repudiation. Anyone with the corresponding public key can then verify this signature.
Question 2: A malicious actor gains control of a large number of nodes on a blockchain network by creating multiple fake identities. They then use this influence to isolate a genuine node from the rest of the network, feeding it false information. What type of attack is this?
- Routing Attack
- 51% Attack
- Sybil Attack (Correct answer)
- Phishing Attack
Correct answer: Sybil Attack
A Sybil attack involves a single entity creating and controlling numerous fake identities (nodes) within a peer-to-peer network to gain a disproportionately large influence. This control can then be used to carry out other attacks, such as an eclipse attack where a specific node is isolated from the true network.
Question 3: Which cryptographic technique allows for computations to be performed on encrypted data without decrypting it first, offering enhanced privacy for smart contracts and blockchain analytics?
- Zero-Knowledge Proofs
- Homomorphic Encryption (Correct answer)
- Elliptic Curve Cryptography (ECC)
- Multi-Party Computation (MPC)
Correct answer: Homomorphic Encryption
Homomorphic encryption is a specific form of encryption that allows computations to be performed directly on ciphertext. The result of the computation, when decrypted, is the same as if the operations had been performed on the plaintext, making it ideal for privacy-preserving computations on a transparent ledger.
Question 4: A user wants to prove they have a sufficient account balance to enter a decentralized lottery without revealing their actual balance or transaction history. Which cryptographic method is best suited for this scenario?
- Multi-signature Scheme
- Symmetric Key Encryption
- Digital Signature Algorithm (DSA)
- Zero-Knowledge Proof (ZKP) (Correct answer)
Correct answer: Zero-Knowledge Proof (ZKP)
A Zero-Knowledge Proof (ZKP) is a cryptographic protocol that allows a 'prover' to prove to a 'verifier' that a statement is true, without revealing any information beyond the validity of the statement itself. This is perfect for privacy-focused applications where specific facts need to be verified without disclosing the underlying sensitive data.
Question 5: Compared to the RSA algorithm, what is the primary advantage of using Elliptic Curve Cryptography (ECC) for generating key pairs in blockchain systems like Bitcoin and Ethereum?
- It is resistant to attacks from quantum computers.
- It provides the same level of security with significantly smaller key sizes. (Correct answer)
- The decryption process is mathematically simpler and faster.
- It uses a single key for both encryption and decryption.
Correct answer: It provides the same level of security with significantly smaller key sizes.
The main advantage of ECC over RSA is its efficiency. ECC can provide the same level of cryptographic security as RSA but with much smaller key sizes. For example, a 256-bit ECC key offers comparable security to a 3072-bit RSA key, which leads to lower computational overhead and faster processing, crucial for blockchain performance.
Question 6: A developer is building a decentralized application and needs to store user private keys. Which of the following represents the MOST secure storage practice?
- Storing the encrypted private key in the browser's local storage.
- Sending the private key to a secure, centralized company server for management.
- Storing keys offline in a hardware wallet and requiring user interaction for signing. (Correct answer)
- Writing the private key directly into the application's source code.
Correct answer: Storing keys offline in a hardware wallet and requiring user interaction for signing.
The most secure practice is to keep private keys in 'cold storage,' completely offline and disconnected from the internet. A hardware wallet is a physical device that stores keys offline and requires physical interaction to sign transactions, which significantly reduces the risk of online threats like hacking and malware.
CBCP Cryptography and Security Questions and Answers
In public-key cryptography as used in blockchain, what is the primary function of the private key?