Examkin

Question

Difficulty: Very hardCryptographic Concepts and Algorithms

An enterprise security architect is standardizing cryptographic controls across a zero-trust network infrastructure. Match each security design requirement on the left with the most appropriate cryptographic mechanism or algorithm on the right.

  • Negotiating a transient shared secret over an untrusted channel to provide Perfect Forward Secrecy (PFS) for TLS sessionsECDHE (Elliptic Curve Diffie-Hellman Ephemeral)
  • Providing simultaneous payload confidentiality, integrity verification, and origin authenticity in a single symmetric operationAES-GCM (Authenticated Encryption with Associated Data)
  • Mitigating offline GPU-accelerated brute-force attacks against stored user credential hashes using configurable memory-hard work factorsArgon2id key derivation function
  • Ensuring non-repudiation and origin verification for published software updates without encrypting the file binary itselfECDSA (Elliptic Curve Digital Signature Algorithm)

Answer

1. Negotiating a transient shared secret with PFS matches ECDHE; 2. Simultaneous confidentiality, integrity, and authenticity matches AES-GCM; 3. Mitigating GPU brute-force cracking of stored credentials matches Argon2id; 4. Non-repudiation for software updates without payload encryption matches ECDSA.
Each requirement directly aligns with the operational purpose of the corresponding cryptographic primitive: ECDHE for forward-secret key exchange, AES-GCM for authenticated symmetric encryption, Argon2id for memory-hard credential hashing, and ECDSA for asymmetric digital signatures.

Step-by-Step Solution

1
Analyze key exchange requirements for session key forward secrecy.
Ephemeral Diffie-Hellman key exchanges (like ECDHE) generate temporary key pairs per session, guaranteeing Perfect Forward Secrecy.
Static asymmetric keys (like basic RSA or DH) do not satisfy PFS requirements because private key compromise exposes past traffic.
2
Evaluate cipher modes for combined confidentiality and integrity protection.
Galois/Counter Mode (GCM) is an AEAD mode combining AES block cipher encryption with Galois field authentication.
Standard block modes like CBC require a separate MAC algorithm (e.g., HMAC) to achieve authenticated encryption.
3
Determine password hashing mechanisms designed for high compute/memory cost.
Argon2id incorporates salt and deliberate CPU/memory overheads to neutralize parallelized cracking hardware.
Standard fast hash functions (SHA-256) are vulnerable to rapid GPU dictionary attacks when applied directly to passwords.
4
Identify asymmetric mechanisms providing non-repudiation for cleartext payloads.
Digital signatures (such as ECDSA) sign a digest of the payload using a private key, ensuring origin verification without requiring data encryption.
Public key encryption provides confidentiality rather than payload signing for unencrypted public distribution.

Key Concept

Cryptographic Concepts and Algorithms
Rate this question

Topics

Cryptographic Concepts and Algorithms

More questions from this topic