Question

Difficulty: EasyCryptographic and Security Control Weaknesses

A security administrator is auditing a legacy internal service and discovers two critical cryptographic control weaknesses: the application utilizes static, hardcoded Initialization Vectors (IVs) for Cipher Block Chaining (CBC) encryption, and it explicitly disables Certificate Revocation List (CRL) verification during TLS peer authentication. Which of the following security risks are directly introduced by these weaknesses? (Select TWO.)

  1. Fixed Initialization Vectors enable attackers to detect identical plaintext blocks and perform pattern recognition attacks across encrypted ciphertext.Answer
  2. Bypassing revocation checks allows the service to establish trusted connections using revoked or compromised digital certificates.Answer
  3. C
    Hardcoded IVs occur primarily when asymmetric algorithms are selected for bulk data encryption rather than symmetric ciphers.
  4. D
    Internal network boundary firewalls automatically eliminate the cryptographic risks associated with disabled certificate validation.

Answer

Static Initialization Vectors enable pattern recognition across ciphertext, and bypassing revocation checking permits trusting compromised or revoked certificates.
Hardcoded IVs compromise the randomness of symmetric CBC block ciphers, enabling pattern analysis when identical plaintext blocks are encrypted. Furthermore, disabling CRL checking prevents the application from discovering if a certificate has been revoked by its Issuing CA, allowing revoked or compromised certificates to establish trusted TLS sessions.

Step-by-Step Solution

1
Analyze the impact of hardcoded Initialization Vectors (IVs) in CBC mode.
Identify that static IVs cause identical plaintext encrypted with the same key to yield predictable block patterns.
CBC mode requires a unique and random IV for every encryption operation to ensure indistinguishability.
2
Analyze the impact of disabling Certificate Revocation List (CRL) checks during TLS validation.
Identify that revoked certificates will be accepted without verification.
CRL validation ensures that certificates revoked due to key compromise or expiration are rejected before establishing trust.

Key Concept

Cryptographic Weaknesses in Cipher Initialization and Certificate Validation
Rate this question