Cryptography and PKI Flashcards

A developer is choosing between hashing algorithms for password storage. Which option is MOST appropriate?

Answer: bcrypt with an appropriate work factor

bcrypt is a password-hashing function designed to be computationally expensive and includes built-in salting, making brute-force attacks impractical.

Which attack targets the mathematical relationship between a public and private RSA key pair when small prime factors are used?

Answer: Factoring attack (e.g., using Pollard's rho or GNFS)

RSA security relies on the difficulty of factoring the modulus n = p×q; weak primes allow efficient factoring algorithms to recover the private key.

An organization must encrypt data at rest in a cloud environment while retaining sole control of the encryption keys. Which model achieves this?

Answer: Customer-managed keys (CMK) stored in a customer-controlled HSM (HYOK — Hold Your Own Key)

HYOK/CMK with a customer-controlled HSM ensures the cloud provider never has access to the plaintext keys, giving the customer sole cryptographic control.

Which property of a cryptographic hash function ensures that two different inputs cannot produce the same hash output?

Answer: Collision resistance

Collision resistance means it is computationally infeasible to find any two distinct inputs x and y such that H(x) = H(y).

A TLS 1.3 handshake eliminates which legacy feature compared to TLS 1.2?

Answer: RSA key exchange (non-forward-secret)

TLS 1.3 removes RSA key exchange entirely, mandating ephemeral key exchange (ECDHE/DHE) to ensure perfect forward secrecy for all sessions.

Which technique allows computation on encrypted data without decrypting it?

Answer: Homomorphic encryption

Homomorphic encryption allows mathematical operations to be performed on ciphertext, producing an encrypted result that decrypts to the same value as operating on the plaintext.