A security administrator is auditing a legacy internal service and discovers two critical cryptographic control weaknesses: the application utilizes static, hardcoded Initialization Vectors (IVs) for Cipher Block Chaining (CBC) encryption, and it explicitly disables Certificate Revocation List (CRL) verification during TLS peer authentication. Which of the following security risks are directly introduced by these weaknesses? (Select TWO.)
- Fixed Initialization Vectors enable attackers to detect identical plaintext blocks and perform pattern recognition attacks across encrypted ciphertext.Answer
- Bypassing revocation checks allows the service to establish trusted connections using revoked or compromised digital certificates.Answer
- CHardcoded IVs occur primarily when asymmetric algorithms are selected for bulk data encryption rather than symmetric ciphers.
- DInternal network boundary firewalls automatically eliminate the cryptographic risks associated with disabled certificate validation.
Answer
Static Initialization Vectors enable pattern recognition across ciphertext, and bypassing revocation checking permits trusting compromised or revoked certificates.
Hardcoded IVs compromise the randomness of symmetric CBC block ciphers, enabling pattern analysis when identical plaintext blocks are encrypted. Furthermore, disabling CRL checking prevents the application from discovering if a certificate has been revoked by its Issuing CA, allowing revoked or compromised certificates to establish trusted TLS sessions.
Step-by-Step Solution
Key Concept
Cryptographic Weaknesses in Cipher Initialization and Certificate Validation