Hashing Algorithms (MD5, SHA, RIPEMD, Tiger, Whirlpool) and HMAC ECES Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A developer is implementing an API that uses HMAC-SHA1 for request signing. A security review flags SHA-1 as weak. The developer must update the signing mechanism without breaking existing clients. Which approach best balances security and backward compatibility?

   • ASupport both HMAC-SHA1 and HMAC-SHA256 during a transition period
   • BUse plain SHA-256 without a key
   • CKeep HMAC-SHA1 but add a random nonce to each request
   • DImmediately switch all clients to HMAC-SHA256
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A compliance officer requires that all digital signatures in a new document-management system use a hash function that is not based on the Merkle–Damgård construction. Which hash function should the system use?

   • ASHA-3 (Keccak)
   • BMD5
   • CWhirlpool
   • DSHA-256
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A company is designing a new product that requires a hash function with a 512-bit output and must be resistant to length-extension attacks. The team is considering SHA-512 and Whirlpool. Which statement correctly guides the decision?

   • AUse Whirlpool because it is faster than SHA-512 on all platforms.
   • BUse Whirlpool because it is immune to length-extension attacks by design.
   • CUse SHA-512 because it is a NIST standard and widely supported, but note that it is vulnerable to length-extension attacks if used naively.
   • DUse SHA-512 with HMAC to avoid length-extension attacks.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A penetration tester is assessing a system that uses MD5 for password hashing. The tester finds that two different passwords produce the same MD5 hash. Which security property is directly violated, and what is the most likely impact?

   • ACollision resistance; an attacker could potentially authenticate using a different password that hashes to the same value.
   • BAvalanche effect; the hash function is not producing sufficiently different outputs.
   • CPreimage resistance; an attacker can recover the original password from the hash.
   • DSecond preimage resistance; an attacker can find a different password that hashes to the same value as a given password.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   How does HMAC incorporate a secret key into the hashing process?

   • AThe key is used to encrypt the hash output.
   • BThe key is prepended to the message and hashed once.
   • CThe key is padded and XORed with inner and outer pads, then hashed with the message.
   • DThe key is appended to the message and hashed once.
   Reveal Solution Discussion Select an answer first