Examkin

Question

Difficulty: MediumCryptographic Concepts and Algorithms

A security architect is establishing cryptographic standards for an enterprise API service. The service requirements specify that past session communications must remain secure even if the server's long-term private key is compromised in the future. Additionally, incoming API requests must provide proof of origin and data integrity that cannot be denied by the sender. Which of the following cryptographic mechanisms should the architect implement to satisfy these security requirements? (Select TWO).

  1. Ephemeral Elliptic Curve Diffie-Hellman (ECDHE) key exchange for session establishmentAnswer
  2. Asymmetric digital signatures attached to request payloadsAnswer
  3. C
    SHA-256 cryptographic hashing alone applied to incoming payload data
  4. D
    Static RSA asymmetric encryption for bulk API payload encryption
  5. E
    Certificate Signing Request (CSR) generation for every incoming request

Answer

The architect should implement Ephemeral Elliptic Curve Diffie-Hellman (ECDHE) key exchange and asymmetric digital signatures attached to request payloads.
Ephemeral Elliptic Curve Diffie-Hellman (ECDHE) key exchange provides Perfect Forward Secrecy (PFS) by generating unique key pairs for each session, preventing future key compromises from decrypting past traffic. Asymmetric digital signatures ensure data integrity and non-repudiation, guaranteeing that the request originated from the specified sender and was not altered in transit.

Step-by-Step Solution

1
Analyze the requirement for protecting past session communications against future private key compromise.
Identified the need for Perfect Forward Secrecy (PFS).
Perfect Forward Secrecy ensures that session keys are not derived from long-term secret keys. Ephemeral Diffie-Hellman key exchanges (such as ECDHE) generate temporary keys per session to achieve this.
2
Analyze the requirement for proof of origin and data integrity that cannot be denied by the sender.
Identified the need for non-repudiation and integrity verification.
Digital signatures combine hashing (for integrity) with asymmetric private key signing (for non-repudiation), ensuring the sender cannot deny creating the request.

Key Concept

Perfect Forward Secrecy and Digital Signatures
Rate this question

Topics

Cryptographic Concepts and Algorithms

More questions from this topic