PROBLEM 3 - Cryptography Fundamentals (20 points) (5 pts each) a) Which of the f

Question

PROBLEM 3 - Cryptography Fundamentals (20 points)
(5 pts each)

a) Which of the following would a security administrator use to encrypt transmissions from an internal database to an internal server, keeping in mind that the encryption process must add as little latency to the process as possible?
A) ECC
B) RSA
C) SHA
D) 3DES

b) Which of the following should be the first step when a new Certificate Signing Request (CSR) has to be submitted to a Certificate Authority (CA)?
A) Generate a new private key based on AES.
B) Generate a new private key based on RSA.
C) Generate a new public key based on AES.
D) Generate a new public key based on RSA.

c) Ann wants to send a secure encrypted email to Joe, and wants to ensure that Joe can verify that she sent it. Which of the following does Joe need to verify the certificate that Ann used in this process is valid?
A) Ann’s public key
B) Ann’s private key
C) Joe's private key
D) Joe's public key
E) The CA’s private key
F) The CA’s public key

d) When a user needs to provide message authenticity, in the absence of a secure channel, what options may be the best?
A) Send a digital signature of the message to the recipient
B) Encrypt the message with a symmetric algorithm and send it
C) Create a checksum, append it to the message, encrypt the message, then send it to the recipient
D) Encrypt the message with a private key so the recipient can decrypt with the corresponding public key

Explanation / Answer

a)Answer:

D) 3DES

Explanation:

3DES would be less secure compared to ECC, but 3DES would require less computational power.
Triple-DES (3DES) is a technological upgrade of DES. 3DES is still used, even though AES is the preferred
choice for government applications. 3DES is considerably harder to break than many other systems, and
it’s more secure than DES. It increases the key length to 168 bits (using three 56-bit DES keys).

b)Answer:

B) Generate a new private key based on RSA.

Explanation:

Before creating a CSR, the applicant first generates a key pair,keeping the private key secret. The private key is needed to produce, but it is not part of, theCSR. The private key is an RSA key. The private encryption key that will be used to protectsensitive information. Note: A CSR or Certificate Signing request is a block of encrypted textthat is generated on the server that the certificate will be used on. It contains information thatwill be included in your certificate such as your organization name, common name (domainname), locality, and country. It also contains the public key that will be included in yourcertificate. A private key is usually created at the same time that you create the CSR.

c)Answer:

F) The CA’s public key

Explanation:

Joe would verify Ann’s certificate is valid by querying theCertificate Authority (CA) that issued Ann’s certificate and the CA’s public certificateincludes the CA’s public key. Ann would use a digital signature to provide verification thatshe sent the message. Ann would encrypt the digital signature with her private key and Joewould decrypt the digital signature with Ann’s public key. The CA’s private key remainsprivate. Joe’s keys are not used for Ann’s digital signature, but might be used for theencryption of the email.

d)Answer:

D) Encrypt the message with a private key so the recipient can decrypt with the corresponding public key

Explanation:

If a sender were to encrypt a message with his own private key,anyone who has the sender’s public key can decrypt the message. But, since only the senderhas the sender’s private key, only the sender could have sent the message, hence proving theauthenticity of the message, i.e., the message was indeed sent by the sender. A is pointless,without sending the message itself to compare hash results. B has a weakness if the attackerever gets the symmetric key used to encrypt the message. C, while providing integrity, is notpreferred in this case

Related Questions

Navigate

• Browse (All)
• Browse P
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.