Examkin

Question

Difficulty: HardCryptographic Concepts and Algorithms

A security engineer is designing a secure communication protocol between distributed edge gateways and a cloud broker. The design mandates that if an attacker compromises the private key of a gateway in the future, the attacker must not be able to decrypt past session traffic that was previously captured and stored. Which of the following cryptographic mechanisms should the engineer enforce to satisfy this specific requirement?

  1. Ephemeral Diffie-Hellman key exchange to establish Perfect Forward SecrecyAnswer
  2. B
    RSA key encapsulation for symmetric session key distribution
  3. C
    Digital signatures using ECDSA coupled with SHA-256 hashing
  4. D
    Implementation of inline network intrusion prevention system filtering rules

Answer

Ephemeral Diffie-Hellman key exchange to establish Perfect Forward Secrecy
Ephemeral Diffie-Hellman (such as DHE or ECDHE) creates unique, temporary key pairs for every communication session. Because these ephemeral keys are discarded after the session terminates and are never saved to disk or transmitted directly, a future compromise of the server or gateway's long-term private key cannot be used to recalculate or decrypt historical session keys. This property is known as Perfect Forward Secrecy.

Step-by-Step Solution

1
Analyze the core requirement
Identified requirement: Future compromise of a long-term private key must not compromise previously recorded session traffic.
This is the exact definition of Perfect Forward Secrecy (PFS).
2
Evaluate cryptographic primitives for PFS support
Ephemeral key exchanges (such as DHE or ECDHE) derive dynamic session keys for each individual session that are independent of long-term identity keys.
Static asymmetric key transport (e.g., standard RSA key exchange) allows any historical session to be decrypted if the static private key is compromised.
3
Select the mechanism that satisfies PFS
Ephemeral Diffie-Hellman key exchange guarantees that compromise of long-term secrets does not expose past session keys.
Temporary keys generated during the handshake are deleted immediately after the session ends.

Key Concept

Perfect Forward Secrecy (PFS) via Ephemeral Key Exchange
Rate this question

Topics

Cryptographic Concepts and Algorithms

More questions from this topic