Examkin

Question

Difficulty: MediumCryptographic Concepts and Algorithms

A security engineer is updating the cryptographic specifications for an enterprise file ingest service. The system baseline requires high-throughput data confidentiality for large batch data uploads, alongside digital non-repudiation and origin verification for administrative policy manifests submitted with each batch. Which TWO cryptographic algorithms or mechanisms should the security engineer implement to satisfy these specific operational requirements?

  1. AES-GCM (Advanced Encryption Standard in Galois/Counter Mode) for high-speed symmetric bulk data encryptionAnswer
  2. ECDSA (Elliptic Curve Digital Signature Algorithm) for signing administrative policy manifestsAnswer
  3. C
    Direct RSA public key encryption applied to the full payload stream of each large batch data upload
  4. D
    Standalone SHA-256 hashing performed on administrative policy manifests prior to transmission
  5. E
    Generating and submitting a new Certificate Signing Request (CSR) for each individual administrative policy manifest

Answer

The correct cryptographic implementation consists of using symmetric authenticated encryption (AES-GCM) for rapid bulk data confidentiality and asymmetric digital signatures (ECDSA) to provide non-repudiation and origin authentication for administrative manifests.
AES-GCM is the industry standard symmetric block cipher mode for fast, authenticated encryption of high-volume data payloads. ECDSA provides strong asymmetric digital signatures with compact key sizes, fulfilling the requirement for non-repudiation and sender authenticity on administrative manifest files.

Step-by-Step Solution

1
Identify the high-throughput confidentiality requirement for bulk data.
Symmetric ciphers are optimized for processing large volumes of data quickly. AES-GCM provides bulk stream confidentiality along with authenticated encryption.
Asymmetric algorithms incur prohibitive performance overhead when encrypting large payloads.
2
Identify the non-repudiation and origin verification requirement for administrative manifests.
Asymmetric digital signatures, such as ECDSA, allow the sender to sign content using a private key, enabling receivers to verify origin and integrity using the corresponding public key.
Digital signatures guarantee non-repudiation because only the private key owner could have produced the signature.

Key Concept

Selecting Appropriate Cryptographic Algorithms for Confidentiality vs. Non-Repudiation
Rate this question

Topics

Cryptographic Concepts and Algorithms

More questions from this topic