Examkin

Question

Difficulty: MediumCryptographic Concepts and Algorithms

A systems administrator is configuring a secure remote management channel for server administration over an untrusted network. The security policy mandates perfect forward secrecy so that compromising the server's long-term private key in the future will not allow an attacker to decrypt previously recorded session traffic. Which cryptographic key exchange mechanism should the administrator implement to satisfy this requirement?

  1. Ephemeral Diffie-Hellman key exchangeAnswer
  2. B
    Static RSA key exchange
  3. C
    Certificate Signing Request flow
  4. D
    Symmetric AES-CBC data encryption with a static key

Answer

Ephemeral Diffie-Hellman key exchange should be selected because ephemeral keys provide perfect forward secrecy for encrypted sessions.
Ephemeral Diffie-Hellman key exchange satisfies perfect forward secrecy requirements because a unique, temporary key pair is generated for each communication session. Once the session ends, the temporary keys are discarded. An attacker who compromises the server's long-term private key at a later date cannot derive previous session keys or decrypt captured historical traffic.

Step-by-Step Solution

1
Identify the primary requirement specified in the scenario
The requirement is perfect forward secrecy (PFS) for remote management sessions over an untrusted network.
The system must protect historical session logs from decryption even if long-term server private keys are compromised.
2
Evaluate key exchange mechanisms against the requirement
Ephemeral key exchanges (such as ECDHE or DHE) generate temporary, disposable keys per session rather than deriving session keys from long-term asymmetric keys.
Because temporary session keys are not stored and cannot be derived from long-term keys, forward secrecy is maintained.
3
Select the option that implements ephemeral key exchange
Ephemeral Diffie-Hellman key exchange correctly satisfies the security requirement.
It ensures that compromising long-term keys does not compromise past communication sessions.

Key Concept

Perfect Forward Secrecy via Ephemeral Diffie-Hellman
Rate this question

Topics

Cryptographic Concepts and Algorithms

More questions from this topic