A security engineer is updating enterprise cryptographic standards across various operational systems. Match each cryptographic algorithm or mechanism on the left to its primary operational security capability on the right.
- Galois/Counter Mode (AES-GCM)Provides authenticated encryption by delivering simultaneous bulk data confidentiality and data integrity verification.
- Elliptic Curve Diffie-Hellman Ephemeral (ECDHE)Establishes temporary session keys dynamically to ensure perfect forward secrecy during network transport.
- Password-Based Key Derivation Function 2 (PBKDF2)Applies salting and repeated hashing iterations to slow down offline password cracking and dictionary attacks.
- Hash-based Message Authentication Code (SHA-256 HMAC)Combines a symmetric secret key with a cryptographic hash function to verify data origin authentication and payload integrity.
Answer
Galois/Counter Mode (AES-GCM) pairs with authenticated encryption for bulk data confidentiality and integrity; Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) pairs with temporary session key negotiation for perfect forward secrecy; Password-Based Key Derivation Function 2 (PBKDF2) pairs with salting and repeated iterations for password cracking mitigation; SHA-256 HMAC pairs with secret-key hashing for origin authentication and payload integrity.
Each cryptographic primitive aligns strictly with its defined operational role: AES-GCM performs authenticated bulk encryption, ECDHE manages ephemeral key exchange for perfect forward secrecy, PBKDF2 performs key stretching to secure stored passwords, and SHA-256 HMAC provides keyed integrity and origin verification.
Step-by-Step Solution
Key Concept
Cryptographic Primitives and Operational Capabilities
Estimated Time:1m 30s