CREST Cryptography & PKI 1 — Questions and Answers
Question 1: Which cryptographic algorithm is considered asymmetric and commonly used for key exchange in TLS?
- RSA (Correct answer)
- AES
- SHA-256
- 3DES
Correct answer: RSA
RSA is an asymmetric algorithm widely used for key exchange and digital signatures in TLS handshakes.
Question 2: What is the primary purpose of a Certificate Authority (CA) in PKI?
- To issue and sign digital certificates (Correct answer)
- To encrypt network traffic
- To store private keys for users
- To hash passwords
Correct answer: To issue and sign digital certificates
A Certificate Authority issues and digitally signs certificates, binding public keys to identities and establishing trust.
Question 3: Which of the following describes a collision attack against a hash function?
- Finding two different inputs that produce the same hash output (Correct answer)
- Reversing a hash back to its original input
- Brute-forcing a hash to find the plaintext
- Injecting data into a hashed message
Correct answer: Finding two different inputs that produce the same hash output
A collision attack finds two distinct inputs that yield the same hash digest, undermining data integrity guarantees.
Question 4: What does perfect forward secrecy (PFS) ensure in TLS?
- Past session keys remain secure even if the long-term private key is compromised (Correct answer)
- All traffic is encrypted with a single master key
- Session keys are never rotated
- Certificates are always pinned
Correct answer: Past session keys remain secure even if the long-term private key is compromised
PFS uses ephemeral key exchange so that compromise of the server's long-term key cannot decrypt previously recorded sessions.
Question 5: Which mode of AES operation produces ciphertext blocks that are independent of each other, making it susceptible to block-swapping attacks?
- ECB (Electronic Codebook) (Correct answer)
- CBC (Cipher Block Chaining)
- GCM (Galois/Counter Mode)
- CTR (Counter Mode)
Correct answer: ECB (Electronic Codebook)
ECB encrypts each block independently, so identical plaintext blocks produce identical ciphertext blocks, enabling block-swapping and pattern analysis.
Question 6: What is a Certificate Revocation List (CRL) used for?
- Listing certificates that have been invalidated before their expiry (Correct answer)
- Listing all valid certificates in a PKI
- Encrypting certificate data at rest
- Binding domain names to IP addresses
Correct answer: Listing certificates that have been invalidated before their expiry
A CRL is published by a CA to notify relying parties of certificates that have been revoked prior to their natural expiration.
CREST Cryptography & PKI 1
Which cryptographic algorithm is considered asymmetric and commonly used for key exchange in TLS?