Question

Difficulty: MediumCryptographic and Security Control Weaknesses

A security analyst is reviewing an audit report detailing cryptographic vulnerabilities identified across an enterprise network. Match each observed security incident or technical finding on the left with its underlying cryptographic weakness on the right.

  • An attacker retroactively decrypts historical TLS traffic captured from a web server after stealing its long-term private key.Absence of Perfect Forward Secrecy (PFS) in key exchange mechanisms.
  • A database review reveals that identical credit card numbers produce identical ciphertext entries across multiple records.Implementation of Electronic Codebook (ECB) mode of operation.
  • An attacker recovers plaintext communications from a legacy wireless system by collecting packets transmitted with repeated nonces.Keystream reuse resulting from static initialization vectors (IVs).
  • A security audit uncovers an application using a fixed 56-bit symmetric cipher key compiled directly into client software binaries.Inadequate key length susceptible to brute-force key space exhaustion.

Answer

1. Retroactive decryption of captured traffic maps to Absence of Perfect Forward Secrecy (PFS). 2. Identical ciphertext for identical database inputs maps to Electronic Codebook (ECB) mode. 3. Plaintext recovery from repeated nonces maps to Keystream reuse from static IVs. 4. Compiled 56-bit symmetric key maps to Inadequate key length.
Each security finding correctly pairs with its fundamental cryptographic flaw: compromise of past TLS sessions due to lack of PFS; deterministic identical ciphertexts due to ECB block mode; keystream exposure due to static IV reuse; and weak key entropy due to an obsolete 56-bit key length.

Step-by-Step Solution

1
Analyze the first scenario involving compromise of a private key leading to retroactive session decryption.
Identify that static RSA key exchange allows past traffic to be decrypted if the private key is exposed.
Perfect Forward Secrecy ensures ephemeral session keys are destroyed and cannot be derived from long-term private keys.
2
Analyze the second scenario involving pattern preservation in encrypted database entries.
Identify that deterministic block-by-block encryption without initialization vectors exhibits ECB mode behavior.
ECB mode maps identical plaintext blocks directly to identical ciphertext blocks.
3
Analyze the third scenario involving plaintext recovery via repeated nonces.
Recognize that static IV usage in stream ciphers leads to keystream reuse.
When the same keystream encrypts multiple plaintexts, XORing two ciphertexts cancels out the keystream.
4
Analyze the fourth scenario involving a hardcoded 56-bit symmetric key.
Determine that a 56-bit key size is cryptographically weak due to low key space size.
Modern computing hardware can brute-force a 56-bit key space in hours or minutes.

Key Concept

Cryptographic and Security Control Weaknesses
Rate this question