A security review of an e-commerce platform's legacy vault database reveals that stored payment tokens are encrypted using the Data Encryption Standard (DES) algorithm operating in Cipher Block Chaining (CBC) mode. Additionally, the system uses a single, hardcoded Initialization Vector (IV) for every database record encryption operation. Which TWO cryptographic weaknesses are present in this architecture? (Select TWO)
- Use of a deprecated cipher with a short key length vulnerable to brute-force attacksAnswer
- Reuse of a static Initialization Vector (IV), resulting in predictable ciphertexts for matching plaintext inputsAnswer
- CFailure to utilize asymmetric RSA key pairs for bulk data encryption at rest
- DMisconfiguration of database encryption logs as a preventive control rather than a detective control
Answer
The two cryptographic weaknesses are the reliance on a deprecated cipher with a short key size (DES) and the implementation of a static Initialization Vector (IV) across CBC operations.
The system suffers from two distinct cryptographic flaws: first, DES relies on a legacy 56-bit key size that is vulnerable to key recovery attacks; second, reusing a static IV with CBC mode breaks semantic security, allowing attackers to detect matching plaintext blocks across stored records.
Step-by-Step Solution
Key Concept
Cryptographic Weaknesses in Cipher Selection and Mode Implementation