Examkin

Question

Difficulty: MediumCryptographic Concepts and Algorithms

A security engineer is updating the cryptographic configuration of an internal API gateway to enhance session transport security. The new security baseline requires providing Perfect Forward Secrecy (PFS) for key establishment and guaranteeing message authentication and integrity for incoming payload headers. Which TWO cryptographic mechanisms or algorithms should the security engineer implement to satisfy these requirements?

  1. Elliptic Curve Diffie-Hellman Ephemeral (ECDHE)Answer
  2. Hash-based Message Authentication Code with SHA-256 (HMAC-SHA256)Answer
  3. C
    Static RSA key exchange
  4. D
    Unsalted SHA-256 digest hashing
  5. E
    AES-256 in Cipher Block Chaining (CBC) mode without an authentication tag

Answer

The security engineer should implement Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) for key establishment and HMAC-SHA256 for header integrity and authentication.
Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) provides dynamic key exchange where session keys are temporary and discarded after use, guaranteeing Perfect Forward Secrecy. HMAC-SHA256 pairs a secret cryptographic key with a hash function, ensuring both message integrity and sender origin authentication.

Step-by-Step Solution

1
Analyze key establishment requirements for Perfect Forward Secrecy (PFS).
Identify that ephemeral key exchange mechanisms like ECDHE regenerate key pairs per session, preventing retroactive decryption.
Static asymmetric key exchanges like static RSA decrypt session secrets using long-term private keys, violating PFS principles.
2
Analyze payload header requirements for message authenticity and integrity.
Identify that symmetric keyed hashing (HMAC-SHA256) verifies both data integrity and origin authenticity.
Unkeyed hash functions verify integrity against corruption but cannot authenticate the sender, while plain symmetric ciphers without MAC tags only provide confidentiality.

Key Concept

Cryptographic Concepts and Algorithms
Rate this question

Topics

Cryptographic Concepts and Algorithms

More questions from this topic