SSCP Cryptography & PKI 2 — Questions and Answers
Question 1: Which cryptographic attack involves an adversary obtaining ciphertext-plaintext pairs of their choosing to deduce the key?
- Known-plaintext attack
- Chosen-plaintext attack (Correct answer)
- Ciphertext-only attack
- Side-channel attack
Correct answer: Chosen-plaintext attack
A chosen-plaintext attack lets the adversary select arbitrary plaintext and observe corresponding ciphertext, making it stronger than a known-plaintext attack.
Question 2: What is the primary purpose of a Certificate Revocation List (CRL)?
- To list trusted root CAs
- To publish certificates that are no longer valid before expiration (Correct answer)
- To store encrypted private keys
- To distribute public keys to endpoints
Correct answer: To publish certificates that are no longer valid before expiration
A CRL is a signed list published by a CA that identifies certificates revoked prior to their expiration date.
Question 3: In asymmetric cryptography, what operation does the sender perform to ensure non-repudiation when signing a message?
- Encrypts with the recipient's public key
- Encrypts with the sender's private key (Correct answer)
- Hashes with the recipient's public key
- Decrypts with the sender's public key
Correct answer: Encrypts with the sender's private key
Signing with the sender's private key creates a digital signature only that entity could produce, ensuring non-repudiation.
Question 4: Which mode of AES operation produces ciphertext blocks that depend on all preceding plaintext blocks?
- ECB (Electronic Codebook)
- CBC (Cipher Block Chaining) (Correct answer)
- CTR (Counter)
- OFB (Output Feedback)
Correct answer: CBC (Cipher Block Chaining)
CBC XORs each plaintext block with the previous ciphertext block before encryption, chaining all blocks together.
Question 5: What does the term 'key escrow' mean in cryptography?
- Generating keys from a master secret
- Storing a copy of encryption keys with a trusted third party (Correct answer)
- Exchanging session keys over an encrypted channel
- Revoking keys after their validity period
Correct answer: Storing a copy of encryption keys with a trusted third party
Key escrow involves depositing cryptographic keys with a trusted third party so they can be retrieved under authorized circumstances.
Question 6: Which PKI component is responsible for verifying the identity of certificate applicants before issuing certificates?
- Certificate Repository
- Certificate Authority (CA)
- Registration Authority (RA) (Correct answer)
- OCSP Responder
Correct answer: Registration Authority (RA)
The Registration Authority (RA) performs identity verification and vetting of applicants before forwarding approved requests to the CA for issuance.
Question 7: What type of encryption uses a single key for both encryption and decryption?
- Asymmetric encryption
- Public key encryption
- Symmetric encryption (Correct answer)
- Hybrid encryption
Correct answer: Symmetric encryption
Symmetric encryption uses the same shared secret key for both encrypting and decrypting data.
SSCP Cryptography & PKI 2
Which cryptographic attack involves an adversary obtaining ciphertext-plaintext pairs of their choosing to deduce the key?