CEH Study Guide - 13 Cryptography

With a rotation of 4, what does erwaiv decrypt to?

• waive

• wave

• answer

• decrypt

Answer explanation

This is a rotation cipher with a key of 4. When you rotate the alphabet by 4, you end up

with e = a, r = n, w = s, and so on. In addition to not being the right decryption, none of the

others have the correct number of letters. In a substitution cipher like a rotation cipher, you

will always have the same number of letters in the output as you do in the input

What do you call a message before it is encrypted?

• Text

• Plain text

• Bare words

• Bare text

Answer explanation

In cryptography, any data or message that is in an unencrypted state is called plaintext.

The output from a cryptographic process is ciphertext. While you may have text as input

to an encryption process, the word text would be ambiguous in this context. The other two

are unrelated to cryptography.

What does PGP use to verify identity?

• Central authority

• Web of users

• Web of trust

• Central trust authority

Answer explanation

Where certificate authorities use a centralized mechanism for verification of users or

certificate subjects, PGP uses a decentralized model. PGP calls this a web of trust, where

individual users sign keys that belong to other people to validate that they are who they say

they are. All of the other answers are made-up terms.

What principle is used to demonstrate that a signed message came from the owner of the key that signed it?

• Non-repudiation

• Non-verifiability

• Integrity

• Authority

Answer explanation

Integrity is part of the CIA triad but isn’t the principle that ties a signed message back

to the subject of the signing certificate. Non-verifiability is nonsense, and authority isn’t

relevant here. Instead, non-repudiation means someone can’t say they didn’t send a message

if it was signed with their key. This assumes the key was in their possession and password

protected, meaning no one else could use it.

What is Diffie-Hellman used for?

• Key management

• Key isolation

• Key exchange

• Key revocation

Answer explanation

Certificates can be revoked but that’s not what Diffie-Hellman is used for. Key

management is a much broader topic than key exchange, which is what Diffie-Hellman is

used for. It is a process that allows two parties to an encrypted conversation to mutually

derive the same key starting with the same base value.

How did 3DES improve on DES?

• Made the key longer

• Used two keys

• Changed algorithms

• Used three keys

Answer explanation

3DES, or Triple DES, uses three keys. The first key is used to encrypt the plaintext. The

second key is used to decrypt the ciphertext resulting from the first round of encryption.

Finally, the third key is used to encrypt the ciphertext that resulted from the decryption

with the second key. The key wasn’t made longer because the 168 bits used in 3DES aren’t

used in a single key. The underlying DES algorithm is still used.

What improvement does elliptic curve cryptography make?

• Smaller keys improve speed

• Algorithm is more complex

• Doesn't use factoring, which is better

• Longer keys

Answer explanation

Algorithms used for elliptic curve cryptography are not more complex, necessarily.

While they don’t use factoring, that fact alone doesn’t necessarily make the algorithms

better. Instead, elliptic curve cryptography relies on the assumption that determining a

discrete logarithm of a point on an elliptic curve can’t be computed in a consistent way. The

keys that result from elliptic key cryptography are actually smaller than those that result

from factoring with large prime numbers

What is it called when two different data sets yield the same cryptographic hash?

• Paradox

• Collision

• Crash

• Unrealistic

Answer explanation

When two different data sets yield the same cryptographic hash, it is called a collision.

It relates to a mathematical problem called the birthday paradox, but two values being the

same is not a paradox. It’s also not unrealistic, nor is it a crash.

Which of the following terms can be used BEST in a description of asymmetric key encryption?

• Private key

• Multifactor

• Public key

• Single factor

Answer explanation

Asymmetric key cryptography uses two related keys. One key is used for encryption and

one is used for decryption. These keys are referred to as the public and private key. Because

it’s the public key that is used to encrypt messages to the owner of the paired private key,

this type of encryption is commonly referred to as public key cryptography. It is neither

single factor nor multifactor since it’s not authentication.

If Alice were to send an email to Bob, what key would she use to encrypt the message?

• PGP key

• Private key

• Public key

• Symmetric key

Answer explanation

Public key cryptography works because the public key can be provided to anyone. The

only thing you can do with the public key is encrypt a message that could be decrypted by

the matched private key. This process uses asymmetric encryption, so it’s not a symmetric

key. The private key has to be with the owner of the key and protected. If that key gets

out, any messages encrypted to the owner by the public key could be decrypted. PGP uses

public/private keys and does not have its own type of key.