Cryptographic Attacks CASENET Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A .NET application uses RSA with a 1024-bit key to sign authentication tokens. A security consultant warns that the key size is insufficient. Which action best addresses the weakness while maintaining compatibility with existing clients?

   • AGenerate a new 2048-bit RSA key, update the server, and coordinate a client rollout before enforcing the new key
   • BUse the same 1024-bit key but rotate it every month
   • CKeep the 1024-bit key but add a longer random salt to the token
   • DImmediately switch to a 4096-bit RSA key and require all clients to update
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security analyst notices that a .NET web application's login endpoint takes measurably longer to respond when the submitted password is longer. The application uses a custom hash function that processes input character by character. Which attack is the analyst observing, and which countermeasure is most appropriate?

   • ATiming side-channel; use a constant-time comparison for password hashes
   • BTiming side-channel; replace the custom hash with a standard constant-time hash like PBKDF2 or bcrypt and use constant-time comparison
   • CBrute-force; add rate limiting to the login endpoint
   • DDictionary attack; enforce a minimum password length
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A .NET application uses a symmetric encryption algorithm with a key that is generated once and reused for all users. The key is stored in a configuration file with read permissions for the application pool account. A security assessment identifies this as a high-risk flaw. Which change should be prioritized?

   • AEncrypt the configuration file with DPAPI.
   • BUse a longer key, such as AES-256 instead of AES-128.
   • CGenerate a unique key per user and store the keys in a secure key management system.
   • DChange the configuration file permissions to read-only for the application pool account.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   A .NET developer uses the DES algorithm with a 56-bit key to encrypt sensitive data. Which cryptographic weakness makes this implementation vulnerable to attack?

   • AWeak algorithm
   • BFlawed implementation
   • CImproper key management
   • DSide-channel leakage
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A .NET developer is encrypting a database column containing customer email addresses. They use the same static initialization vector (IV) for every record and store the encryption key in the same database table as the ciphertext. Which cryptographic weakness does this configuration introduce?

   • AReusing a static IV causes identical plaintexts to produce identical ciphertexts, and storing the key with the data allows an attacker with database access to decrypt everything.
   • BEmail addresses are not sensitive enough to require encryption, so the configuration is acceptable.
   • CThe use of a block cipher in CBC mode is inherently insecure regardless of the IV.
   • DThe key should be stored in the application's web.config file to improve security.
   Reveal Solution Discussion Select an answer first