SDL Cryptography & Data Protection 1 — Questions and Answers
Question 1: Which cryptographic algorithm is considered most suitable for encrypting data at rest according to SDL best practices?
- DES with a 56-bit key
- AES-256 in CBC or GCM mode (Correct answer)
- RC4 with a 128-bit key
- 3DES with two independent keys
Correct answer: AES-256 in CBC or GCM mode
AES-256 in CBC or GCM mode provides strong symmetric encryption approved by NIST and recommended by SDL guidelines for protecting data at rest.
Question 2: In SDL, what is the primary purpose of using a Hash-based Message Authentication Code (HMAC)?
- To encrypt data in transit
- To verify both integrity and authenticity of a message (Correct answer)
- To generate public/private key pairs
- To compress data before storage
Correct answer: To verify both integrity and authenticity of a message
HMAC uses a shared secret key combined with a hash function to ensure both the integrity and the authenticity of a message.
Question 3: Which key exchange protocol is commonly recommended in SDL to establish a shared secret over an insecure channel without transmitting the secret itself?
- RSA key transport
- Diffie-Hellman (or ECDH) key agreement (Correct answer)
- Pre-shared key distribution
- Kerberos ticket exchange
Correct answer: Diffie-Hellman (or ECDH) key agreement
Diffie-Hellman (and its elliptic curve variant ECDH) allows two parties to derive a shared secret without ever sending the secret over the channel.
Question 4: What is the recommended minimum RSA key length for new SDL-compliant applications as of current NIST guidance?
- 512 bits
- 1024 bits
- 2048 bits (Correct answer)
- 4096 bits is the only acceptable size
Correct answer: 2048 bits
NIST SP 800-131A recommends a minimum RSA key length of 2048 bits for new systems to provide adequate security through 2030.
Question 5: In an SDL context, what does 'salting' a password hash primarily protect against?
- Brute-force attacks on individual accounts
- Rainbow table and precomputation attacks (Correct answer)
- SQL injection attacks
- Man-in-the-middle interception of passwords
Correct answer: Rainbow table and precomputation attacks
A salt is a unique random value added to each password before hashing, which defeats precomputed rainbow table attacks by making each hash unique.
Question 6: Which TLS version should SDL-compliant systems deprecate support for to avoid known vulnerabilities?
- TLS 1.3
- TLS 1.2 with approved cipher suites
- TLS 1.0 and TLS 1.1 (Correct answer)
- TLS 1.2 with AEAD ciphers
Correct answer: TLS 1.0 and TLS 1.1
TLS 1.0 and TLS 1.1 are deprecated due to known vulnerabilities such as POODLE and BEAST; SDL requires disabling these versions.
Question 7: What is the main security advantage of Authenticated Encryption with Associated Data (AEAD) ciphers like AES-GCM over AES-CBC?
- AEAD ciphers are faster on all hardware platforms
- AEAD provides both confidentiality and integrity in a single operation (Correct answer)
- AEAD uses longer keys than CBC mode
- AEAD eliminates the need for initialization vectors
Correct answer: AEAD provides both confidentiality and integrity in a single operation
AEAD modes like AES-GCM simultaneously provide confidentiality and integrity/authenticity verification, removing the need for a separate MAC.
SDL Cryptography & Data Protection 1
Which cryptographic algorithm is considered most suitable for encrypting data at rest according to SDL best practices?