Modern Cryptographic Attacks ECES Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A developer stores encryption keys in a configuration file that is committed to the company's source-control repository. You are asked to remediate this issue. What is the best course of action?

   • ARotate the compromised keys and store them in a dedicated secrets-management service with access controls and audit logging.
   • BEncrypt the configuration file with a master password and commit the encrypted file.
   • CRemove the keys from the repository and keep them only in the deployment scripts.
   • DChange the file permissions to read-only for the repository.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is an example of a cache-based side-channel attack?

   • AAn attacker exploits a buffer overflow to overwrite a return address and gain code execution.
   • BAn attacker monitors which parts of the CPU cache are accessed during a cryptographic operation to infer secret data.
   • CAn attacker measures the time it takes for a server to respond to different inputs to deduce a secret key.
   • DAn attacker uses a padding oracle to decrypt ciphertext without the key.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following best describes a version rollback attack?

   • AAn attacker measures the power consumption of a device to recover a secret key.
   • BAn attacker sends a large number of requests to a server to cause a denial of service.
   • CAn attacker intercepts and modifies the protocol negotiation messages to force the use of an older, less secure version.
   • DAn attacker exploits a bug in the random number generator to predict session keys.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A hardware token performs ECDSA signatures, and a researcher demonstrates that the device's power consumption reveals the nonce value used during signing. What is the most effective countermeasure?

   • AAdd a hardware noise generator to mask the power consumption.
   • BUse deterministic ECDSA (RFC 6979) so that the nonce is derived from the message and private key, eliminating the need for a random nonce.
   • CUse a larger ECDSA key size to make the nonce harder to recover.
   • DPerform the signature operation in a shielded enclosure to block electromagnetic emissions.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company's mobile app uses end-to-end encryption for messaging. A security audit reveals that the app's key exchange does not authenticate the server's public key, allowing an attacker to intercept and modify the key exchange. Which attack surface is being exploited, and what is the best countermeasure?

   • ACryptanalysis attack; switch to a different encryption algorithm
   • BSide-channel attack; add random delays to the key exchange
   • CImplementation flaw; use a longer symmetric key
   • DProtocol-level weakness; implement certificate pinning or use an authenticated key exchange like signed ephemeral keys
   Reveal Solution Discussion Select an answer first