An enterprise security architecture assessment identified several technical flaws across the organization's cryptographic implementations and control configurations. Match each cryptographic or security control weakness on the left to its corresponding security impact on the right.
- Static RSA key exchange without ephemeral key parametersCompromise of the server's private key allows retroactive decryption of previously recorded session traffic.
- Hardcoded symmetric encryption keys embedded in client application binariesReverse engineering of the binary exposes shared secret keys, compromising data confidentiality globally across all deployments.
- Disabled Certificate Revocation List (CRL) and OCSP validation on client endpointsClients accept revoked or compromised digital certificates, enabling man-in-the-middle inspection by unauthorized gateways.
- Cipher Block Chaining (CBC) mode initialized with predictable Initialization VectorsAdversaries can exploit deterministic initial block states to perform plaintext recovery or chosen-ciphertext attacks.
Answer
Static RSA key exchange matches retroactive decryption of past session traffic due to lack of Perfect Forward Secrecy; hardcoded symmetric keys match binary reverse engineering leading to global key exposure; disabled revocation checking matches acceptance of revoked certificates during man-in-the-middle attacks; predictable CBC IVs match susceptibility to block pattern analysis and chosen-ciphertext attacks.
Each identified weakness maps directly to its technical vulnerability: static RSA key exchange lacks forward secrecy resulting in retroactive traffic decryption; hardcoded client secrets permit reverse engineering and key extraction; bypassing CRL/OCSP validation forces endpoints to trust revoked certificates during interception attacks; and predictable IVs in CBC mode break cipher non-determinism, exposing sessions to chosen-ciphertext analysis.
Step-by-Step Solution
Key Concept
Cryptographic and Security Control Weaknesses