Examkin

Soru

Zorluk: Çok zorCryptographic Concepts and Algorithms

A lead security analyst is reviewing the cryptographic design for an enterprise file storage service. The system must encrypt multi-gigabyte data archives efficiently while ensuring data confidentiality, integrity, and origin authenticity. The engineering team proposes encrypting each entire backup file directly using RSA-4096 asymmetric encryption to achieve confidentiality and non-repudiation in a single operation. Which of the following architectural modifications should the security analyst require to meet both performance and security objectives?

  1. Transition to a hybrid encryption scheme utilizing AES-GCM for bulk file encryption and RSA to encrypt the symmetric data encryption key.Cevap
  2. B
    Replace RSA-4096 with ECC P-384 to encrypt the bulk file payload directly, leveraging elliptic curves for high-speed asymmetric bulk data encryption.
  3. C
    Implement AES-ECB mode for bulk file encryption alongside a SHA-256 hash of the plaintext file to guarantee non-repudiation.
  4. D
    Require client workstations to submit a Certificate Signing Request to the CA before generating symmetric stream keys for archive transfer.

Cevap

The security analyst should require transitioning to a hybrid encryption scheme using AES-GCM for bulk payload encryption and RSA for symmetric key encapsulation.
Directly encrypting large files using asymmetric keys (like RSA or ECC) causes severe performance degradation and failure due to block size constraints. The industry standard solution for bulk data protection is hybrid encryption: a high-speed symmetric algorithm (such as AES-GCM) encrypts the bulk file payload using a randomly generated Data Encryption Key (DEK), and the asymmetric key (RSA) is used solely to encrypt the small DEK. Furthermore, AES-GCM provides Authenticated Encryption with Associated Data (AEAD), ensuring both confidentiality and integrity.

Adım Adım Çözüm

1
Analyze the performance bottleneck of asymmetric encryption on bulk data
Identified that RSA encryption applied directly to multi-gigabyte files introduces massive computational overhead and is practically infeasible due to key size limits.
Asymmetric encryption algorithms are mathematically intensive and restricted to encrypting small blocks of data (such as key material).
2
Evaluate symmetric cipher requirements for bulk encryption
Selected AES in Galois/Counter Mode (AES-GCM) to deliver fast symmetric encryption with built-in authenticated encryption (AEAD).
AES-GCM efficiently provides both data confidentiality and integrity verification within a single pass without needing separate signature overhead for bulk content.
3
Integrate asymmetric key management via hybrid encryption
Encapsulated the ephemeral symmetric Data Encryption Key (DEK) using the recipient's RSA public key.
Hybrid encryption achieves the high performance of symmetric ciphers alongside the key distribution advantages of asymmetric cryptography.

Anahtar Kavram

Hybrid Encryption and Authenticated Symmetric Modes
Bu soruyu puanla

Konular

Cryptographic Concepts and Algorithms

Bu konudan daha fazla soru