Advanced Cryptography and PKI

1. What is "perfect forward secrecy" (PFS)?

• A. Keeping all keys secret forever
• B. A property ensuring session keys are not compromised even if long-term private keys are later exposed ✓
• C. A type of symmetric encryption
• D. A certificate management technique

💡 PFS generates unique session keys for each session, ensuring past sessions remain secure even if the server's private key is later compromised.

2. What is "homomorphic encryption"?

• A. Encryption that looks the same
• B. Encryption allowing computations to be performed on encrypted data without decrypting it first ✓
• C. A type of symmetric encryption
• D. A quantum-resistant algorithm

💡 Homomorphic encryption enables computation on ciphertext, producing encrypted results that when decrypted match results of operations on plaintext.

3. What is "certificate pinning"?

• A. Displaying certificates on a board
• B. Hardcoding expected certificate information in an application to prevent MITM attacks ✓
• C. A type of certificate renewal
• D. A CA management technique

💡 Certificate pinning embeds expected certificate fingerprints in apps, rejecting connections presenting unexpected certificates even if CA-signed.

4. What does "IV" stand for in encryption?

• A. Internal Variable
• B. Initialization Vector — a random value used with a key to ensure identical plaintexts produce different ciphertexts ✓
• C. Input Value
• D. Integrity Verification

💡 An IV is a random value combined with the encryption key to ensure that encrypting the same plaintext twice produces different ciphertext.

5. What is a "meet-in-the-middle attack"?

• A. A type of MITM attack
• B. A cryptanalytic attack splitting the problem in half and working from both ends simultaneously ✓
• C. A type of birthday attack
• D. A brute force technique

💡 Meet-in-the-middle attacks divide the keyspace, encrypting from one end and decrypting from the other, dramatically reducing the work for double encryption.

6. What is "post-quantum cryptography"?

• A. Cryptography done after quantum computers exist
• B. Developing cryptographic algorithms resistant to attacks from quantum computers ✓
• C. A type of ECC
• D. Quantum key distribution

💡 Post-quantum cryptography develops algorithms (lattice-based, hash-based) that remain secure against quantum computers running Shor's algorithm.

7. What is a "chosen plaintext attack"?

• A. An attack with no information
• B. An attack where the attacker can choose arbitrary plaintexts and observe the resulting ciphertexts to deduce the key ✓
• C. A type of brute force attack
• D. A timing attack

💡 In a chosen plaintext attack, the attacker can encrypt chosen messages and study the outputs to gain information about the encryption key.

8. What is "HMAC"?

• A. Hash Message Authentication Code — combining a hash with a secret key to verify both data integrity and authenticity ✓
• B. A type of symmetric encryption
• C. A digital signature algorithm
• D. A key exchange protocol

💡 HMAC uses a cryptographic hash function combined with a secret key to produce a message authentication code, verifying both integrity and authenticity.

9. What is "cipher block chaining" (CBC) mode?

• A. A type of stream cipher
• B. A block cipher mode where each plaintext block is XORed with the previous ciphertext block before encryption ✓
• C. A type of encryption key
• D. A hashing mode

💡 In CBC mode, each block is XORed with the previous ciphertext block before encryption, ensuring identical plaintext blocks produce different ciphertext.

10. What is a "padding oracle attack"?

• A. Adding extra data to messages
• B. An attack exploiting error messages about decryption padding to decrypt ciphertext without the key ✓
• C. A type of brute force attack
• D. A certificate attack

💡 Padding oracle attacks exploit server responses about invalid padding to iteratively decrypt ciphertext without knowing the key (e.g., POODLE attack).

11. What is the "Diffie-Hellman key exchange"?

• A. A type of symmetric encryption
• B. A cryptographic protocol allowing two parties to establish a shared secret over an insecure channel ✓
• C. A digital signature algorithm
• D. A hashing algorithm

💡 Diffie-Hellman allows two parties to derive a shared secret key over a public channel without ever transmitting the secret itself.

12. What is "threshold cryptography"?

• A. Cryptography with a time limit
• B. A scheme where a secret is split among multiple parties requiring a minimum number to cooperate for decryption ✓
• C. A type of key escrow
• D. A quantum cryptography technique

💡 Threshold cryptography splits cryptographic keys among n parties, requiring at least t parties to cooperate — no single party can decrypt alone.

13. What is "certificate transparency"?

• A. Making all certificates public
• B. A framework requiring CAs to log all issued certificates in public, auditable logs to detect misissued certificates ✓
• C. A type of certificate revocation
• D. A CA security standard

💡 Certificate transparency requires CAs to log all certificates in public CT logs, allowing domain owners and browsers to detect unauthorized certificate issuance.

14. What is a "birthday attack" in cryptography?

• A. Attacking on someone's birthday
• B. Exploiting the birthday paradox to find hash collisions with fewer computations than brute force ✓
• C. A type of brute force attack
• D. A social engineering attack

💡 Birthday attacks exploit the statistical birthday paradox — finding two inputs with the same hash (collision) requires far fewer attempts than finding a specific hash.

15. What is "tokenization" in data security?

• A. Creating authentication tokens
• B. Replacing sensitive data with non-sensitive placeholder tokens while storing actual data in a secure vault ✓
• C. A type of encryption
• D. A hashing technique

💡 Tokenization replaces sensitive data (credit card numbers) with meaningless tokens — the actual data stays in a secure token vault.

16. What is "key stretching"?

• A. Making encryption keys longer
• B. Using algorithms like PBKDF2 or bcrypt to make password hashing computationally expensive and resistant to brute force ✓
• C. A type of key exchange
• D. Extending key expiry dates

💡 Key stretching applies computationally expensive transformations to passwords, making brute force and dictionary attacks impractical.

17. What is "quantum key distribution" (QKD)?

• A. Distributing keys via the internet
• B. Using quantum mechanical properties to distribute encryption keys with theoretically unbreakable security ✓
• C. A type of post-quantum cryptography
• D. A key storage technique

💡 QKD uses quantum mechanics (photon polarization) to distribute keys — any eavesdropping disturbs the quantum state, revealing the interception.

18. What is "elliptic curve cryptography" (ECC)?

• A. A type of symmetric encryption
• B. A public-key cryptography approach using elliptic curves offering smaller keys with equivalent security to RSA ✓
• C. A hashing algorithm
• D. A type of digital signature only

💡 ECC achieves equivalent security to RSA with much smaller key sizes (256-bit ECC ≈ 3072-bit RSA), making it efficient for mobile and IoT.

19. What is "OCSP stapling"?

• A. Stapling certificates to documents
• B. A TLS extension allowing servers to include a time-stamped OCSP response proving certificate validity without client querying ✓
• C. A type of certificate pinning
• D. A CA validation method

💡 OCSP stapling lets servers include a signed OCSP response in the TLS handshake, improving privacy and performance of certificate revocation checking.

20. What is the "RSA problem"?

• A. A general computing problem
• B. The mathematical difficulty of factoring the product of two large prime numbers — the basis of RSA security ✓
• C. A type of elliptic curve problem
• D. A hashing problem

💡 RSA security relies on the computational difficulty of factoring the product of two large primes. Quantum computers could break this using Shor's algorithm.