Examkin

Soru

Zorluk: OrtaCryptographic and Security Control Weaknesses

A financial enterprise archives encrypted network packet captures of client communications for long-term compliance auditing. During a security review, an analyst notes that the legacy web application server is configured to prioritize static RSA key exchange cipher suites (such as TLS_RSA_WITH_AES_256_GCM_SHA384). If an adversary obtains the server's private key at a future date, which of the following security control weaknesses poses the greatest threat to the archived data?

  1. Lack of perfect forward secrecy, enabling retroactive decryption of recorded sessionsCevap
  2. B
    Failure to utilize asymmetric algorithms for encrypting the payload data during transit
  3. C
    Misclassifying the private key key-store as a compensating control rather than a deterrent control
  4. D
    Over-reliance on network perimeter firewalls to prevent Certificate Signing Request (CSR) tampering

Cevap

Lack of perfect forward secrecy, enabling retroactive decryption of recorded sessions
In static RSA key exchange cipher suites, the client encrypts the pre-master secret with the server's public key. If an attacker records the encrypted traffic and later gains access to the server's private key, they can decrypt the pre-master secret and derive the session key for every archived session. Implementing cipher suites that support Perfect Forward Secrecy (PFS)—such as those using Ephemeral Elliptic Curve Diffie-Hellman (ECDHE)—ensures that a compromised long-term private key cannot be used to decrypt past communications.

Adım Adım Çözüm

1
Analyze the cipher suite specification
Identified the use of standard RSA key exchange (TLS_RSA_WITH_AES_256_GCM_SHA384) without ephemeral Diffie-Hellman key exchange (DHE/ECDHE).
Static RSA key exchange relies directly on the server's static private key to encrypt or exchange secret session material.
2
Evaluate the risk of private key compromise against recorded traffic
Determined that possessing the server's static private key allows deriving the master secret for any recorded handshake using that key.
Without Perfect Forward Secrecy (PFS), session keys are mathematically linked to the long-term private key.
3
Identify the required cryptographic control
Selected Perfect Forward Secrecy (PFS) via ephemeral Diffie-Hellman key agreement (e.g., ECDHE) as the necessary mitigation.
PFS generates unique, temporary session keys for each connection that cannot be derived retroactively even if the long-term server key is compromised.

Anahtar Kavram

Perfect Forward Secrecy (PFS) and Cipher Suite Weaknesses
Bu soruyu puanla

Konular

Cryptographic and Security Control Weaknesses

Bu konudan daha fazla soru