Diffie-Hellman Key Exchange and Random Number Generators ECES Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which countermeasure is commonly used to protect Diffie-Hellman key exchange against man-in-the-middle attacks?

   • AUsing a different generator g
   • BAuthenticating the public values with digital signatures
   • CUsing a larger prime modulus
   • DEncrypting the public values with a symmetric cipher
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   In the Diffie-Hellman key exchange, which values are transmitted over the insecure channel?

   • AThe prime modulus and the generator only
   • BThe private keys of both parties
   • CThe shared secret and the private keys
   • DThe public values computed from each party's private key
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security team is evaluating a cloud-based service that generates cryptographic keys. The service runs in a container and relies on /dev/urandom for randomness. Which concern is most relevant?

   • A/dev/urandom is not cryptographically secure.
   • BThe service should use a PRNG instead of /dev/urandom.
   • CThe container must use a hardware RNG to be secure.
   • DThe container may have limited entropy sources, potentially affecting the quality of randomness.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   Two parties are using Diffie-Hellman with a prime p that is not a safe prime (p = 2q+1 where q is prime). Which additional vulnerability might this introduce?

   • AThe shared secret will be the same for all sessions.
   • BThe group may have small subgroups, enabling a small-subgroup confinement attack.
   • CThe generator g may not be primitive.
   • DThe discrete logarithm problem becomes easier.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company is implementing Diffie-Hellman for secure communication between two servers. The servers exchange public values, but an attacker is able to intercept and modify the messages. Which additional step is necessary to ensure that the shared secret is established with the intended peer?

   • AUse a different generator that is not publicly known.
   • BEncrypt the public values with a symmetric key before sending them.
   • CAuthenticate the public values using a digital signature or a pre-shared key.
   • DIncrease the prime size to 4096 bits to make the discrete logarithm problem harder.
   Reveal Solution Discussion Select an answer first