Examkin

Question

Difficulty: MediumCryptographic Concepts and Algorithms

A systems administrator is configuring bulk storage encryption for a enterprise cloud file server holding sensitive financial records. The organization requires a cryptographic mechanism that delivers high-speed symmetric data encryption while simultaneously calculating an authentication tag to ensure confidentiality and data integrity during high-throughput disk operations. Which of the following cryptographic algorithms and modes BEST fulfills these requirements?

  1. AES-256 in Galois/Counter Mode (GCM)Answer
  2. B
    RSA-4096 with OAEP padding
  3. C
    HMAC-SHA256 with key stretching
  4. D
    SHA-3 in Cipher Block Chaining (CBC) mode

Answer

AES-256 in Galois/Counter Mode (GCM) is the optimal choice because it is a symmetric block cipher mode offering high-speed authenticated encryption (AEAD), satisfying both confidentiality and integrity requirements for bulk storage.
AES-256 in Galois/Counter Mode (GCM) is an Authenticated Encryption with Associated Data (AEAD) cipher mode. It provides strong confidentiality via symmetric bulk encryption and simultaneous data integrity authentication via a Galois field multiplication tag, fulfilling all scenario requirements with minimal latency.

Step-by-Step Solution

1
Identify the primary operational constraint and functional requirements
The scenario requires bulk data encryption (requiring symmetric encryption for speed), confidentiality, and integrity (requiring authenticated encryption).
Bulk disk storage operations require high-throughput symmetric ciphers due to performance overhead of asymmetric ciphers.
2
Evaluate candidate cryptographic algorithms for bulk data encryption
AES (Advanced Encryption Standard) is the standard symmetric block cipher for high-speed bulk data-at-rest encryption.
Asymmetric ciphers (such as RSA) and hashing functions (such as HMAC or SHA-3) cannot fulfill high-throughput encryption requirements.
3
Select the appropriate cipher mode of operation
Galois/Counter Mode (GCM) provides Authenticated Encryption with Associated Data (AEAD), outputting both ciphertext and an authentication tag.
AEAD modes guarantee data confidentiality while verifying data integrity without requiring separate hash passes.

Key Concept

Authenticated Encryption with Associated Data (AEAD) via AES-GCM
Rate this question

Topics

Cryptographic Concepts and Algorithms

More questions from this topic