Chapter 32 Quiz: Cryptography Applied¶
Test your knowledge of symmetric and asymmetric cryptography, PKI, TLS 1.3, key management, HSMs, post-quantum algorithms, and historical crypto failures.
Questions¶
1. A development team is choosing between AES-256-CBC and AES-256-GCM for encrypting sensitive records at rest. Which is the better choice, and why?
- A) AES-256-CBC, because CBC is the standard for data at rest
- B) AES-256-GCM, because GCM provides both confidentiality and authenticated encryption (AEAD), detecting tampering
- C) Both are equivalent — the mode does not matter for data at rest
- D) AES-256-CBC, because GCM is only suitable for network protocols
Answer
B — AES-256-GCM, because GCM provides both confidentiality and authenticated encryption (AEAD), detecting tampering
AES-GCM is an Authenticated Encryption with Associated Data (AEAD) mode — it simultaneously encrypts and produces an authentication tag, protecting against both eavesdropping and tampering/bit-flipping. AES-CBC provides only confidentiality; without a separate MAC, it is vulnerable to padding oracle attacks (POODLE) and undetected modification. GCM is the modern standard for both data at rest and in transit.
2. During a TLS 1.3 handshake, a client and server establish session keys. What is the key mechanism that enables TLS 1.3's forward secrecy?
- A) RSA key exchange — the server's public key encrypts the session key
- B) Ephemeral Diffie-Hellman key exchange (DHE or ECDHE) — session keys are generated fresh for each connection and never transmitted
- C) Session resumption tickets are encrypted with the server's certificate private key
- D) The client generates the session key and transmits it encrypted to the server
Answer
B — Ephemeral Diffie-Hellman key exchange (DHE or ECDHE) — session keys are generated fresh for each connection and never transmitted
TLS 1.3 mandates ephemeral Diffie-Hellman (DHE/ECDHE) for all key exchanges, eliminating RSA key transport entirely. ECDHE generates a fresh key pair per session — the session key is derived from both parties' ephemeral keys but never transmitted. Forward secrecy means that compromising the server's long-term private key does not decrypt past sessions (since past session keys were ephemeral and discarded).
3. A certificate chain shows: Root CA → Intermediate CA → Leaf Certificate. The intermediate CA certificate expires without renewal. What is the impact?
- A) Only certificates signed by that intermediate become invalid; the Root CA and other intermediates are unaffected
- B) The entire PKI hierarchy collapses and all certificates must be re-issued from scratch
- C) The expired intermediate only affects newly issued certificates; existing leaf certificates remain valid
- D) The Root CA automatically renews the intermediate CA without administrator action
Answer
A — Only certificates signed by that intermediate become invalid; the Root CA and other intermediates are unaffected
A three-tier PKI hierarchy (Root CA → Intermediate CA → Leaf) provides compartmentalization. When an intermediate CA certificate expires, only the leaf certificates it signed (and those signed by subordinate CAs under it) fail chain validation. The Root CA and certificates signed by other intermediates are unaffected. This is why intermediate CAs are used — to protect the offline Root CA and contain scope of failure.
4. An organization is migrating from CRL to OCSP for certificate revocation checking. What operational advantage does OCSP provide over CRL?
- A) OCSP certificates are cryptographically stronger than CRL signatures
- B) OCSP provides real-time, per-certificate revocation status without downloading a large revocation list
- C) OCSP eliminates the need for certificate authorities entirely
- D) OCSP is backward-compatible with all pre-2000 TLS clients; CRL is not
Answer
B — OCSP provides real-time, per-certificate revocation status without downloading a large revocation list
CRL (Certificate Revocation List): a periodically published file listing all revoked certificates — grows large over time and may be hours to days stale. OCSP (Online Certificate Status Protocol): a real-time query to an OCSP responder that returns the status of a specific certificate. OCSP Stapling further improves performance by having the server attach a pre-fetched, signed OCSP response to the TLS handshake.
5. Which historical TLS vulnerability exploited the use of CBC mode in TLS 1.0 by allowing an attacker with network position to decrypt HTTPS cookies through adaptive chosen-plaintext attacks?
- A) Heartbleed
- B) POODLE
- C) BEAST (Browser Exploit Against SSL/TLS)
- D) FREAK
Answer
C — BEAST (Browser Exploit Against SSL/TLS)
BEAST (2011) exploited a weakness in TLS 1.0's CBC mode implementation — the initialization vector (IV) for each record was the last ciphertext block of the previous record (predictable IVs). This allowed a network attacker with JavaScript injection capability to perform adaptive chosen-plaintext attacks and recover HTTPS session cookies. The fix: upgrade to TLS 1.1+, which uses random IVs, or use RC4 (now also deprecated).
6. What did the Heartbleed vulnerability (CVE-2014-0160) expose, and what type of cryptographic failure does it exemplify?
- A) A weak cipher negotiation flaw that allowed downgrade to DES
- B) A memory over-read bug in OpenSSL's heartbeat extension that could expose private keys, session keys, and memory contents
- C) A certificate forgery flaw in the X.509 parsing library
- D) A padding oracle attack in TLS 1.2 CBC mode
Answer
B — A memory over-read bug in OpenSSL's heartbeat extension that could expose private keys, session keys, and memory contents
Heartbleed was not a cryptographic algorithm failure — it was an implementation bug. The TLS heartbeat extension in OpenSSL failed to validate that the response payload length matched the actual data sent. An attacker could request up to 64KB of server memory per heartbeat, potentially recovering TLS private keys, session tokens, and credentials. The fix was updating OpenSSL and revoking/reissuing all server certificates.
7. An HSM (Hardware Security Module) is mandated for a financial institution's code signing pipeline. What is the primary security property that justifies using an HSM over software-based key storage?
- A) HSMs are faster than software key stores for all cryptographic operations
- B) Private keys in an HSM never leave the hardware boundary — cryptographic operations are performed inside the tamper-resistant device
- C) HSMs are immune to network-based attacks since they operate offline
- D) HSMs store unlimited certificates without performance degradation
Answer
B — Private keys in an HSM never leave the hardware boundary — cryptographic operations are performed inside the tamper-resistant device
The core security property of an HSM is key non-exportability. The private key is generated inside the HSM, never exported in plaintext, and all cryptographic operations (signing, decryption) are performed within the hardware's tamper-resistant boundary. If the HSM is physically attacked, it self-destructs key material. Software key stores (files, databases) can be exfiltrated; HSM-protected keys cannot.
8. A CISO is reviewing the organization's cryptographic roadmap. Which post-quantum cryptographic algorithm, standardized by NIST in 2024, is designed to replace RSA/ECC for key encapsulation (key exchange)?
- A) CRYSTALS-Dilithium
- B) CRYSTALS-Kyber (ML-KEM)
- C) SPHINCS+
- D) FALCON
Answer
B — CRYSTALS-Kyber (ML-KEM)
NIST's Post-Quantum Cryptography (PQC) standardization (FIPS 203–205) finalized in 2024 selected: CRYSTALS-Kyber (FIPS 203, renamed ML-KEM) for key encapsulation (replacing RSA/ECDH in TLS key exchange), CRYSTALS-Dilithium (FIPS 204, ML-DSA) for digital signatures, SPHINCS+ (FIPS 205, SLH-DSA) as a hash-based signature backup. FALCON (FN-DSA) is a secondary signature scheme. Kyber is the key exchange replacement.
9. A key management policy requires that data encryption keys (DEKs) be rotated annually and that the master key used to encrypt DEKs (KEK) be stored in an HSM. What is this two-tier key architecture called?
- A) Public Key Infrastructure (PKI)
- B) Envelope Encryption (Key Wrapping)
- C) Split-Key Cryptography
- D) Certificate Transparency
Answer
B — Envelope Encryption (Key Wrapping)
Envelope encryption (also called key wrapping) is a two-tier model: a Data Encryption Key (DEK) encrypts the actual data, and a Key Encryption Key (KEK) encrypts (wraps) the DEK. The KEK is stored in a protected location (HSM or KMS). This allows rotating data encryption without re-encrypting all data (only the DEK wrapper needs re-encryption with a new KEK), and provides centralized key lifecycle control.
10. An analyst reviews a TLS configuration and finds a server still supporting TLS 1.0, RC4, and NULL cipher suites. Which immediate action is most critical?
- A) Disable NULL cipher suites only — RC4 and TLS 1.0 are still considered acceptable for legacy compatibility
- B) Disable NULL cipher suites first (they provide no encryption), then disable RC4 and TLS 1.0 with a migration timeline for legacy clients
- C) Migrate the entire server to TLS 1.3 immediately without considering legacy client impact
- D) Enable certificate pinning to compensate for weak cipher suites
Answer
B — Disable NULL cipher suites first (they provide no encryption), then disable RC4 and TLS 1.0 with a migration timeline for legacy clients
NULL cipher suites transmit data in plaintext — there is no encryption whatsoever. This is always an immediate critical fix regardless of client compatibility. RC4 is broken (multiple statistical biases, BEAST-variant attacks) and TLS 1.0 has known vulnerabilities (POODLE, BEAST). These should be disabled on a structured migration plan that considers legacy client impact. Certificate pinning (D) does not fix weak cipher suites.
Scoring¶
| Score | Performance |
|---|---|
| 9–10 | Expert — Applied cryptography, PKI, and key management concepts fully mastered |
| 7–8 | Proficient — Ready to design cryptographic architectures and advise on crypto policy |
| 5–6 | Developing — Review Chapter 32 sections on TLS handshake, PKI hierarchy, and key management lifecycle |
| <5 | Foundational — Re-read Chapter 32 before proceeding |
Return to Chapter 32 | Next: Chapter 33