A network administrator is configuring a secure transport session to protect financial telemetry transmitted across an untrusted enterprise network. The session configuration requires high-speed symmetric data confidentiality as well as a key exchange mechanism that guarantees Perfect Forward Secrecy (PFS). Which TWO of the following cryptographic mechanisms should the administrator select to meet these requirements?
- Elliptic Curve Diffie-Hellman Ephemeral (ECDHE)Answer
- Advanced Encryption Standard in Galois/Counter Mode (AES-GCM)Answer
- CStatic Rivest-Shamir-Adleman (RSA) key transport
- DStandalone Secure Hash Algorithm 256-bit (SHA-256)
- ECertificate Signing Request (CSR) generation
Answer
Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) and Advanced Encryption Standard in Galois/Counter Mode (AES-GCM) must be selected.
To protect session data across an untrusted network with both high performance and forward secrecy, administrators pair a symmetric cipher for data payload confidentiality with an ephemeral key exchange protocol. Elliptic Curve Diffie-Hellman Ephemeral provides Perfect Forward Secrecy by establishing unique keying material for each session without relying on reusable private keys. Advanced Encryption Standard in Galois/Counter Mode provides authenticated symmetric bulk encryption, meeting both the performance and confidentiality objectives.
Step-by-Step Solution
Key Concept
Combining symmetric encryption for bulk confidentiality with ephemeral key exchange for forward secrecy.