Examkin

Question

Difficulty: HardCryptographic and Security Control Weaknesses

A security engineering team is conducting a vulnerability assessment of an internal payment API gateway. The assessment reveals that client TLS connections are configured to accept cipher suites utilizing the RC4 stream cipher for data encryption and static RSA key exchange for session negotiation. Which of the following security risks or weaknesses are directly introduced by this cryptographic configuration? (Select TWO.)

  1. Susceptibility to plaintext recovery attacks resulting from statistical biases in the stream cipher keystreamAnswer
  2. Loss of Perfect Forward Secrecy, allowing retrospective decryption of recorded sessions if the server private key is compromisedAnswer
  3. C
    Inability to authenticate the server identity due to substituting asymmetric algorithms with symmetric key distribution
  4. D
    Increased exposure to operating system memory corruption and remote buffer overflow execution on the gateway

Answer

The correct selections state that the configuration introduces susceptibility to plaintext recovery via keystream statistical biases and results in a loss of Perfect Forward Secrecy.
The scenario highlights two distinct cryptographic weaknesses: the use of RC4 and static RSA key exchange. RC4 contains documented statistical biases in its keystream generation, which enables malicious actors to recover plaintext from captured TLS traffic over time. Static RSA key exchange uses the server's static public key to transport pre-master secrets without generating ephemeral keys per session; consequently, it lacks Perfect Forward Secrecy, meaning a future compromise of the server's private key compromises all previously recorded session communications.

Step-by-Step Solution

1
Analyze the symmetric encryption component (RC4 stream cipher).
Identify that RC4 suffers from known keystream biases (e.g., Fluhrer, Mantin, and Shamir attacks / NOMORE attacks), permitting plaintext recovery over repeated ciphertexts.
Cryptographic assessment requires identifying vulnerabilities tied directly to weak or deprecated bulk ciphers.
2
Analyze the key exchange mechanism (static RSA key exchange).
Determine that static RSA key exchange does not generate ephemeral session keys, failing to provide Perfect Forward Secrecy (PFS).
Without ephemeral key exchange algorithms like ECDHE or DHE, compromise of the server's long-term private key compromises all historical session traffic.
3
Evaluate and eliminate incorrect distractor claims regarding identity authentication and memory buffer security.
Confirm that server authentication via RSA certificates remains active and that buffer overflows represent software execution vulnerabilities rather than cipher flaws.
Differentiates protocol-level cryptographic weaknesses from software code vulnerabilities and general PKI misconceptions.

Key Concept

Cryptographic and Security Control Weaknesses
Rate this question

Topics

Cryptographic and Security Control Weaknesses

More questions from this topic