SSCP Certification SSCP Cryptography Fundamentals 5 — Questions and Answers
Question 1: What is a side-channel attack in the context of cryptography?
- Attacking the mathematical weakness in the algorithm itself
- Exploiting information leaked through physical implementation, such as timing or power consumption (Correct answer)
- Intercepting keys during network transmission
- Reverse-engineering compiled cryptographic software
Correct answer: Exploiting information leaked through physical implementation, such as timing or power consumption
Side-channel attacks exploit physical information leaked during cryptographic operations — such as execution time, power consumption, or electromagnetic emissions — rather than mathematical weaknesses.
Question 2: In PKI, what is Online Certificate Status Protocol (OCSP) used for?
- Generating new certificate signing requests
- Providing real-time certificate revocation status checks (Correct answer)
- Encrypting certificate private keys during transport
- Distributing root CA certificates to clients
Correct answer: Providing real-time certificate revocation status checks
OCSP allows clients to query a CA's OCSP responder in real time to check whether a specific certificate has been revoked, as an alternative to downloading the full CRL.
Question 3: Which symmetric key algorithm uses a 56-bit key and is now considered insecure due to its short key length?
- AES-128
- 3DES
- DES (Correct answer)
- Blowfish
Correct answer: DES
DES (Data Encryption Standard) uses a 56-bit key which is vulnerable to brute-force attacks with modern hardware, and has been broken experimentally in under 24 hours.
Question 4: What is the function of a key derivation function (KDF) such as HKDF?
- Generating random initialization vectors for block ciphers
- Deriving one or more cryptographic keys from a master secret or password (Correct answer)
- Compressing keys to reduce storage requirements
- Converting public keys to private keys
Correct answer: Deriving one or more cryptographic keys from a master secret or password
A KDF like HKDF derives cryptographically strong keys from input keying material such as a shared secret or password, enabling multiple distinct keys to be produced from a single source.
Question 5: Which of the following describes a chosen-ciphertext attack (CCA)?
- An attacker who can observe only encrypted traffic and attempts decryption
- An attacker who submits ciphertexts and observes corresponding plaintexts to learn the key (Correct answer)
- An attacker who intercepts the key exchange process
- An attacker who modifies ciphertext blocks to alter plaintext
Correct answer: An attacker who submits ciphertexts and observes corresponding plaintexts to learn the key
In a chosen-ciphertext attack, the adversary can choose arbitrary ciphertexts and obtain their decryptions from the target system, using these oracle responses to deduce the decryption key or recover plaintexts.
Question 6: What is the significance of Authenticated Encryption with Associated Data (AEAD) modes like AES-GCM?
- They provide encryption only, leaving authentication to a separate process
- They combine confidentiality and integrity/authentication in a single cryptographic operation (Correct answer)
- They are exclusively used for key exchange protocols
- They replace public key infrastructure entirely
Correct answer: They combine confidentiality and integrity/authentication in a single cryptographic operation
AEAD modes like AES-GCM simultaneously provide data confidentiality, integrity, and authenticity in one pass, eliminating the complexity and vulnerabilities of combining separate encryption and MAC operations.
Question 7: In the context of the SSCP exam, what does 'non-repudiation' mean as provided by digital signatures?
- Ensuring that encrypted data cannot be read by unauthorized parties
- Preventing a sender from denying they sent a message by binding their identity to it cryptographically (Correct answer)
- Guaranteeing that a message arrives at its destination unchanged
- Ensuring two parties derive the same session key independently
Correct answer: Preventing a sender from denying they sent a message by binding their identity to it cryptographically
Non-repudiation through digital signatures means the signer cannot later deny having signed a message, because only the holder of the private key could have produced the signature.
SSCP Certification SSCP Cryptography Fundamentals 5
What is a side-channel attack in the context of cryptography?