Examkin

Question

Difficulty: MediumCryptographic Concepts and Algorithms

A security analyst is investigating a breach where an adversary captured encrypted TLS traffic traversing an enterprise network. Months later, the adversary obtained the web server's private key and successfully decrypted all historical session data. Which of the following cryptographic mechanisms should be implemented to ensure that a future compromise of the server's private key does not expose previously recorded encrypted session communications?

  1. Perfect forward secrecy utilizing ephemeral key exchange mechanismsAnswer
  2. B
    Static RSA asymmetric key transport for encrypting session symmetric keys
  3. C
    HMAC-SHA256 message authentication codes appended to each network packet
  4. D
    Generating a Certificate Signing Request with a 4096-bit RSA public key length

Answer

Perfect forward secrecy utilizing ephemeral key exchange mechanisms
Perfect forward secrecy (PFS) ensures that compromise of a long-term private key does not compromise past session keys. By generating disposable ephemeral key pairs for each session (such as with ECDHE), past session keys cannot be computed retroactively even if an attacker acquires the server's long-term private key.

Step-by-Step Solution

1
Analyze the vulnerability described in the security incident.
Recorded historical TLS sessions were decrypted after an attacker obtained the server's long-term static private key.
The static key exchange mechanism allowed the server's long-term private key to decrypt stored session keys.
2
Identify the required cryptographic security property.
The architecture requires a mechanism where compromise of long-term keying material does not compromise past session keys.
This specific security goal is defined as Perfect Forward Secrecy (PFS).
3
Select the implementation mechanism that provides Perfect Forward Secrecy.
Ephemeral key exchange algorithms (such as ECDHE or DHE) generate temporary, disposable key pairs per session.
Because ephemeral keys are discarded immediately after session key derivation, compromise of the long-term server key cannot decrypt recorded past traffic.

Key Concept

Perfect Forward Secrecy and Ephemeral Key Exchange
Rate this question

Topics

Cryptographic Concepts and Algorithms

More questions from this topic