CCP CCP Cryptography & PKI 2 — Questions and Answers
Question 1: What is a digital signature and how does it work?
- A scanned image of a handwritten signature embedded in a document
- A hash of the message encrypted with the sender's private key, verifiable with the sender's public key (Correct answer)
- A symmetric key used to authenticate the document origin
- An SSL certificate attached to an email message
Correct answer: A hash of the message encrypted with the sender's private key, verifiable with the sender's public key
A digital signature is created by hashing the message and encrypting the hash with the sender's private key; recipients decrypt it with the sender's public key and compare hashes to verify authenticity and integrity.
Question 2: Which key exchange protocol allows two parties to establish a shared secret over an insecure channel without transmitting the secret itself?
- RSA key transport
- Diffie-Hellman (DH) key exchange (Correct answer)
- AES key wrapping
- Elliptic Curve Integrated Encryption Scheme (ECIES)
Correct answer: Diffie-Hellman (DH) key exchange
Diffie-Hellman key exchange enables two parties to independently compute the same shared secret using public values, without the secret ever being transmitted.
Question 3: What is the purpose of a Hardware Security Module (HSM) in a PKI deployment?
- To accelerate network packet inspection
- To securely generate, store, and manage cryptographic keys in tamper-resistant hardware (Correct answer)
- To distribute certificates to end-user devices
- To monitor certificate expiration dates
Correct answer: To securely generate, store, and manage cryptographic keys in tamper-resistant hardware
An HSM is a dedicated hardware device that provides tamper-resistant storage and cryptographic operations for private keys, protecting them from software-based attacks.
Question 4: Which attack involves an adversary intercepting encrypted traffic today with the intention of decrypting it in the future once quantum computers become capable?
- Downgrade attack
- Harvest-now, decrypt-later (HNDL) (Correct answer)
- Birthday attack
- Padding oracle attack
Correct answer: Harvest-now, decrypt-later (HNDL)
HNDL attacks involve storing encrypted data captured today and decrypting it once sufficiently powerful quantum computers are available, motivating the transition to post-quantum cryptography.
Question 5: What is a Certificate Transparency (CT) log, and how does it improve PKI security?
- A private database storing expired certificates for compliance purposes
- A publicly auditable append-only log of all issued certificates, enabling detection of misissued or rogue certificates (Correct answer)
- A key escrow system operated by government agencies
- A revocation service that invalidates certificates in real time
Correct answer: A publicly auditable append-only log of all issued certificates, enabling detection of misissued or rogue certificates
CT logs are publicly accessible, append-only records of issued certificates that allow domain owners and security researchers to detect unauthorized or misissued certificates.
Question 6: Which NIST standard describes a suite of post-quantum cryptographic algorithms intended to replace RSA and ECC against quantum-capable adversaries?
- NIST SP 800-57
- FIPS 140-3
- NIST IR 8413 / FIPS 203/204/205 (Correct answer)
- NIST SP 800-131A
Correct answer: NIST IR 8413 / FIPS 203/204/205
NIST finalized its first post-quantum cryptography standards in 2024 as FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA), documented in NIST IR 8413.
CCP CCP Cryptography & PKI 2
What is a digital signature and how does it work?