CREST Cryptography & PKI 2 — Questions and Answers
Question 1: Which key length is currently recommended for RSA keys to provide adequate security according to NIST guidelines?
- 2048 bits or higher (Correct answer)
- 512 bits
- 1024 bits
- 768 bits
Correct answer: 2048 bits or higher
NIST recommends at least 2048-bit RSA keys for current use, with 3072 or 4096 bits for longer-term security.
Question 2: What is the purpose of OCSP (Online Certificate Status Protocol)?
- To check the real-time revocation status of a certificate (Correct answer)
- To generate new SSL certificates
- To negotiate cipher suites
- To distribute root CA certificates
Correct answer: To check the real-time revocation status of a certificate
OCSP allows clients to query a responder in real time to determine whether a specific certificate has been revoked.
Question 3: Which elliptic curve is widely used in TLS 1.3 for key exchange?
- X25519 (Correct answer)
- secp192r1
- Brainpool P-160
- NIST P-521
Correct answer: X25519
X25519 (Curve25519 ECDH) is the preferred key exchange curve in TLS 1.3 due to its performance and resistance to side-channel attacks.
Question 4: What does a digital signature primarily provide?
- Non-repudiation and integrity verification (Correct answer)
- Confidentiality of data in transit
- Key agreement between two parties
- Password hashing for authentication
Correct answer: Non-repudiation and integrity verification
A digital signature binds a message to a signer's private key, providing integrity verification and non-repudiation.
Question 5: Which attack involves an adversary obtaining a valid certificate for a domain they do not control by exploiting weaknesses in the CA validation process?
- Certificate misissuance attack (Correct answer)
- Padding oracle attack
- Bleichenbacher attack
- BEAST attack
Correct answer: Certificate misissuance attack
Certificate misissuance occurs when a CA incorrectly issues a certificate for a domain to an unauthorized party due to flawed domain validation.
Question 6: What is the primary difference between symmetric and asymmetric encryption?
- Symmetric uses one shared key; asymmetric uses a key pair (Correct answer)
- Symmetric is always faster and more secure
- Asymmetric uses one shared key; symmetric uses a key pair
- Symmetric encryption cannot be used for bulk data
Correct answer: Symmetric uses one shared key; asymmetric uses a key pair
Symmetric encryption uses a single shared secret key for both encryption and decryption, while asymmetric uses mathematically related public/private key pairs.
CREST Cryptography & PKI 2
Which key length is currently recommended for RSA keys to provide adequate security according to NIST guidelines?