SSCP Certification SSCP Cryptography Fundamentals 3 — Questions and Answers
Question 1: Which encryption mode of operation turns a block cipher into a stream cipher by XORing plaintext with an encrypted counter value?
- ECB (Electronic Codebook)
- CBC (Cipher Block Chaining)
- CTR (Counter) (Correct answer)
- OFB (Output Feedback)
Correct answer: CTR (Counter)
CTR mode generates a keystream by encrypting sequential counter values and XORing it with plaintext, effectively converting a block cipher into a stream cipher.
Question 2: What vulnerability does the Electronic Codebook (ECB) mode of operation have?
- It requires an initialization vector, which can be guessed
- Identical plaintext blocks produce identical ciphertext blocks, leaking patterns (Correct answer)
- It is vulnerable to padding oracle attacks exclusively
- It cannot encrypt data larger than one block
Correct answer: Identical plaintext blocks produce identical ciphertext blocks, leaking patterns
ECB mode encrypts each block independently, so identical plaintext blocks always produce identical ciphertext blocks, revealing data patterns — famously illustrated by the 'ECB penguin' example.
Question 3: In the context of PKI, what is the role of a Certificate Revocation List (CRL)?
- It lists all certificates issued by a CA
- It contains certificates that have been revoked before their expiration date (Correct answer)
- It stores private keys for certificate holders
- It maps domain names to public keys
Correct answer: It contains certificates that have been revoked before their expiration date
A CRL is a list published by a Certificate Authority containing serial numbers of certificates that have been revoked before their expiration date, allowing relying parties to check certificate validity.
Question 4: Which key exchange algorithm enables two parties to establish a shared secret over an insecure channel without prior shared secrets?
- RSA key transport
- Diffie-Hellman key exchange (Correct answer)
- AES key wrapping
- HMAC key derivation
Correct answer: Diffie-Hellman key exchange
Diffie-Hellman key exchange allows two parties to independently compute the same shared secret over an insecure channel without transmitting the secret itself.
Question 5: What is the primary security concern with using MD5 for cryptographic hashing?
- It is too slow for practical use
- It produces hash collisions that can be crafted by attackers (Correct answer)
- It requires a secret key to function
- It only supports inputs up to 512 bits
Correct answer: It produces hash collisions that can be crafted by attackers
MD5 is cryptographically broken because practical collision attacks exist, allowing attackers to create two different inputs with the same hash, undermining integrity guarantees.
Question 6: Which concept describes wrapping one encrypted tunnel inside another for additional security layers?
- Key escrow
- Cryptographic agility
- Nested encryption (double encryption) (Correct answer)
- Key stretching
Correct answer: Nested encryption (double encryption)
Nested or double encryption involves encrypting data with one algorithm or key and then encrypting the result again, as seen in Triple DES (3DES) which applies DES three times.
Question 7: When generating RSA key pairs, what mathematical property ensures the difficulty of breaking the encryption?
- The difficulty of solving elliptic curve discrete logarithm problems
- The difficulty of factoring the product of two large prime numbers (Correct answer)
- The difficulty of computing SHA-256 in reverse
- The difficulty of solving linear equations with many variables
Correct answer: The difficulty of factoring the product of two large prime numbers
RSA security relies on the computational infeasibility of factoring the product of two large prime numbers (n = p × q), which is the trapdoor function underlying RSA.
SSCP Certification SSCP Cryptography Fundamentals 3
Which encryption mode of operation turns a block cipher into a stream cipher by XORing plaintext with an encrypted counter value?