9.0 Cryptography CEH Practice Quiz

• A. Symmetric encryption
• B. Asymmetric encryption
• C. Cryptographic hashing
• D. Steganography

Symmetric encryption uses one shared secret key for both encrypting plaintext and decrypting ciphertext. Both the sender and receiver must securely exchange and protect this single key. Common symmetric algorithms include AES, 3DES, Blowfish, and ChaCha20. The primary challenge is secure key distribution, if the key is intercepted, all encrypted communications are compromised.

• A. OpenSSL
• B. Wireshark
• C. Nmap
• D. John the Ripper

OpenSSL is the de facto standard open-source cryptographic library and command-line toolkit, providing implementations of SSL/TLS protocols and a broad range of cryptographic functions. It is used by the majority of HTTPS web servers (via Apache, Nginx, and others), provides the libssl and libcrypto libraries, and offers command-line tools for RSA/ECC key generation, X.509 certificate creation and signing, S/MIME, PKCS operations, and symmetric encryption/decryption.

• A. Symmetric AES-256 encryption, the journalist and whistleblower use the same pre-shared key
• B. Asymmetric encryption, the whistleblower encrypts the document using the journalist's published public key
• C. SHA-256 hashing, the whistleblower hashes the document to create an encrypted version for transit
• D. Block cipher encryption in ECB mode, the whistleblower uses the journalist's private key to encrypt

Asymmetric encryption solves the key distribution problem for unknown parties. The journalist publishes their public key (e.g., on their website or a keyserver). The whistleblower uses this freely available public key to encrypt the document. Only the journalist's corresponding private key (which is never shared) can decrypt it. This enables secure communication without any prior interaction or shared secret.

• A. AES requires a longer key derivation process than proprietary algorithms can implement with 256-bit keys
• B. Proprietary algorithms cannot implement the same block cipher operation modes as AES
• C. Security through obscurity is acceptable for symmetric algorithms only when combined with 512-bit key lengths
• D. Kerckhoffs's Principle states a cryptosystem must remain secure even if everything about it except the key is publicly known, relying on algorithm secrecy as a security property is invalid

Kerckhoffs's Principle (1883) states: 'A cryptosystem should be secure even if everything about the system, except the key, is public knowledge.' A corollary is Shannon's maxim: 'The enemy knows the system.' Proprietary algorithms that rely on secrecy fail this test, if the algorithm is ever reverse-engineered, leaked, or disclosed, security collapses entirely. AES was publicly scrutinized through a 5-year NIST competition involving global cryptanalysis, its security is derived from mathematical properties, not secrecy.

• A. Computing elliptic curve discrete logarithms over a prime finite field
• B. Factoring the product of two large prime numbers into its prime factors
• C. Computing discrete logarithms modulo a large prime (the Diffie-Hellman problem)
• D. Finding a SHA-256 preimage, reversing the hash function to recover the input from a digest

RSA security relies on the Integer Factorization Problem: given n = p × q (where p and q are large prime numbers), it is computationally infeasible to factor n back into p and q with classical computers when n is sufficiently large (2048+ bits). The public key contains n and the public exponent e; the private key derives from the prime factors p and q. Anyone who can factor n can compute the private key.

• A. 128 bits (16 bytes)
• B. 64 bits (8 bytes)
• C. 256 bits (32 bytes)
• D. 512 bits (64 bytes)

AES (FIPS 197) always operates on a fixed 128-bit (16-byte) block size regardless of the key length used. AES supports three key lengths, 128, 192, and 256 bits, which affect the number of encryption rounds (10, 12, and 14 rounds respectively) but never the block size. The block size is a fixed architectural property of the AES substitution-permutation network.

• A. Triple DES (3DES), applies DES three times with three independent 56-bit keys for symmetric encryption
• B. AES-128 in GCM mode, provides authenticated symmetric encryption suitable for IoT
• C. Elliptic Curve Cryptography (ECC), ECDSA-256 provides security equivalent to RSA-2048 with a 256-bit key
• D. Blowfish with a 448-bit key, designed by Bruce Schneier for low-resource environments

NIST's key strength equivalence table shows that a 256-bit ECC key (using ECDSA or ECDH) provides security equivalent to a 3072-bit RSA key, and is far stronger than RSA-2048. ECC operations require significantly fewer CPU cycles and less memory than RSA at equivalent security levels. This makes ECC the preferred asymmetric algorithm for IoT, embedded systems, and smart cards. NIST FIPS 186-5 standardizes ECDSA curves including P-256 and P-384.

• A. Replacing SHA-256 with MD5 to reduce hash computation time for the defender
• B. Encrypting the entire hash database file at rest with AES-128-CBC
• C. Adding a unique random salt to each password before hashing, stored alongside the hash
• D. Encoding stored hashes in Base64 instead of hexadecimal to obscure their format

A salt is a unique, randomly generated value appended or prepended to each password before hashing: hash = SHA-256(password + unique_salt). Since each user has a different salt, an attacker must compute a separate dictionary attack for each salt-hash pair, pre-computed rainbow tables are defeated entirely, and parallel dictionary attacks across all users become infeasible. Salts are stored in plaintext alongside the hash (their purpose is uniqueness, not secrecy).