CISSP Cryptography 5 — Questions and Answers
Question 1: Which of the following hash algorithms is considered cryptographically broken and should NOT be used for security purposes?
- SHA-256
- SHA-3
- MD5 (Correct answer)
- SHA-512
Correct answer: MD5
MD5 is cryptographically broken; practical collision attacks have been demonstrated, making it unsuitable for digital signatures or certificate integrity.
Question 2: What is a rainbow table attack, and what control most effectively mitigates it?
- Brute-force of encrypted files; mitigated by longer keys
- Precomputed hash lookup attack; mitigated by salting passwords (Correct answer)
- Side-channel timing attack; mitigated by constant-time algorithms
- Replay attack on TLS; mitigated by session tokens
Correct answer: Precomputed hash lookup attack; mitigated by salting passwords
Rainbow tables are precomputed hash chains for cracking passwords; adding a unique random salt per password makes precomputed tables useless.
Question 3: In the context of CISSP, what does 'crypto agility' mean?
- The ability to encrypt data faster using hardware acceleration
- The ability to swap cryptographic algorithms without major system redesign (Correct answer)
- The use of multiple simultaneous encryption algorithms for redundancy
- Automatically rotating encryption keys on a schedule
Correct answer: The ability to swap cryptographic algorithms without major system redesign
Crypto agility is designing systems so that cryptographic algorithms can be replaced quickly when vulnerabilities are discovered, without architectural overhaul.
Question 4: Which concept describes encrypting data so it remains encrypted while being processed, enabling computation on ciphertext without decrypting it?
- Transparent data encryption (TDE)
- Homomorphic encryption (Correct answer)
- Format-preserving encryption (FPE)
- Tokenization
Correct answer: Homomorphic encryption
Homomorphic encryption allows computations to be performed directly on encrypted data, with results that match operations on the plaintext when decrypted.
Question 5: What is the primary threat that quantum computing poses to current public-key cryptography systems like RSA and ECC?
- Quantum computers generate true randomness, breaking deterministic ciphers
- Shor's algorithm can efficiently factor large integers and compute discrete logs (Correct answer)
- Quantum entanglement allows decryption without the private key
- Quantum computers render all symmetric encryption algorithms obsolete
Correct answer: Shor's algorithm can efficiently factor large integers and compute discrete logs
Shor's algorithm, runnable on a sufficiently powerful quantum computer, can factor integers and compute discrete logarithms exponentially faster, breaking RSA and ECC.
Question 6: Which type of cryptographic attack involves an adversary obtaining ciphertexts for plaintexts of their choice to deduce the key?
- Ciphertext-only attack
- Known-plaintext attack
- Chosen-plaintext attack (Correct answer)
- Related-key attack
Correct answer: Chosen-plaintext attack
In a chosen-plaintext attack (CPA), the attacker can select arbitrary plaintexts, have them encrypted, and analyze the resulting ciphertexts to extract key information.
Question 7: What is the purpose of HMAC compared to a simple hash of a message?
- HMAC uses asymmetric keys to provide non-repudiation
- HMAC incorporates a secret key to provide both integrity and authentication (Correct answer)
- HMAC is faster than SHA-256 for large messages
- HMAC compresses the output to a fixed 128-bit value regardless of hash used
Correct answer: HMAC incorporates a secret key to provide both integrity and authentication
HMAC (Hash-based MAC) combines a secret key with the message hash, ensuring that only parties sharing the key can generate or verify the MAC, adding authentication to integrity.
CISSP Cryptography 5
Which of the following hash algorithms is considered cryptographically broken and should NOT be used for security purposes?