Examkin

Question

Difficulty: Very hardCryptographic Concepts and Algorithms

A enterprise security architect is updating the Transport Layer Security (TLS) configuration for an API gateway that services millions of mobile endpoints. The architecture requires establishing unique, temporary symmetric session keys across untrusted connections while minimizing computational overhead on mobile processor microchips. Additionally, the solution must enforce Perfect Forward Secrecy (PFS) so that a future compromise of the API gateway's long-term private key will not allow an attacker to decrypt previously captured session traffic. Which cryptographic key exchange algorithm combination should the architect configure on the gateway?

  1. Elliptic Curve Diffie-Hellman Ephemeral (ECDHE)Answer
  2. B
    Static RSA key transport with Cipher Block Chaining (CBC)
  3. C
    HMAC-SHA256 key derivation hashing
  4. D
    Elliptic Curve Digital Signature Algorithm (ECDSA) in static mode

Answer

Elliptic Curve Diffie-Hellman Ephemeral (ECDHE)
Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) uses temporary (ephemeral) key pairs for every handshake session, ensuring that compromising long-term keys does not reveal past communications (Perfect Forward Secrecy). Additionally, using elliptic curve mathematics reduces bit-length overhead, preserving CPU and battery resources on mobile clients.

Step-by-Step Solution

1
Analyze the core requirements
Identified low-overhead key exchange on mobile devices, temporary session key agreement, and Perfect Forward Secrecy (PFS).
PFS requires key exchange protocols that derive unique, temporary key pairs per session rather than using static private keys.
2
Evaluate key exchange mechanisms for forward secrecy
Ephemeral Diffie-Hellman (EDH/DHE) variants generate temporary keys discarded after session termination.
Because ephemeral keys are never stored long-term, compromising the server private key cannot decrypt past recorded sessions.
3
Select algorithm optimized for mobile resource constraints
Elliptic Curve cryptography (ECC) delivers equivalent security to standard RSA/DH with significantly smaller key sizes and less computational overhead.
Combining ECC with Ephemeral Diffie-Hellman yields ECDHE, meeting both the mobile efficiency requirement and PFS enforcement.

Key Concept

Perfect Forward Secrecy via Ephemeral Elliptic Curve Key Exchange
Estimated Time:2m 0s
Rate this question

Topics

Cryptographic Concepts and Algorithms

More questions from this topic