SSCA Cryptography & PKI 2 — Questions and Answers
Question 1: Which encryption mode of operation turns a block cipher into a stream cipher by XOR-ing the plaintext with an encrypted keystream?
- Electronic Codebook (ECB)
- Cipher Block Chaining (CBC)
- Output Feedback (OFB) (Correct answer)
- Cipher Feedback (CFB)
Correct answer: Output Feedback (OFB)
OFB mode pre-generates a keystream from the cipher's output and XORs it with plaintext, effectively operating as a synchronous stream cipher.
Question 2: What is the Diffie-Hellman key exchange primarily used for?
- Encrypting messages using a public/private key pair
- Allowing two parties to establish a shared secret over an untrusted channel (Correct answer)
- Generating a hash-based message authentication code
- Signing documents to provide non-repudiation
Correct answer: Allowing two parties to establish a shared secret over an untrusted channel
Diffie-Hellman enables two parties who have no prior shared secret to jointly derive a common symmetric key over an insecure channel without transmitting the key itself.
Question 3: An administrator discovers that the same RSA key pair is used for both encryption and digital signing. What is the primary security concern?
- RSA keys cannot be used for encryption at all
- Dual use increases attack surface and may violate key usage constraints in certificates (Correct answer)
- The key length is automatically halved when used for two purposes
- Digital signing requires a symmetric key, not RSA
Correct answer: Dual use increases attack surface and may violate key usage constraints in certificates
Using the same key pair for both encryption and signing violates the principle of key separation; compromise of one use-case (e.g., decryption oracle) can expose the signing key.
Question 4: Which hashing algorithm is currently recommended by NIST for use in digital signatures and is part of the SHA-2 family?
- MD5
- SHA-1
- SHA-256 (Correct answer)
- RIPEMD-128
Correct answer: SHA-256
SHA-256 is part of the NIST-approved SHA-2 family with a 256-bit output, providing strong collision resistance and currently recommended for digital signatures.
Question 5: What is a Certificate Signing Request (CSR)?
- A revocation notice sent from the CA to relying parties
- A message sent to a CA containing the applicant's public key and identity information (Correct answer)
- An encrypted session key exchanged during TLS handshake
- A record stored in the CRL when a certificate is revoked
Correct answer: A message sent to a CA containing the applicant's public key and identity information
A CSR is a standardized message (typically PKCS#10 format) that an entity sends to a CA, containing its public key and identity details to request a signed certificate.
Question 6: In a PKI hierarchy, what is an Intermediate CA (also called a Subordinate CA)?
- A CA that issues end-entity certificates and is itself certified by a higher-level CA (Correct answer)
- The top-level CA that is the ultimate trust anchor in the hierarchy
- A backup CA that activates only if the root CA fails
- A CA dedicated exclusively to issuing CRLs
Correct answer: A CA that issues end-entity certificates and is itself certified by a higher-level CA
An Intermediate CA is signed by a Root CA (or another Intermediate CA) and issues certificates to end-entities, keeping the Root CA offline and protected.
Question 7: Which attack targets the weakest link in a cipher by trying every possible key value?
- Man-in-the-middle attack
- Birthday attack
- Brute-force attack (Correct answer)
- Padding oracle attack
Correct answer: Brute-force attack
A brute-force attack systematically tries every possible key combination until the correct one is found, making key length the primary defense.
SSCA Cryptography & PKI 2
Which encryption mode of operation turns a block cipher into a stream cipher by XOR-ing the plaintext with an encrypted keystream?