English
Menu

Applied Cryptography

Which of the following is an appropriate measure to increase crypto agility (the property of making cryptographic schemes easy to replace) in system design?

  1. AWrite the cryptographic algorithms and key lengths directly into the program so that nobody can change the settings during operation
  2. BKeep a list of which cryptographic schemes are used where, and make algorithms replaceable through configuration or protocol negotiation
  3. CSince new cryptographic schemes may have defects, keep using only proven schemes that have been in use for more than 20 years
Show answer and explanation

Answer: B. Keep a list of which cryptographic schemes are used where, and make algorithms replaceable through configuration or protocol negotiation

Cryptographic schemes can become insecure as attacks advance, as with MD5, SHA-1 and short-key RSA, and the migration to post-quantum cryptography is another such case. If a scheme is written deep into a program, just finding where it is used takes effort, and replacing it takes many years. Keeping an inventory of which cryptography is used where, including algorithm identifiers in communication and data formats, and making algorithms replaceable through configuration allow migrations to proceed quickly and safely.

  • A. Writing them in directly makes replacement slow when a scheme becomes dangerous. It is the opposite of crypto agility.
  • B. Correct. Both a cryptographic inventory and a design that allows replacement are needed.
  • C. Some old schemes already have known attacks. It is important to be ready to move to new schemes.
Practice this topic Back to topic

Books on Applied Cryptography Ad

As an Amazon Associate I earn from qualifying purchases.

More Applied Cryptography questions

  1. Which of the following correctly describes the difference between block ciphers and stream ciphers among symmetric-key ciphers?
  2. Which of the following is the correct combination of block length and key length for AES, the block cipher widely used today?
  3. Image data were encrypted with AES in ECB mode, and the outline of the original picture could still be recognized in the encrypted image. Which of the following is the cause?
  4. Which of the following is an appropriate way to handle the initialization vector (IV) when using AES in CBC mode?
  5. AES (block length 16 bytes) is used in CBC mode with PKCS#7 padding. In PKCS#7, if n bytes are missing, n bytes of value n are added, and even when the plaintext length is exactly a multiple of 16, 16 bytes of value 16 are added. Which of the following is the length of the ciphertext (not including the IV) when a 96-byte plaintext is encrypted?

Comparisons in this topic