SSCA Cryptography & PKI 1 — Questions and Answers
Question 1: Which cryptographic algorithm uses the same key for both encryption and decryption?
- RSA
- Elliptic Curve Cryptography
- AES (Correct answer)
- Diffie-Hellman
Correct answer: AES
AES (Advanced Encryption Standard) is a symmetric algorithm, meaning it uses the same secret key for both encrypting and decrypting data.
Question 2: What is the primary role of a Certificate Authority (CA) in a PKI infrastructure?
- Encrypting data in transit between clients and servers
- Issuing and digitally signing digital certificates to validate identities (Correct answer)
- Storing private keys on behalf of users
- Performing key exchange using Diffie-Hellman
Correct answer: Issuing and digitally signing digital certificates to validate identities
A Certificate Authority issues and signs digital certificates, binding a public key to an entity's identity, which is the foundational trust anchor in PKI.
Question 3: Which property of a cryptographic hash function ensures that two different inputs cannot produce the same hash output?
- Pre-image resistance
- Key stretching
- Collision resistance (Correct answer)
- Avalanche effect
Correct answer: Collision resistance
Collision resistance means it is computationally infeasible to find two distinct inputs that produce the same hash digest, preventing forgery of signed data.
Question 4: In asymmetric cryptography, which key is used to verify a digital signature?
- The signer's private key
- The signer's public key (Correct answer)
- A shared symmetric key
- A session key derived from Diffie-Hellman
Correct answer: The signer's public key
A digital signature is created with the signer's private key and verified using the corresponding public key, confirming authenticity and non-repudiation.
Question 5: What does the X.509 standard define?
- A protocol for secure key exchange over untrusted networks
- The format and fields of digital certificates used in PKI (Correct answer)
- An encryption algorithm for protecting data at rest
- A method for generating pseudo-random numbers
Correct answer: The format and fields of digital certificates used in PKI
X.509 is the ITU-T standard that specifies the format of public key certificates, including fields such as subject, issuer, validity period, and public key.
Question 6: Which mechanism allows a relying party to check in real time whether a digital certificate has been revoked?
- Certificate Revocation List (CRL)
- Online Certificate Status Protocol (OCSP) (Correct answer)
- Certificate Signing Request (CSR)
- Key Escrow
Correct answer: Online Certificate Status Protocol (OCSP)
OCSP provides real-time certificate status by querying an OCSP responder, unlike CRLs which are periodically downloaded batch lists.
Question 7: What is the purpose of key stretching techniques such as PBKDF2 or bcrypt?
- To extend the length of an encryption key beyond its native size
- To slow down brute-force and dictionary attacks against passwords (Correct answer)
- To distribute encryption keys securely across a network
- To convert asymmetric keys into symmetric keys for performance
Correct answer: To slow down brute-force and dictionary attacks against passwords
Key stretching algorithms apply many iterations of hashing to a password, making brute-force and dictionary attacks computationally expensive.
SSCA Cryptography & PKI 1
Which cryptographic algorithm uses the same key for both encryption and decryption?