SE Cryptography and PKI 2 — Questions and Answers
Question 1: Which hashing algorithm is currently recommended by NIST for secure applications due to its collision resistance?
- MD5
- SHA-1
- SHA-256 (SHA-2 family) (Correct answer)
- CRC32
Correct answer: SHA-256 (SHA-2 family)
SHA-256 is part of the NIST-recommended SHA-2 family, offering strong collision resistance for security applications.
Question 2: What does Perfect Forward Secrecy (PFS) ensure in a TLS session?
- The server certificate is always valid
- Past session keys cannot be compromised even if the server's long-term private key is later exposed (Correct answer)
- All traffic is encrypted end-to-end
- Session tokens never expire
Correct answer: Past session keys cannot be compromised even if the server's long-term private key is later exposed
PFS uses ephemeral key exchange (e.g., ECDHE) so each session uses a unique key, protecting past sessions if the private key is compromised.
Question 3: Which protocol provides online certificate status checking as a faster alternative to CRLs?
- LDAP
- OCSP (Correct answer)
- SCEP
- EST
Correct answer: OCSP
OCSP (Online Certificate Status Protocol) allows clients to query a CA in real time for the revocation status of a specific certificate.
Question 4: A security engineer discovers that the same nonce was used twice with AES-GCM. What is the impact?
- No impact; nonce reuse is expected
- The cipher falls back to CBC mode
- Confidentiality and integrity are both broken for those sessions (Correct answer)
- Only performance degrades
Correct answer: Confidentiality and integrity are both broken for those sessions
Nonce reuse with AES-GCM allows an attacker to recover plaintext and forge authentication tags, breaking both confidentiality and integrity.
Question 5: What is key escrow in the context of cryptography?
- Deleting encryption keys after use
- Storing a copy of encryption keys with a trusted third party for authorized recovery (Correct answer)
- Using the same key across multiple users
- Generating keys from passwords
Correct answer: Storing a copy of encryption keys with a trusted third party for authorized recovery
Key escrow deposits copies of cryptographic keys with a trusted third party so authorized parties (e.g., law enforcement, IT) can recover encrypted data.
Question 6: Which elliptic curve algorithm is recommended by NIST for digital signatures and key agreement?
- DH (Diffie-Hellman)
- DSA
- ECDSA / ECDH (Correct answer)
- RC4
Correct answer: ECDSA / ECDH
ECDSA (digital signatures) and ECDH (key agreement) use elliptic curve cryptography for strong security with smaller key sizes than RSA.
SE Cryptography and PKI 2
Which hashing algorithm is currently recommended by NIST for secure applications due to its collision resistance?