CISSP Cryptography 3 — Questions and Answers
Question 1: Which cryptographic algorithm is specifically designed for key wrapping and protecting other cryptographic keys?
- AES-KW (AES Key Wrap) (Correct answer)
- SHA-256
- RSA-OAEP
- HMAC-SHA1
Correct answer: AES-KW (AES Key Wrap)
AES Key Wrap (AES-KW) is specifically designed to protect cryptographic keys by encrypting them with a key-encrypting key (KEK).
Question 2: What is the main advantage of Elliptic Curve Cryptography (ECC) over RSA for the same security level?
- ECC is older and more battle-tested
- ECC requires smaller key sizes for equivalent security (Correct answer)
- ECC supports symmetric encryption natively
- ECC eliminates the need for key exchange
Correct answer: ECC requires smaller key sizes for equivalent security
ECC provides equivalent security to RSA with much smaller key sizes; a 256-bit ECC key offers roughly the same security as a 3072-bit RSA key.
Question 3: A message authentication code (MAC) differs from a digital signature primarily because a MAC:
- Uses asymmetric keys and provides non-repudiation
- Uses a shared secret key and does not provide non-repudiation (Correct answer)
- Uses a public key and is slower to compute
- Provides confidentiality but not integrity
Correct answer: Uses a shared secret key and does not provide non-repudiation
MACs use a shared symmetric key, so any party with the key could have generated it, meaning MACs cannot provide non-repudiation.
Question 4: Which padding scheme is recommended for RSA encryption to prevent attacks such as Bleichenbacher's attack?
- PKCS#1 v1.5
- OAEP (Optimal Asymmetric Encryption Padding) (Correct answer)
- Zero padding
- ANSI X9.23
Correct answer: OAEP (Optimal Asymmetric Encryption Padding)
OAEP is the modern recommended padding for RSA encryption and is resistant to Bleichenbacher's chosen-ciphertext attack that affects PKCS#1 v1.5.
Question 5: What does perfect forward secrecy (PFS) ensure in a TLS session?
- All sessions use the same session key for efficiency
- Compromise of the long-term private key does not expose past session keys (Correct answer)
- The server's certificate never expires
- Session keys are stored for future audit purposes
Correct answer: Compromise of the long-term private key does not expose past session keys
PFS ensures that each session uses an ephemeral key pair, so compromising the server's private key cannot decrypt previously captured sessions.
Question 6: In steganography, what distinguishes it from encryption?
- Steganography makes data unreadable; encryption hides its existence
- Steganography hides the existence of data; encryption makes it unreadable (Correct answer)
- They are identical techniques with different names
- Steganography is only used for images; encryption works on any data
Correct answer: Steganography hides the existence of data; encryption makes it unreadable
Steganography conceals the fact that a message exists at all (security through obscurity), while encryption scrambles content but doesn't hide the message's existence.
Question 7: Which key management practice involves splitting a cryptographic key into multiple parts so that no single person holds the complete key?
- Key escrow
- Key splitting / M-of-N control (Correct answer)
- Key derivation
- Key rotation
Correct answer: Key splitting / M-of-N control
M-of-N key splitting (split knowledge) divides a key among N custodians, requiring M parts to reconstruct it, preventing single-person access.
CISSP Cryptography 3
Which cryptographic algorithm is specifically designed for key wrapping and protecting other cryptographic keys?