CREST Cryptography & PKI 2

Question 1

Which key length is currently recommended for RSA keys to provide adequate security according to NIST guidelines?

Accepted Answer

2048 bits or higher

Answer

NIST recommends at least 2048-bit RSA keys for current use, with 3072 or 4096 bits for longer-term security.

Question 2

What is the purpose of OCSP (Online Certificate Status Protocol)?

Accepted Answer

To check the real-time revocation status of a certificate

Answer

OCSP allows clients to query a responder in real time to determine whether a specific certificate has been revoked.

Question 3

Which elliptic curve is widely used in TLS 1.3 for key exchange?

Accepted Answer

X25519

Answer

X25519 (Curve25519 ECDH) is the preferred key exchange curve in TLS 1.3 due to its performance and resistance to side-channel attacks.

Question 4

What does a digital signature primarily provide?

Accepted Answer

Non-repudiation and integrity verification

Answer

A digital signature binds a message to a signer's private key, providing integrity verification and non-repudiation.

Question 5

Which attack involves an adversary obtaining a valid certificate for a domain they do not control by exploiting weaknesses in the CA validation process?

Accepted Answer

Certificate misissuance attack

Answer

Certificate misissuance occurs when a CA incorrectly issues a certificate for a domain to an unauthorized party due to flawed domain validation.

(CREST) Council for Registered Ethical Security Testers Practice Test

(CREST) Council for Registered Ethical Security Testers Practice Test

CREST Cryptography & PKI 2