Encryption: Keeping Secrets in the Digital Age

• A. To make data faster to transmit over networks
• B. To protect the confidentiality, integrity, and authenticity of information ✓
• C. To compress files so they take up less storage space
• D. To detect hardware failures in computer systems

Why: Cryptography is concerned with keeping information secret (confidentiality), ensuring it is not altered (integrity), and verifying who sent it (authenticity). Speed, compression, and hardware diagnostics are not its purpose.

• A. Ciphertext
• B. Hash
• C. Plaintext ✓
• D. Key

Why: Plaintext is the original, readable data. Ciphertext is the scrambled output of encryption, a hash is a fixed-size fingerprint of data, and a key is the secret value used by the algorithm.

• A. Two keys, one public and one private
• B. One key shared by the sender and receiver ✓
• C. No keys, since the algorithm itself is secret
• D. A new key for every bit of the message

Why: Symmetric encryption uses a single secret key for both encryption and decryption, which must be shared securely between the parties. Asymmetric encryption is the approach that uses a key pair.

• A. A cipher should remain secure even if everything about it except the key is public knowledge ✓
• B. Encryption algorithms should be kept secret to maximize security
• C. Longer messages are always easier to encrypt than short ones
• D. A strong cipher only needs to be used once before it must be replaced

Why: Kerckhoffs's principle states that a system's security should depend only on the secrecy of the key, not on the secrecy of the algorithm. Publicly reviewed algorithms are more trustworthy because flaws get discovered and fixed.

• A. Producing a fixed-size fingerprint of data to check integrity ✓
• B. Reversibly encrypting large files quickly
• C. Generating random numbers for games
• D. Sending secret keys over an unsecured channel

Why: A cryptographic hash function turns input of any size into a fixed-size output, and small input changes produce very different outputs, which makes it useful for detecting tampering. Hashes are one-way, so they cannot be reversed to recover the data.

• A. Different keys are used for encryption and decryption
• B. The same key is used for both encryption and decryption ✓
• C. The ciphertext is always the same length as the plaintext
• D. No key is required to encrypt the data

Why: Symmetric encryption uses one shared secret key for both encrypting and decrypting data, unlike asymmetric encryption which uses a key pair.

• A. It encrypts one bit of data at a time
• B. It encrypts fixed-size groups of plaintext bits as a unit ✓
• C. It encrypts variable-length streams of data with no grouping
• D. It hashes data into a fixed-size digest

Why: A block cipher processes data in fixed-size blocks (for example, 128 bits for AES), transforming each block as a unit.

• A. 64 bits
• B. 128 bits ✓
• C. 256 bits
• D. 512 bits

Why: AES always operates on 128-bit blocks, regardless of whether the key length is 128, 192, or 256 bits.

• A. To make the key longer
• B. To increase the speed of encryption
• C. To fill the last block so the plaintext length is a multiple of the block size ✓
• D. To hide the identity of the sender

Why: Block ciphers require complete blocks, so padding adds extra bytes to the final block when the plaintext length is not an exact multiple of the block size.

• A. It is too slow for large files
• B. Identical plaintext blocks produce identical ciphertext blocks, revealing patterns ✓
• C. It cannot be used with symmetric keys
• D. It requires a separate public key for each block

Why: Because ECB encrypts each block independently with the same key, repeated plaintext blocks leak visible patterns in the ciphertext.

• A. The private key
• B. The public key ✓
• C. The session key
• D. The master key

Why: The public key is distributed openly so anyone can use it to encrypt messages or verify signatures, while the corresponding private key is kept secret by its owner.

• A. Alice's private key
• B. Bob's private key
• C. Bob's public key ✓
• D. Alice's public key

Why: Alice encrypts with Bob's public key, so only Bob's private key, which only Bob holds, can decrypt the message.

• A. It is always faster than symmetric encryption
• B. It removes the need to securely share a secret key in advance ✓
• C. It requires no key management at all
• D. It makes messages impossible to intercept

Why: Public key cryptography lets parties communicate securely without first agreeing on a shared secret, solving the key distribution problem. It is generally slower, not faster, and still requires careful key management.

• A. The discrete logarithm problem
• B. The difficulty of factoring large composite numbers ✓
• C. The traveling salesman problem
• D. The halting problem

Why: RSA relies on the fact that multiplying two large primes is easy, while factoring their product back into the original primes is computationally infeasible for sufficiently large numbers.

• A. Hiding the contents of a message from everyone
• B. Speeding up encryption of large files
• C. Verifying the sender's identity and that the message was not altered ✓
• D. Generating random session keys

Why: A digital signature is created with the signer's private key and verified with their public key, providing authentication and integrity rather than confidentiality.

• A. To encrypt data so only the intended recipient can read it
• B. To produce a fixed-size fingerprint of input data that changes if the data changes
• C. To generate random numbers for use as encryption keys
• D. To compress large files into smaller files without losing information

• A. Collision resistance
• B. Avalanche effect
• C. Preimage resistance
• D. Determinism

• A. So that the hash output can be reversed back to the input
• B. So that the same input always produces the same hash output
• C. So that hashes are always the same length regardless of input
• D. So that hash values can be kept secret from attackers

• A. The sender encrypts the hash with the receiver's public key
• B. The sender transmits the hash alongside the message, and the receiver recomputes and compares it
• C. The receiver sends the message back to the sender to confirm the hash
• D. The hash is used to generate a new encryption key for each message

• A. AES
• B. RSA
• C. SHA-256
• D. Diffie-Hellman

• A. To encrypt a message so only the recipient can read it
• B. To verify the authenticity and integrity of a message or document ✓
• C. To compress a file so it takes up less storage space
• D. To hide the sender's identity from the recipient

Why: A digital signature proves who signed a message (authenticity) and that it has not been altered since signing (integrity). It does not by itself hide the content from others.

• A. The sender's public key
• B. The recipient's public key
• C. The sender's private key ✓
• D. The recipient's private key

Why: The sender signs with their private key. Anyone can then verify the signature using the sender's corresponding public key, which is why only the legitimate owner can produce a valid signature.

• A. A password that unlocks an encrypted file
• B. A document that binds a public key to the identity of its owner, issued by a trusted authority ✓
• C. A randomly generated number used once per session
• D. A copy of a user's private key stored on a server

Why: A digital certificate, such as an X.509 certificate, binds a public key to an identity like a person or website. A Certificate Authority (CA) vouches for this binding by signing the certificate.

• A. It encrypts all messages sent over the internet
• B. It stores users' private keys so they can recover lost passwords
• C. It issues and signs digital certificates, vouching that a public key belongs to a specific entity ✓
• D. It generates random session keys for each conversation

Why: A CA is a trusted third party that verifies an entity's identity and issues certificates signed with the CA's own private key. Browsers and operating systems trust a set of root CAs, allowing users to trust certificates issued by them.

• A. The signature is automatically re-signed with the new content
• B. Verification succeeds because the signature is permanent
• C. Verification fails, revealing that the document was altered ✓
• D. The original document is restored from a backup

Why: The signature is computed from a hash of the original content. Any change alters the hash, so the signature no longer matches when verified, which reveals tampering.

• A. To speed up page loading by compressing images
• B. To encrypt data in transit between your browser and the web server ✓
• C. To permanently store your passwords on the website's server
• D. To block all advertisements on the page

Why: TLS (Transport Layer Security) encrypts the data traveling between your browser and the server, protecting it from eavesdroppers on the network. It does not speed up pages, store passwords, or block ads.

• A. A password the user must enter
• B. A digital certificate issued by a trusted Certificate Authority ✓
• C. A list of all previous visitors
• D. A copy of the website's source code

Why: The server presents a digital certificate containing its public key and identity information, signed by a Certificate Authority. The browser verifies this signature against trusted CAs to confirm the server is who it claims to be.

• A. SMTP
• B. POP3
• C. PGP (Pretty Good Privacy) ✓
• D. IMAP

Why: PGP uses public-key cryptography to encrypt message content so only the intended recipient's private key can decrypt it. SMTP, POP3, and IMAP are protocols for sending and retrieving mail and do not, by themselves, encrypt message content.

• A. It deletes emails after they are read
• B. It upgrades an existing plaintext connection to an encrypted TLS connection ✓
• C. It digitally signs every attachment automatically
• D. It blocks emails from unknown senders

Why: STARTTLS allows a mail server to begin an unencrypted session and then negotiate an upgrade to TLS partway through. This protects mail in transit between servers, though it only helps if both servers support it.

• A. End-to-end encryption is faster than TLS
• B. TLS only protects the connection segments, while end-to-end encryption keeps the message encrypted from sender to recipient, even on the mail servers ✓
• C. TLS encrypts only the subject line, while end-to-end encrypts the body
• D. There is no difference; the terms are interchangeable

Why: TLS protects each hop between two machines, but the mail servers along the path can still read the plaintext message. End-to-end encryption ensures that only the sender and recipient hold the keys needed to read the content, so intermediate servers see only ciphertext.

• A. Replay attack
• B. Harvest now, decrypt later ✓
• C. Man-in-the-middle attack
• D. Brute-force attack

Why: Harvest now, decrypt later means attackers collect encrypted data now, betting that future advances such as quantum computers will let them break the encryption. This is why long-lived secrets need quantum-resistant algorithms even before such computers exist.

• A. Intercepting the key while it is being transmitted
• B. Tricking the user into revealing the key
• C. Systematically trying every possible key until the correct one is found ✓
• D. Exploiting a flaw in the encryption algorithm's mathematics

Why: A brute-force attack tries every possible key in the keyspace until one works. Its difficulty depends on key length: longer keys have exponentially more possibilities, which is why 128-bit and 256-bit keys are considered secure against this method.

• A. It makes the ciphertext shorter than the plaintext
• B. It slows down encryption and decryption
• C. It can allow an attacker to recover plaintext by combining two ciphertexts encrypted with the same keystream ✓
• D. It causes the key to be publicly broadcast

Why: In stream ciphers and modes like AES-GCM, reusing a nonce with the same key produces the same keystream. XORing two ciphertexts then cancels the keystream and leaks information about both plaintexts, and in GCM it can even allow forgery of authentication tags.

• A. An attack that breaks the encryption algorithm mathematically
• B. An attack that gains information from physical or observable effects of a system, such as timing, power consumption, or electromagnetic emissions ✓
• C. An attack that sends fake messages to a server
• D. An attack that overloads a network to stop communication

Why: Side-channel attacks ignore the algorithm's mathematics and instead measure leaks from the implementation, such as how long operations take, how much power a chip uses, or sound and electromagnetic emissions. Constant-time coding is a common defense.

• A. To compress data so it transmits faster
• B. To hide the message contents from everyone
• C. To let the receiver verify that a message was not altered and came from someone holding the shared key ✓
• D. To generate random numbers for future sessions

Why: A MAC is computed from the message and a secret key. If the receiver recomputes the MAC and it matches, they know the message was not modified in transit and was produced by a party with the key. A MAC does not by itself hide the message content.