Examkin

Question

Difficulty: HardCryptographic and Security Control Weaknesses

An energy utility enterprise recently deployed 50,000 smart grid sensors that transmit operational telemetry data to a central management server over encrypted TLS connections. During an independent security audit, analysts discover that while TLS 1.2 is enforced, the server accepts finite-field Diffie-Hellman key exchanges configured with legacy 512-bit prime parameters. Which cryptographic vulnerability does this configuration represent, and what risk does it present to the enterprise?

  1. Weak key exchange implementation allowing an attacker to precompute discrete logarithms and decrypt TLS session keysAnswer
  2. B
    Improper selection of asymmetric algorithms for bulk data payload encryption, causing processing bottlenecks on edge sensors
  3. C
    Flawed Certificate Signing Request submission flow leading to automatic approval of self-signed root certificates on grid endpoints
  4. D
    Inadequate network perimeter firewall filtering failing to inspect application-layer payloads passed through the encrypted tunnel

Answer

Weak key exchange implementation allowing an attacker to precompute discrete logarithms and decrypt TLS session keys
The correct answer accurately identifies that 512-bit prime parameters in Diffie-Hellman key exchange are cryptographically broken. Utilizing sub-2048-bit prime groups dramatically reduces the computational effort required to solve discrete logarithms, enabling threat actors to compute session keys and decrypt TLS traffic.

Step-by-Step Solution

1
Analyze the reported scenario and identify the specific cryptographic mechanism.
The server uses TLS 1.2 with finite-field Diffie-Hellman key exchange utilizing 512-bit prime modulus parameters.
Diffie-Hellman parameter size dictates the mathematical difficulty of solving the discrete logarithm problem necessary to derive session keys.
2
Evaluate the security threshold for Diffie-Hellman key sizes.
512-bit DH groups are cryptographically weak and vulnerable to precomputation attacks using the Number Field Sieve (NFS).
Modern cryptographic guidelines require DH prime sizes of at least 2048 bits to resist polynomial-time discrete logarithm factoring.
3
Determine the impact of exploiting weak key exchange parameters.
An adversary performing a man-in-the-middle or passive decryption attack can derive the shared secret and decrypt network traffic.
Breaking the key exchange compromises the confidentiality of all TLS sessions established with those weak parameters.

Key Concept

Cryptographic Key Exchange Weaknesses (Diffie-Hellman Parameter Strength)
Estimated Time:2m 0s
Rate this question

Topics

Cryptographic and Security Control Weaknesses

More questions from this topic