CCP CCP Cryptography & PKI 1 — Questions and Answers
Question 1: Which cryptographic property ensures that a sender cannot later deny having sent a message?
- Confidentiality
- Integrity
- Availability
- Non-repudiation (Correct answer)
Correct answer: Non-repudiation
Non-repudiation, typically achieved through digital signatures, provides cryptographic proof of origin that prevents a sender from denying their actions.
Question 2: What is the primary difference between symmetric and asymmetric encryption?
- Symmetric uses one key for encryption and decryption; asymmetric uses a public/private key pair (Correct answer)
- Symmetric is slower; asymmetric is faster
- Symmetric uses longer keys; asymmetric uses shorter keys
- Symmetric encrypts data in transit; asymmetric encrypts data at rest
Correct answer: Symmetric uses one key for encryption and decryption; asymmetric uses a public/private key pair
Symmetric encryption uses a single shared secret key for both encryption and decryption, while asymmetric encryption uses a mathematically linked key pair — one public, one private.
Question 3: Which hashing algorithm is currently recommended by NIST for generating message digests due to its resistance to collision attacks?
- MD5
- SHA-1
- SHA-256 (Correct answer)
- CRC32
Correct answer: SHA-256
SHA-256 (part of the SHA-2 family) is NIST-recommended for cryptographic hashing, as MD5 and SHA-1 have known collision vulnerabilities.
Question 4: In a Public Key Infrastructure (PKI), what is the role of a Certificate Authority (CA)?
- To generate private keys on behalf of end users
- To issue, sign, and revoke digital certificates that bind public keys to identities (Correct answer)
- To encrypt data exchanged between clients and servers
- To store private keys in a hardware security module
Correct answer: To issue, sign, and revoke digital certificates that bind public keys to identities
A CA is a trusted third party that issues digitally signed certificates, binding a subject's identity to their public key and enabling other parties to trust that binding.
Question 5: What mechanism allows a relying party to check whether a digital certificate has been revoked before it reaches its expiration date?
- Certificate Signing Request (CSR)
- Online Certificate Status Protocol (OCSP) (Correct answer)
- Key encapsulation mechanism
- Certificate Transparency log
Correct answer: Online Certificate Status Protocol (OCSP)
OCSP provides real-time certificate revocation status by querying an OCSP responder, offering a more efficient alternative to downloading full Certificate Revocation Lists (CRLs).
Question 6: Which cipher mode of operation provides both confidentiality and data integrity within a single operation, making it suitable for TLS 1.3?
- Electronic Codebook (ECB)
- Cipher Block Chaining (CBC)
- Galois/Counter Mode (GCM) (Correct answer)
- Output Feedback (OFB)
Correct answer: Galois/Counter Mode (GCM)
GCM is an authenticated encryption mode that simultaneously provides confidentiality and message authentication, and is the preferred cipher mode in TLS 1.3.
CCP CCP Cryptography & PKI 1
Which cryptographic property ensures that a sender cannot later deny having sent a message?