I85PREP
⌘ K
EECC study materials
EECC study resources

EECC practice questions

One question at a time. Build your EECC understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Introduction to Cryptography and Encryption

In a symmetric encryption scheme, which property must the sender and receiver share before any ciphertext can be exchanged?

  1. A digital signature
  2. A public key certificate
  3. A hash digest of the plaintext
  4. A common secret key Correct answer.

Explanation

Symmetric encryption requires both parties to hold the same secret key, which is used for both encryption and decryption. Without that shared secret, the receiver cannot recover the plaintext. Public key certificates and signatures belong to asymmetric systems.

Question 2Introduction to Cryptography and Encryption

Which statement correctly distinguishes hashing from encryption?

  1. Hashing is reversible with the right key, whereas encryption is always one-way.
  2. Hashing requires a shared secret key, while encryption never uses keys.
  3. Hashing and encryption both guarantee confidentiality of the original message.
  4. Hashing produces a fixed-length digest and is designed to be one-way, while encryption is reversible with a key. Correct answer.

Explanation

A cryptographic hash maps any input to a fixed-length digest and is intentionally infeasible to invert. Encryption, by contrast, is a reversible transformation whose inverse requires the correct key. This is why hashes support integrity checks rather than confidentiality.

Question 3Introduction to Cryptography and Encryption

A cipher transforms the plaintext 'HELLO' by replacing each letter with the letter three positions later in the alphabet. Which classical cipher is being used?

  1. Vigenere cipher
  2. Playfair cipher
  3. One-time pad
  4. Caesar cipher Correct answer.

Explanation

A fixed uniform shift of the alphabet, here by three positions, is the defining feature of the Caesar cipher. The Vigenere and Playfair ciphers use keys or digraph rules that vary the substitution. The one-time pad requires a random key as long as the message.

Question 4Introduction to Cryptography and Encryption

What is the key length in bits of the AES-128 algorithm?

  1. 56
  2. 256
  3. 128 Correct answer.
  4. 512

Explanation

AES is defined with three key sizes: 128, 192, and 256 bits. The name AES-128 specifically denotes the 128-bit key variant. The 56-bit figure refers to DES, and 256 bits belongs to AES-256.

Question 5Introduction to Cryptography and Encryption

In asymmetric cryptography, which key does a sender use to encrypt a message intended only for a specific recipient?

  1. The sender's public key
  2. The recipient's private key
  3. The sender's private key
  4. The recipient's public key Correct answer.

Explanation

To ensure only the intended recipient can read the message, the sender encrypts with the recipient's public key. Only the matching private key, held by the recipient, can decrypt it. Using the sender's keys would not restrict confidentiality to the recipient.

Question 6Introduction to Cryptography and Encryption

Which mode of operation turns a block cipher into a stream-like cipher by encrypting a counter and XORing the result with the plaintext?

  1. Cipher Feedback with full block (CFB)
  2. Cipher Block Chaining (CBC)
  3. Electronic Codebook (ECB)
  4. Counter (CTR) mode Correct answer.

Explanation

CTR mode encrypts successive counter values with the block cipher and XORs the keystream with the plaintext, allowing parallel processing and random access. CBC chains ciphertext blocks and requires sequential processing. ECB encrypts each block independently without a counter.

Question 7Introduction to Cryptography and Encryption

A company wants to verify that a downloaded file has not changed in transit. Which cryptographic primitive is the most direct choice?

  1. A symmetric block cipher in ECB mode
  2. A Caesar cipher
  3. A cryptographic hash such as SHA-256 Correct answer.
  4. A Diffie-Hellman exchange

Explanation

A cryptographic hash produces a digest that changes if any bit of the file changes, so comparing digests detects tampering. Diffie-Hellman establishes shared keys but does not by itself verify file integrity. A cipher conceals content rather than checking it.

Question 8Introduction to Cryptography and Encryption

Which property of a cryptographic hash function ensures it is computationally infeasible to find two different inputs producing the same digest?

  1. Collision resistance Correct answer.
  2. Perfect forward secrecy
  3. Preimage resistance
  4. Key agility

Explanation

Collision resistance specifically addresses the difficulty of finding any two distinct inputs with the same hash output. Preimage resistance concerns reversing a given digest to its input. Key agility and forward secrecy are properties of key management, not of hash functions.

Question 9Introduction to Cryptography and Encryption

Two parties use the Diffie-Hellman key exchange over an insecure channel. What is the primary purpose of this protocol?

  1. To sign each message so the receiver can prove authorship
  2. To encrypt the entire conversation with a static shared password
  3. To compress the plaintext before encryption
  4. To establish a shared secret key without transmitting it directly Correct answer.

Explanation

Diffie-Hellman lets two parties derive a common secret over a public channel without ever sending that secret directly. Each side combines its own private value with the other's public value to reach the same result. It does not provide signatures or data compression.

Question 10Introduction to Cryptography and Encryption

Why is the one-time pad considered information-theoretically secure when used correctly?

  1. Because the key is truly random, as long as the message, and used only once Correct answer.
  2. Because the key is reused across many messages to hide patterns
  3. Because it applies a fixed substitution alphabet to every message
  4. Because it relies on the computational difficulty of factoring large integers

Explanation

With a truly random key equal in length to the message and never reused, the ciphertext gives an attacker no information about the plaintext. This is the basis of Shannon's perfect secrecy. Reusing the key or using a predictable key destroys that guarantee.

Question 11Introduction to Cryptography and Encryption

A developer needs a block cipher mode that provides both confidentiality and built-in authentication of the ciphertext in a single construction. Which mode best fits?

  1. Cipher Block Chaining (CBC) without a MAC
  2. Output Feedback (OFB) mode
  3. Electronic Codebook (ECB)
  4. Galois/Counter Mode (GCM) Correct answer.

Explanation

GCM combines CTR-mode encryption with a Galois field authentication tag, yielding authenticated encryption in one pass. ECB and OFB provide confidentiality only and no integrity protection. Plain CBC likewise lacks authentication unless paired with a separate MAC.

Question 12Introduction to Cryptography and Encryption

What role does a digital signature provide that symmetric encryption alone does not?

  1. It replaces the need for any key management.
  2. It guarantees the plaintext is free of malware.
  3. It provides non-repudiation by binding the message to the signer's private key. Correct answer.
  4. It reduces the ciphertext size.

Explanation

A digital signature is created with the signer's private key and verified with the corresponding public key, so the signer cannot later deny having signed. Symmetric encryption provides confidentiality but not non-repudiation because both parties share the same key. Signatures do not shrink data or eliminate key management.

Question 13Introduction to Cryptography and Encryption

In RSA, which mathematical problem is believed to make recovering the private key from the public key infeasible?

  1. Solving linear congruences with a single unknown
  2. Integer factorization of the modulus Correct answer.
  3. Finding hash collisions
  4. Discrete logarithm over elliptic curves

Explanation

RSA security rests on the difficulty of factoring the product of two large primes that forms the modulus. The private exponent depends on that factorization. Elliptic curve discrete logarithms underpin ECC, not RSA.

Question 14Introduction to Cryptography and Encryption

An organization stores user passwords as unsalted SHA-256 digests. Which improvement most directly defends against precomputed rainbow-table attacks?

  1. Adding a unique random salt to each password before hashing Correct answer.
  2. Switching from SHA-256 to MD5
  3. Using a longer password minimum length
  4. Encrypting the digest with AES

Explanation

A unique random salt per password forces attackers to recompute tables for each user, defeating precomputed rainbow tables. Encrypting the digest with a key stored alongside it adds little protection. MD5 is weaker than SHA-256 and would worsen the situation.

Question 15Introduction to Cryptography and Encryption

Which of the following best describes the avalanche effect in a cryptographic hash or block cipher?

  1. The output length grows with the input length
  2. Small changes in input produce large, unpredictable changes in output Correct answer.
  3. Encryption speed doubles with each additional key bit
  4. Identical inputs always produce identical outputs regardless of key

Explanation

The avalanche effect means a tiny input change, such as flipping one bit, should alter roughly half the output bits unpredictably. This property frustrates differential analysis and supports diffusion. It does not describe output length growth or deterministic identity.

Question 16Introduction to Cryptography and Encryption

A protocol uses ephemeral Diffie-Hellman with a fresh key pair per session. Which security benefit does this provide if a long-term private key is later compromised?

  1. It makes the key exchange immune to man-in-the-middle attacks.
  2. It removes the need for authentication entirely.
  3. It provides forward secrecy so past session keys remain protected. Correct answer.
  4. It allows recovery of all past session keys.

Explanation

Ephemeral key pairs are discarded after each session, so compromise of a long-term key does not reveal previously negotiated session keys. This property is known as forward secrecy. It does not by itself authenticate the parties or prevent man-in-the-middle attacks.

Question 17Introduction to Cryptography and Encryption

A message is encrypted with AES-256 in CBC mode and then a separate HMAC-SHA-256 tag is computed over the ciphertext. Which security design does this represent?

  1. Encrypt-and-MAC
  2. Hash-then-sign
  3. Encrypt-then-MAC Correct answer.
  4. MAC-then-Encrypt

Explanation

Computing the MAC over the ciphertext and appending it means the receiver can verify integrity before attempting decryption, which is the Encrypt-then-MAC construction. MAC-then-Encrypt and Encrypt-and-MAC authenticate plaintext or both, exposing different attack surfaces. Hash-then-sign is a signature construction, not a symmetric composition.

Question 18Introduction to Cryptography and Encryption

Given a hash function H, a sender computes H(message) and transmits the message with the digest over an insecure channel. Which weakness does this scheme have?

  1. An attacker can forge any plaintext because hashing is reversible.
  2. The scheme fails because hash functions cannot process long messages.
  3. An attacker who can modify the message can recompute the digest and replace both. Correct answer.
  4. The digest reveals the original message to anyone who intercepts it.

Explanation

An unkeyed hash provides no authentication because anyone can recompute the digest for a modified message. An attacker who alters the message can simply supply a matching new hash. To bind the digest to the sender, the hash must be keyed or signed.

Question 19Introduction to Cryptography and Encryption

Two different plaintext blocks are identical in CBC mode with a random IV. What does an observer learn from the ciphertext blocks?

  1. Nothing, because identical plaintext blocks encrypt to different ciphertext blocks Correct answer.
  2. That the plaintext blocks are identical, because their ciphertext blocks match
  3. The IV, because it is derived from the first plaintext block
  4. The encryption key, because CBC leaks key material for repeated blocks

Explanation

In CBC, each plaintext block is XORed with the previous ciphertext block before encryption, so identical plaintext blocks yield different ciphertext blocks. This avoids the pattern leakage seen in ECB. The IV is transmitted separately and is not derived from plaintext.

Question 20Introduction to Cryptography and Encryption

A system derives an encryption key directly from a user's password using a single fast hash. Why is this practice considered weak?

  1. Because a single hash cannot produce a fixed-length output
  2. Because fast hashes make brute-force and dictionary attacks on passwords cheap Correct answer.
  3. Because hashing a password always produces a key longer than the cipher accepts
  4. Because passwords are already encrypted and cannot be hashed again

Explanation

General-purpose hashes are designed to be fast, so attackers can test enormous numbers of candidate passwords quickly. A password-based key derivation function with a salt and a high work factor is preferred. Double-hashing concerns and output-length limits are not the core problem.

Question 21Symmetric Key Encryption

In a Feistel network, which operation is applied to the left half before it is combined with the right half via XOR?

  1. A bitwise complement
  2. A keyed round function F Correct answer.
  3. A byte permutation
  4. A modular squaring

Explanation

A Feistel round computes L ⊕ F(R, K) and swaps halves, so the left half is XORed with the output of the keyed round function applied to the right half. The round function is the only key-dependent step and need not be invertible. Decryption reuses the same structure with reversed subkey order.

Question 22Symmetric Key Encryption

Which mode of operation turns a block cipher into a stream cipher by encrypting a counter and XORing the result with plaintext?

  1. Counter mode Correct answer.
  2. Cipher Block Chaining
  3. Electronic Codebook
  4. Cipher Feedback

Explanation

Counter mode encrypts successive values of a nonce-based counter and XORs each keystream block with plaintext, giving stream-cipher behavior with random access. CBC and CFB both depend on prior ciphertext, so they chain rather than generate independent keystream blocks. ECB encrypts each block independently with no keystream generation.

Question 23Symmetric Key Encryption

What is the block size of AES as standardized by NIST?

  1. 192 bits
  2. 128 bits Correct answer.
  3. 64 bits
  4. 256 bits

Explanation

AES operates on a fixed 128-bit block regardless of whether the key is 128, 192, or 256 bits. The key size varies among those three lengths, but the state matrix is always 4x4 bytes. Confusing key length with block length is a common error.

Question 24Symmetric Key Encryption

Which property must a cryptographic hash function satisfy to make finding two distinct inputs with the same digest computationally infeasible?

  1. Collision resistance Correct answer.
  2. Preimage resistance
  3. Second preimage resistance
  4. Key recovery resistance

Explanation

Collision resistance means it is infeasible to find any two different inputs producing the same digest. Preimage resistance concerns inverting a given digest, and second preimage resistance concerns finding a different input matching a specified one. Collision resistance is the strongest of these and is broken by birthday attacks sooner than preimage resistance.

Question 25Symmetric Key Encryption

In DES, what is the effective key length after accounting for parity bits in the 64-bit key?

  1. 56 bits Correct answer.
  2. 112 bits
  3. 48 bits
  4. 64 bits

Explanation

DES discards 8 parity bits from the 64-bit key input, leaving a 56-bit effective key used in the key schedule. The parity bits are ignored by the algorithm. This short key length is why DES is no longer considered secure.

Question 26Symmetric Key Encryption

Which AES step provides diffusion by mixing bytes within each column of the state matrix?

  1. SubBytes
  2. AddRoundKey
  3. ShiftRows
  4. MixColumns Correct answer.

Explanation

MixColumns treats each column as a polynomial and multiplies it by a fixed matrix over GF(2^8), spreading each byte's influence across the whole column. SubBytes provides nonlinear byte substitution, ShiftRows permutes bytes across columns, and AddRoundKey injects the round key. Together these give the wide trail diffusion AES relies on.

Question 27Symmetric Key Encryption

Which type of attack exploits the birthday paradox against a block cipher or hash?

  1. Differential cryptanalysis
  2. Meet-in-the-middle collision search Correct answer.
  3. Linear cryptanalysis
  4. Related-key attack

Explanation

Birthday attacks find collisions in roughly 2^(n/2) operations for an n-bit output, and meet-in-the-middle collision search is the classic application. Linear and differential cryptanalysis exploit statistical properties of the round function. Related-key attacks assume the adversary can choose keys with known relationships.

Question 28Symmetric Key Encryption

What is the primary purpose of an initialization vector in CBC mode?

  1. To increase the effective key length
  2. To compress the plaintext before encryption
  3. To authenticate the ciphertext against tampering
  4. To randomize encryption so identical plaintexts yield different ciphertexts Correct answer.

Explanation

An IV ensures that encrypting the same plaintext twice produces different ciphertext, hiding equality of plaintexts. In CBC the IV is XORed with the first plaintext block. The IV is not secret but must be unpredictable and unique per encryption.

Question 29Symmetric Key Encryption

An attacker obtains two ciphertexts encrypted under AES-CTR with the same key and the same nonce. What is the most direct consequence?

  1. The AES key schedule becomes invertible
  2. The block cipher degrades to a linear function
  3. The authentication tag can be forged without the key
  4. The plaintexts can be recovered from the XOR of the ciphertexts Correct answer.

Explanation

Reusing a counter value regenerates the same keystream, so XORing the two ciphertexts cancels the keystream and leaves the XOR of the plaintexts. This reveals structure and often full plaintext. Nonce reuse is therefore catastrophic for CTR and GCM.

Question 30Symmetric Key Encryption

Why is ECB mode unsuitable for encrypting images or structured records?

  1. It cannot process more than one block
  2. It requires a unique IV per block
  3. It expands the ciphertext by one block
  4. Identical plaintext blocks produce identical ciphertext blocks Correct answer.

Explanation

ECB encrypts each block independently, so equal plaintext blocks map to equal ciphertext blocks and patterns remain visible. This leaks structural information about the data. Chaining or counter modes are needed to hide such patterns.

Question 31Symmetric Key Encryption

In two-key triple DES, an attacker with known plaintext-ciphertext pairs can reduce the search effort to roughly 2^112 operations by which method?

  1. Meet-in-the-middle over the two subkeys Correct answer.
  2. Side-channel power analysis
  3. Linear approximation of the S-boxes
  4. Birthday collision search

Explanation

Two-key 3DES uses keys K1 and K2, and meet-in-the-middle search can find them in about 2^112 work rather than 2^112 naive exhaustive search over the pair. This is why two-key 3DES offers only about 112 bits of security. Three independent keys raise the effort to about 2^168.

Question 32Symmetric Key Encryption

Which construction allows a block cipher to produce a message authentication code over arbitrarily long messages?

  1. OFB encryption
  2. CBC encryption with a fixed IV
  3. CFB encryption
  4. CMAC Correct answer.

Explanation

CMAC is a MAC built from a block cipher, processing message blocks in a CBC-like chain with subkey-derived final tweaks. CBC, CFB, and OFB are confidentiality modes; using raw CBC output as a MAC is vulnerable to length-extension and truncation issues that CMAC addresses.

Question 33Symmetric Key Encryption

Why does GCM require that the nonce never repeat under the same key?

  1. Because repetition halves the effective key length
  2. Because repetition causes padding errors
  3. Because repetition changes the block size
  4. Because repetition allows keystream reuse and tag forgery Correct answer.

Explanation

GCM derives both encryption keystream and authentication tag from the nonce, so repeating a nonce under one key reuses keystream and exposes the authentication key. This can allow attackers to forge tags. Nonce uniqueness is therefore mandatory.

Question 34Symmetric Key Encryption

Which property distinguishes a pseudorandom permutation from a pseudorandom function?

  1. A PRP is invertible given the key, while a PRF need not be Correct answer.
  2. A PRF is always invertible
  3. A PRP produces shorter outputs than a PRF
  4. A PRP uses no key material

Explanation

A PRP is a keyed bijection on fixed-length blocks, so it can be inverted with the key, whereas a PRF is not required to be invertible. Block ciphers are modeled as PRPs. The PRP-PRF switching lemma bounds how closely they can be distinguished for random inputs.

Question 35Symmetric Key Encryption

AES key whitening in many implementations is applied by XORing round keys at the start and end. What does this primarily defend against?

  1. Differential fault injection
  2. Nonce reuse in CTR mode
  3. Meet-in-the-middle key recovery
  4. Statistical attacks that exploit the first and last rounds Correct answer.

Explanation

Adding key material before the first and after the last round obscures the input and output of the core rounds, making statistical attacks on the outer rounds harder. It does not prevent fault injection or meet-in-the-middle search. Whitening is standard in AES via the initial AddRoundKey and final round key.

Question 36Symmetric Key Encryption

Which mode provides both confidentiality and integrity in a single standardized construction without a separate MAC?

  1. CBC mode
  2. ECB mode
  3. AES-GCM Correct answer.
  4. OFB mode

Explanation

AES-GCM is an authenticated encryption mode that combines CTR encryption with a GHASH-based tag, providing confidentiality and integrity together. CBC, OFB, and ECB provide only confidentiality. Using them without a MAC leaves ciphertext malleability unaddressed.

Question 37Symmetric Key Encryption

In the AES key schedule for a 256-bit key, how many words make up the expanded key?

  1. 64 words
  2. 44 words
  3. 60 words Correct answer.
  4. 52 words

Explanation

AES-256 expands to 60 32-bit words: 8 words of the original key plus 13 rounds times 4 words. AES-128 gives 44 words and AES-192 gives 52 words. The expansion supplies each round's 128-bit round key.

Question 38Symmetric Key Encryption

Which statement correctly describes the relationship between key size and security in symmetric ciphers?

  1. Security is independent of key size once the cipher is standardized
  2. Security depends only on block size, not key size
  3. Security grows linearly with key bits, so doubling key length doubles resistance
  4. Security grows exponentially, so each added key bit doubles exhaustive-search effort Correct answer.

Explanation

Exhaustive search over an n-bit key requires about 2^n trials, so each additional key bit doubles the work. This exponential growth is why moving from 128 to 256 bits adds enormous margin. Block size separately affects birthday-bound collision resistance.

Question 39Symmetric Key Encryption

What is the main weakness of using a raw hash of a password, such as SHA-256, for password storage?

  1. It is fast and unsalted, enabling fast offline cracking and precomputation Correct answer.
  2. It cannot handle non-ASCII input
  3. It produces variable-length output
  4. It is too slow for servers to compute

Explanation

General-purpose hashes are designed to be fast, so attackers can test billions of guesses per second, and unsalted hashes allow rainbow tables and cross-account comparisons. Password hashing should use a slow, salted KDF such as Argon2 or bcrypt. Salting also prevents identical passwords from producing identical digests.

Question 40Symmetric Key Encryption

A protocol encrypts with AES-CBC and appends HMAC-SHA256 computed over the ciphertext with an independent key. Which property does this construction provide?

  1. Encrypt-and-MAC, authenticating plaintext in parallel
  2. No integrity, since CBC is malleable
  3. MAC-then-Encrypt, hiding the tag inside the ciphertext
  4. Encrypt-then-MAC, giving integrity over the ciphertext before decryption Correct answer.

Explanation

Computing the MAC over the ciphertext and verifying it before decryption is Encrypt-then-MAC, the preferred composition because it rejects tampered ciphertext early and avoids padding-oracle exposure. Encrypt-and-MAC and MAC-then-Encrypt are more vulnerable to chosen-ciphertext attacks. Using independent keys prevents cross-protocol key reuse issues.

Question 41Symmetric Key Encryption

In a Feistel cipher with a 128-bit block, how many bits does the round function operate on per round?

  1. 64 bits Correct answer.
  2. 16 bits
  3. 128 bits
  4. 32 bits

Explanation

A Feistel network splits the block into two equal halves, so a 128-bit block gives 64-bit halves and the round function processes 64 bits. The other half is XORed with the function output. This halving is why Feistel designs need fewer invertible components.

Question 42Symmetric Key Encryption

Why is a 64-bit block cipher such as 3DES risky for high-volume encryption under a single key?

  1. Its IV space is exhausted after 2^16 encryptions
  2. Its S-boxes become linear after 2^16 blocks
  3. Birthday-bound collisions in the block space leak plaintext equality after roughly 2^32 blocks Correct answer.
  4. Its key schedule repeats after 2^32 blocks

Explanation

With a 64-bit block, birthday collisions between ciphertext blocks become likely after about 2^32 blocks, revealing that plaintext blocks matched. This motivates 128-bit blocks for high-volume modes like CBC and GCM. The key schedule does not repeat in this manner.

Question 43Symmetric Key Encryption

An implementation of CBC decryption returns distinct error messages for padding failures versus MAC failures. Which attack does this enable?

  1. A padding-oracle attack that recovers plaintext byte by byte Correct answer.
  2. A fault-injection attack on the S-boxes
  3. A related-key attack on the key schedule
  4. A meet-in-the-middle key search

Explanation

Distinguishable errors let an attacker adaptively modify ciphertext and learn whether padding was valid, recovering plaintext byte by byte. The defense is to verify the MAC before decryption and return uniform errors. Encrypt-then-MAC with constant-time comparison prevents the oracle.

Question 44Symmetric Key Encryption

Which statement best explains why AES's MixColumns combined with ShiftRows achieves strong diffusion?

  1. Each byte affects only its own column across all rounds
  2. SubBytes alone spreads each byte across the entire state
  3. MixColumns spreads bytes within a column and ShiftRows moves them across columns, so changes propagate widely in few rounds Correct answer.
  4. AddRoundKey permutes byte positions to spread changes

Explanation

MixColumns mixes each column while ShiftRows relocates bytes to different columns, so the two steps together propagate a single-byte change across the full state within a few rounds. This is the wide-trail strategy underlying AES's resistance to differential and linear cryptanalysis. SubBytes adds nonlinearity but does not diffuse.

Question 45Symmetric Key Encryption

In counter mode with a 128-bit block, what happens if the counter space is exhausted and wraps around during a single encryption?

  1. The ciphertext becomes undecryptable
  2. Keystream blocks repeat, revealing XOR of plaintext blocks Correct answer.
  3. The key schedule resets automatically
  4. The authentication tag grows in length

Explanation

Wrapping the counter reuses keystream values, so XORing the affected ciphertext blocks cancels the keystream and leaks plaintext relationships. Implementations must bound message length so the counter never repeats. This is why GCM limits plaintext per nonce.

Question 46Symmetric Key Encryption

AES is defined over the state as a 4x4 matrix of bytes. Which statement correctly identifies the block size of AES and how the state maps to it?

  1. AES has a fixed 128-bit block, arranged as 16 bytes in a 4x4 column-major state matrix. Correct answer.
  2. AES uses a 64-bit block, arranged as an 8-byte state filled with the key schedule.
  3. AES uses a 128-bit block but pads it to 256 bits before the first SubBytes step.
  4. AES has a variable block size that matches the key length, so AES-256 uses a 256-bit block.

Explanation

The AES standard fixes the block length at 128 bits regardless of whether the key is 128, 192, or 256 bits. Those 16 bytes are loaded into a 4x4 matrix of bytes, with input bytes filling columns in order. Only the key schedule changes with key size, not the block size.

Question 47Symmetric Key Encryption

A developer must encrypt a long stream of data with AES in CTR mode using a single key. Which practice keeps the keystream unique across the whole message?

  1. Reset the counter to zero at the start of every message while keeping the nonce fixed.
  2. Choose a fresh random nonce per message and increment the counter block for each successive block. Correct answer.
  3. XOR the plaintext with the previous ciphertext block before applying the counter keystream.
  4. Reuse the same starting counter value for every message so decryption is simpler.

Explanation

CTR security depends on never producing the same keystream block twice under one key. A per-message nonce combined with a counter that increments for each block guarantees distinct counter blocks. Reusing a nonce or restarting the counter under a fixed nonce causes keystream reuse and catastrophic plaintext recovery.

Question 48Symmetric Key Encryption

An engineer compares AES-128 with AES-256 for resistance to exhaustive key search. Which statement is the most accurate?

  1. AES-256 raises the exhaustive-search work to about 2^256, but related-key and biclique-style analyses show reduced margins relative to the ideal. Correct answer.
  2. AES-256 is weaker than AES-128 against brute force because its longer key schedule introduces fixed points.
  3. AES-128 and AES-256 offer identical security because both use ten rounds of the same round function.
  4. AES-256 is exactly twice as strong as AES-128 because it uses twice as many key bits in each round.

Explanation

Exhaustive search against AES-256 is on the order of 2^256 operations, so it is far beyond feasible. Published cryptanalytic results, notably biclique and related-key attacks, reduce the theoretical margin for AES-256 more than for AES-128, though neither breaks the cipher in practice. Security does not scale linearly with key bits, and round counts differ between the variants.

Question 49Symmetric Key Encryption

A protocol builds a MAC from a block cipher by encrypting the message with CBC mode using a key K1 and then encrypting only the final block again with a separate key K2. Which construction is described and what does the second encryption add?

  1. GMAC, where the second key provides the GHASH multiplication key for authentication.
  2. CBC-MAC with an extra final encryption, forming CMAC-style processing that strengthens the tag against length-extension and forgery concerns of plain CBC-MAC. Correct answer.
  3. Counter-mode MAC, where the second key encrypts the counter to produce a fresh keystream each message.
  4. Poly1305-AES, where the second key is the one-time pad applied to the message before hashing.

Explanation

Encrypting the last CBC block under a second key is the classic way to harden CBC-MAC, and CMAC generalizes this idea with subkey derivation for variable-length messages. Plain CBC-MAC is vulnerable when messages of different lengths share a key. The extra processing does not turn the scheme into a counter-mode, GHASH, or Poly1305 construction.

Question 50Symmetric Key Encryption

A system must encrypt many short records under one long-lived key and also detect tampering. The designers propose AES-CBC with a random IV per record, followed by HMAC-SHA256 computed over the IV and ciphertext with an independent key. Which assessment is most defensible?

  1. The construction is broken because CBC requires the IV to be secret, so including it in the MAC input leaks the key.
  2. The construction is sound and needs no further measures, since authenticating each record also guarantees freshness and ordering.
  3. Encrypt-then-MAC over IV and ciphertext is sound, but the design must also handle record reordering and replay, which the MAC alone does not prevent. Correct answer.
  4. The construction is broken because HMAC-SHA256 cannot be computed over ciphertext produced by a block cipher.

Explanation

Computing the MAC over the IV and ciphertext is the encrypt-then-MAC order and lets the receiver reject forged records before decrypting. However, per-record integrity does not bind records to a position or session, so an attacker can reorder, drop, or replay whole records unless sequence numbers or a transcript MAC are added. The IV is public and HMAC accepts arbitrary byte strings, so those objections do not hold.