Diffie-Hellman Key Exchange and Random Number Generators ECES Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A system administrator is configuring a server that will generate Diffie-Hellman parameters. The server has a hardware RNG that provides a high-entropy seed, but the administrator is concerned about the possibility of the hardware RNG failing silently. Which practice best mitigates this risk?

   • ADisable the hardware RNG and use only a software PRNG to avoid hardware failures.
   • BMix the hardware RNG output with other entropy sources, such as system event timings, and use the mixture to seed a CSPRNG.
   • CUse the hardware RNG as the sole source of entropy and trust it completely.
   • DPeriodically test the hardware RNG by comparing its output to a known pattern.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   An organization is deploying a new authentication service that uses Diffie-Hellman key exchange. The service runs on a virtual machine in a cloud environment. The security team wants to ensure the random number generator provides sufficient entropy. Which approach is most appropriate?

   • AUse a deterministic PRNG seeded with the current time.
   • BUse the operating system's CSPRNG, which gathers entropy from multiple system sources.
   • CUse a simple linear congruential generator (LCG) with a large modulus.
   • DUse a custom PRNG based on the Mersenne Twister for speed.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A security architect is designing a key exchange protocol for a high-security environment. The requirement is to resist man-in-the-middle attacks while also ensuring forward secrecy. Which combination of mechanisms best meets this requirement?

   • AStatic Diffie-Hellman with certificates.
   • BEphemeral Diffie-Hellman without authentication.
   • CEphemeral Diffie-Hellman with signed public keys.
   • DStatic Diffie-Hellman with a pre-shared key.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A developer is choosing a random number generator for a Diffie-Hellman key exchange in a low-power embedded device. The device has a limited entropy source. Which choice best balances security and practicality?

   • AUse a linear congruential generator (LCG) with a large modulus to ensure unpredictability.
   • BUse the device's MAC address as the seed for a PRNG to ensure uniqueness.
   • CUse a Mersenne Twister seeded with a single reading from the device's temperature sensor.
   • DUse a cryptographically secure PRNG (CSPRNG) seeded with a combination of the device's hardware noise and system event timings.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A developer is choosing a random number generator for a cryptographic application. The application requires unpredictable keys. Which type of generator is appropriate?

   • AA cryptographically secure pseudo-random number generator (CSPRNG).
   • BA linear congruential generator (LCG).
   • CThe Mersenne Twister.
   • DA simple counter-based generator.
   Reveal Solution Discussion Select an answer first