English
Menu

Applied Cryptography

Learn with multiple-choice questions, including calculations: block and stream ciphers, AES, modes of operation (ECB, CBC, CTR and GCM), initialization vectors and nonces, padding oracle attacks, key length and brute-force effort, SHA-2 and SHA-3, length extension attacks and HMAC, birthday-attack calculations, key derivation functions, RSA and Diffie–Hellman key exchange worked through with small numbers, elliptic-curve key lengths, forward secrecy, certificate authorities and certificate chains, Certificate Transparency, TLS 1.3, 0-RTT and replay, mutual TLS, Grover's algorithm and key length, ML-KEM, ML-DSA and SLH-DSA, hybrid key exchange, HSMs, envelope encryption, key rotation and crypto agility.

Practice 10 questionsRandom questions from this topic · about 5 minutes Practice this topicAll questions in this topic, in random order Weak questionsRetry only the questions you last got wrong

Applied Cryptography: key points

A secure algorithm alone does not make cryptography useful. Mistakes in how it is used, such as reusing a nonce, encrypting in ECB mode or failing to check the host name on a certificate, can easily break even strong cryptography. This topic goes one level deeper into how cryptography is combined and used inside real systems and protocols.

It starts with symmetric-key cryptography: block and stream ciphers, the block and key lengths of AES, modes of operation (ECB, CBC, CTR and GCM) and the requirements on initialization vectors and nonces, padding and padding oracle attacks, and authenticated encryption (AEAD), checking by calculation how plaintext leaks when a nonce is reused in CTR mode. It continues with SHA-2 and SHA-3, length extension attacks and HMAC, the limits of 64-bit blocks under the birthday attack, and key derivation functions, then works through RSA and Diffie–Hellman key exchange with small numbers to examine the discrete logarithm problem, man-in-the-middle attacks, guideline key lengths for elliptic-curve cryptography, forward secrecy and the handling of the random number in ECDSA. The second half covers certificate authorities and certificate chains, host name checks, Certificate Transparency, the changes and cipher suites of TLS 1.3, replay with 0-RTT and mutual TLS, and, for post-quantum cryptography, Grover's algorithm and key length, ML-KEM, ML-DSA and SLH-DSA standardized in August 2024, key encapsulation mechanisms, hybrid key exchange and how to think about the timing of migration. It ends with key management: HSMs, envelope encryption, key rotation and crypto agility. It helps with the security sections of IT certification exams such as Japan's Applied Information Technology Engineer Examination and Registered Information Security Specialist Examination. The values in the calculation questions, including those of the wrong choices, have been checked by computing them in Python. The basics of symmetric-key and public-key cryptography, counting keys, the properties of hash functions and password storage, and the difference between digital signatures and MACs are covered in "Information Security Basics"; side-channel attacks and constant-time implementation, AES-NI, TPMs and true random number generators in "Hardware Security"; Shor's algorithm and the scale of quantum computers in "Quantum Computing Hardware"; the number of round trips in TLS and what HTTPS protects in "Computer Networking Basics"; JWT and OAuth in "Web Technology Basics"; and entropy in "Information Theory and Coding Basics".

All Applied Cryptography questions (40)
  1. Which of the following correctly describes the difference between block ciphers and stream ciphers among symmetric-key ciphers?
  2. Which of the following is the correct combination of block length and key length for AES, the block cipher widely used today?
  3. Image data were encrypted with AES in ECB mode, and the outline of the original picture could still be recognized in the encrypted image. Which of the following is the cause?
  4. Which of the following is an appropriate way to handle the initialization vector (IV) when using AES in CBC mode?
  5. AES (block length 16 bytes) is used in CBC mode with PKCS#7 padding. In PKCS#7, if n bytes are missing, n bytes of value n are added, and even when the plaintext length is exactly a multiple of 16, 16 bytes of value 16 are added. Which of the following is the length of the ciphertext (not including the IV) when a 96-byte plaintext is encrypted?
  6. A server receiving data encrypted in CBC mode returned different errors when the padding after decryption was incorrect and when the padding was correct but the check of the contents failed. Which of the following correctly describes this situation?
  7. Which of the following correctly describes a feature of CTR mode (counter mode) of a block cipher?
  8. In CTR mode, two messages were mistakenly encrypted with the same key and the same nonce. For the byte at one position, the first plaintext P₁ is 01001000 (ASCII "H"), its ciphertext C₁ is 01110100 and the second ciphertext C₂ is 01010101. If the attacker knows P₁, which of the following is the second plaintext P₂ at the same position?
  9. Which of the following does authenticated encryption (AEAD) such as AES-GCM provide in a single operation?
  10. Which of the following correctly describes the 96-bit nonce (IV) used in AES-GCM?
  11. On a certain machine, a brute-force search trying every 56-bit key takes about 20 hours. Which of the following is closest to the time the same machine needs to try every 64-bit key?
  12. Which of the following correctly describes the hash functions SHA-2 and SHA-3?
  13. Using the hash SHA-256(K ‖ m) of a secret key K concatenated with a message m as a tag for detecting tampering is considered dangerous. Which of the following is the reason?
  14. Let 1 GiB = 2³⁰ bytes and 1 EiB = 2⁶⁰ bytes. A block cipher with a 64-bit block (such as 3DES) is used in CBC mode to encrypt a large amount of data under one key. Treating the ciphertext blocks as random 64-bit values, which of the following is the approximate amount of data at which, by the birthday paradox, the probability that a pair of identical ciphertext blocks appears can no longer be ignored?
  15. In protocols such as TLS 1.3, the shared secret obtained from an ECDHE key exchange is not used directly as an encryption key; instead keys are made by passing it through a key derivation function (KDF) such as HKDF. Which of the following is an appropriate reason?
  16. The mechanism of RSA is checked with small numbers. From the primes p = 5 and q = 11, n = pq is formed, and the public exponent is e = 3. With φ(n) = (p − 1)(q − 1), which of the following is the private exponent d (0 < d < φ(n)) that satisfies e × d ≡ 1 (mod φ(n))?
  17. In RSA, let the public key be n = 55 and e = 3. Which of the following is the ciphertext c when the plaintext m = 7 is encrypted as c = m^e mod n?
  18. Which of the following correctly describes a problem with using textbook RSA (computing c = m^e mod n directly from the plaintext m) without padding in real communication?
  19. In Diffie–Hellman key exchange, a prime p and a generator g are public; A and B choose secret values a and b and send each other g^a mod p and g^b mod p. Which of the following is the reason an eavesdropper is believed unable to find the shared secret g^(ab) mod p even after seeing all these public values?
  20. Diffie–Hellman key exchange is checked with small numbers. Let p = 23 and g = 5; A chooses the secret value a = 6 and B the secret value b = 15. A sends A = g^a mod p and B sends B = g^b mod p. Which of the following is the shared secret the two obtain?
  21. Which of the following is the correct combination of a weakness of Diffie–Hellman key exchange without authentication and its countermeasure?
  22. In the table of NIST SP 800-57, which of the following is the combination of RSA key length (the number of bits of n) and elliptic-curve key length given as the guideline for security comparable to a 128-bit symmetric-key cipher (AES-128)?
  23. In TLS, which of the following key exchange methods provides the property that previously recorded communications cannot be decrypted even if the private key of the server certificate leaks later (forward secrecy)?
  24. In ECDSA digital signatures, a secret random number k is used for each signature. Which of the following correctly describes how k must be handled?
  25. Which of the following correctly describes the certificate chain when a browser validates a web server's certificate?
  26. In TLS certificate validation, besides the chain of signatures and the validity period, the client checks that the host name it is connecting to is included in the SAN (subject alternative name) of the certificate. Which of the following is the reason this check is indispensable?
  27. Which of the following correctly describes the mechanism of Certificate Transparency (CT)?
  28. Which of the following correctly describes a change from TLS 1.2 in TLS 1.3 (RFC 8446)?
  29. Which of the following is the correct combination of what the TLS 1.3 cipher suite TLS_AES_128_GCM_SHA256 specifies?
  30. Which of the following is a correct caution about 0-RTT in TLS 1.3 (sending "early data" together with the first message, using a pre-shared key obtained in an earlier connection)?
  31. Which of the following correctly describes mutual TLS (mTLS)?
  32. Searching for the key of an n-bit symmetric-key cipher with Grover's algorithm on a quantum computer is said to take about 2^(n/2) computations. Using this simple guideline, which of the following is closest to the security of AES-128 against quantum computers?
  33. Which of the following correctly pairs the post-quantum cryptography standards published by the US NIST in August 2024 with their types?
  34. Which of the following correctly describes how a key encapsulation mechanism (KEM) such as ML-KEM is used?
  35. Which of the following correctly describes the idea of hybrid key exchange, used during the migration to post-quantum cryptography, that combines X25519 (Diffie–Hellman key exchange using an elliptic curve) with ML-KEM?
  36. One way to think about when to migrate cryptography is "if the number of years x for which data must be kept secret plus the number of years y the migration to new cryptography takes exceeds the number of years z until a quantum computer able to break the cryptography appears, there is already a danger" (Mosca's inequality). With x = 10 years, y = 5 years and z assumed to be 12 years, which of the following is the correct judgment?
  37. Which of the following correctly describes the role of an HSM (hardware security module)?
  38. Let DEK be a data encryption key and KEK a key encryption key. Which of the following correctly describes envelope encryption, as used in cloud storage and elsewhere?
  39. Which of the following is the main purpose of key rotation, replacing a cryptographic key with a new one at regular intervals?
  40. Which of the following is an appropriate measure to increase crypto agility (the property of making cryptographic schemes easy to replace) in system design?

Comparisons in this topic

Books on Applied Cryptography Ad

As an Amazon Associate I earn from qualifying purchases.

Other topics in Computer systems