A lead security analyst is evaluating enterprise cryptographic controls to remediate vulnerabilities identified in a recent security audit. Match each cryptographic mechanism on the left with its primary operational security objective or implementation purpose on the right.
- Ephemeral Elliptic Curve Diffie-Hellman (ECDHE)Provides Perfect Forward Secrecy (PFS) by generating unique temporary keys for each session, ensuring compromised private keys cannot decrypt past traffic.
- Password-Based Key Derivation Function 2 (PBKDF2)Mitigates offline brute-force attacks against stored credentials by enforcing slow key derivation with salt and repeated iterations.
- Galois/Counter Mode (AES-GCM)Delivers authenticated encryption with associated data (AEAD), offering high-performance symmetric bulk confidentiality along with message integrity.
- Elliptic Curve Digital Signature Algorithm (ECDSA)Provides non-repudiation and origin authenticity by signing data digests with a private key that is validated using the corresponding public key.
Cevap
Ephemeral Elliptic Curve Diffie-Hellman (ECDHE) pairs with providing Perfect Forward Secrecy; PBKDF2 pairs with mitigating offline brute-force attacks on stored credentials; AES-GCM pairs with delivering authenticated encryption (AEAD) providing confidentiality and integrity; and ECDSA pairs with providing non-repudiation and origin authenticity via asymmetric signatures.
Each cryptographic primitive is mapped to its core security objective: ECDHE provides ephemeral session key exchange for Perfect Forward Secrecy; PBKDF2 implements computational key stretching to thwart offline password cracking; AES-GCM delivers authenticated symmetric encryption (AEAD) combining integrity and confidentiality; and ECDSA leverages asymmetric keys to generate digital signatures guaranteeing non-repudiation and origin verification.
Adım Adım Çözüm
Anahtar Kavram
Cryptographic Concepts and Algorithms