SSCP Cryptography & PKI 5 — Questions and Answers
Question 1: What attack exploits the mathematical relationship between RSA public and private keys when the same message is encrypted with multiple public keys sharing a common modulus?
- Timing attack
- Common modulus attack (Correct answer)
- Padding oracle attack
- Birthday attack
Correct answer: Common modulus attack
The common modulus attack allows recovery of plaintext when the same message is encrypted under RSA keys that share a modulus but have coprime exponents.
Question 2: Which standard defines the format for X.509 digital certificates used in PKI?
- RFC 2104
- RFC 5280 (Correct answer)
- FIPS 140-2
- NIST SP 800-57
Correct answer: RFC 5280
RFC 5280 defines the Internet X.509 Public Key Infrastructure Certificate and CRL Profile used for TLS and other PKI applications.
Question 3: An organization needs to encrypt data at rest on a hardware security module (HSM). What is the main advantage of using an HSM?
- HSMs support only symmetric algorithms
- Keys are generated and stored in tamper-resistant hardware, never exposed in software (Correct answer)
- HSMs eliminate the need for certificate authorities
- HSMs automatically rotate keys every 24 hours
Correct answer: Keys are generated and stored in tamper-resistant hardware, never exposed in software
HSMs store and operate on cryptographic keys within tamper-resistant hardware, so private keys never exist in unprotected software memory.
Question 4: Which of the following describes a man-in-the-middle (MitM) attack in the context of key exchange?
- An attacker brute-forces the session key after the exchange
- An attacker intercepts and substitutes public keys during the exchange (Correct answer)
- An attacker replays an old session key to hijack a new session
- An attacker decrypts traffic using a stolen certificate
Correct answer: An attacker intercepts and substitutes public keys during the exchange
In a MitM key exchange attack, the adversary substitutes their own public key for each party's, allowing them to decrypt and re-encrypt all traffic.
Question 5: What is the difference between transport mode and tunnel mode in IPsec?
- Transport mode encrypts the payload only; tunnel mode encrypts the entire IP packet including headers (Correct answer)
- Transport mode is for IPv6; tunnel mode is for IPv4
- Transport mode uses ESP; tunnel mode uses AH only
- Transport mode requires certificates; tunnel mode uses pre-shared keys
Correct answer: Transport mode encrypts the payload only; tunnel mode encrypts the entire IP packet including headers
IPsec transport mode protects only the payload while tunnel mode encapsulates and encrypts the original IP packet inside a new IP packet.
Question 6: Which SSCP domain concept refers to the practice of using multiple cryptographic algorithms so that compromise of one does not expose all protected data?
- Key wrapping
- Cryptographic agility (Correct answer)
- Key stretching
- Hybrid encryption
Correct answer: Cryptographic agility
Cryptographic agility is the ability to switch or layer algorithms so systems can adapt when one algorithm is broken without a full redesign.
Question 7: A user's certificate is valid but their private key has been compromised. What immediate action should the PKI administrator take?
- Wait for the certificate to expire naturally
- Reissue the certificate with the same key pair
- Revoke the certificate and add it to the CRL or OCSP database (Correct answer)
- Increase the key length of the existing certificate
Correct answer: Revoke the certificate and add it to the CRL or OCSP database
When a private key is compromised, the corresponding certificate must be immediately revoked so relying parties are notified it can no longer be trusted.
SSCP Cryptography & PKI 5
What attack exploits the mathematical relationship between RSA public and private keys when the same message is encrypted with multiple public keys sharing a common modulus?