SDL Cryptography & Data Protection

Question 1

Which cryptographic algorithm is considered most suitable for encrypting data at rest according to SDL best practices?

Accepted Answer

AES-256 in CBC or GCM mode

Answer

AES-256 in CBC or GCM mode provides strong symmetric encryption approved by NIST and recommended by SDL guidelines for protecting data at rest.

Question 2

In SDL, what is the primary purpose of using a Hash-based Message Authentication Code (HMAC)?

Accepted Answer

To verify both integrity and authenticity of a message

Answer

HMAC uses a shared secret key combined with a hash function to ensure both the integrity and the authenticity of a message.

Question 3

Which key exchange protocol is commonly recommended in SDL to establish a shared secret over an insecure channel without transmitting the secret itself?

Accepted Answer

Diffie-Hellman (or ECDH) key agreement

Answer

Diffie-Hellman (and its elliptic curve variant ECDH) allows two parties to derive a shared secret without ever sending the secret over the channel.

Question 4

What is the recommended minimum RSA key length for new SDL-compliant applications as of current NIST guidance?

Accepted Answer

2048 bits

Answer

NIST SP 800-131A recommends a minimum RSA key length of 2048 bits for new systems to provide adequate security through 2030.

Question 5

In an SDL context, what does 'salting' a password hash primarily protect against?

Accepted Answer

Rainbow table and precomputation attacks

Answer

A salt is a unique random value added to each password before hashing, which defeats precomputed rainbow table attacks by making each hash unique.

(SDL) Security Development Lifecycle Certification Practice Test

(SDL) Security Development Lifecycle Certification Practice Test

SDL Cryptography & Data Protection