A security review of an e-commerce platform's legacy vault database reveals that stored payment tokens are encrypted using the Data Encryption Standard (DES) algorithm operating in Cipher Block Chaining (CBC) mode. Additionally, the system uses a single, hardcoded Initialization Vector (IV) for every database record encryption operation. Which TWO cryptographic weaknesses are present in this architecture? (Select TWO)
- Use of a deprecated cipher with a short key length vulnerable to brute-force attacksCevap
- Reuse of a static Initialization Vector (IV), resulting in predictable ciphertexts for matching plaintext inputsCevap
- CFailure to utilize asymmetric RSA key pairs for bulk data encryption at rest
- DMisconfiguration of database encryption logs as a preventive control rather than a detective control
Cevap
The two cryptographic weaknesses are the reliance on a deprecated cipher with a short key size (DES) and the implementation of a static Initialization Vector (IV) across CBC operations.
The system suffers from two distinct cryptographic flaws: first, DES relies on a legacy 56-bit key size that is vulnerable to key recovery attacks; second, reusing a static IV with CBC mode breaks semantic security, allowing attackers to detect matching plaintext blocks across stored records.
Adım Adım Çözüm
Anahtar Kavram
Cryptographic Weaknesses in Cipher Selection and Mode Implementation