I85PREP
⌘ K
EUC-EO study materials
EUC-EO study resources

EUC-EO practice questions

One question at a time. Build your EUC-EO understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Introduction to Cryptography and Encryption

Which property of a cryptographic hash function ensures that it is computationally infeasible to find two different inputs producing the same output?

  1. Collision resistance Correct answer.
  2. Preimage resistance
  3. Avalanche effect
  4. Key derivation

Explanation

Collision resistance means no efficient method exists to find two distinct inputs with identical digests. Preimage resistance concerns reversing a single given digest, and the avalanche effect describes output sensitivity to input changes. Key derivation is unrelated to finding matching hash outputs.

Question 2Introduction to Cryptography and Encryption

A symmetric cipher uses the same secret key for both encryption and decryption. Which operational challenge does this create for two parties who have never met?

  1. The algorithm must be kept secret to remain secure
  2. The ciphertext expands beyond the plaintext length
  3. Each message requires a longer key than the last
  4. The key must be distributed securely before any confidential exchange occurs Correct answer.

Explanation

Symmetric systems require both parties to already share the secret key, so secure key distribution is the central problem. Kerckhoffs's principle says the algorithm may be public and only the key is secret. Ciphertext expansion and key growth are not inherent requirements of symmetric ciphers.

Question 3Introduction to Cryptography and Encryption

In an asymmetric key pair used for digital signatures, which key does the signer apply to produce the signature?

  1. The verifier's public key
  2. The signer's private key Correct answer.
  3. The verifier's private key
  4. The signer's public key

Explanation

A digital signature is generated with the signer's private key and verified by anyone holding the signer's public key. Using the verifier's keys would not bind the signature to the signer. This asymmetry provides authentication and non-repudiation.

Question 4Introduction to Cryptography and Encryption

Which mode of operation turns a block cipher into a stream-like construction by encrypting a counter and XORing the result with plaintext, allowing parallel decryption?

  1. Cipher Block Chaining (CBC) mode
  2. Electronic Codebook (ECB) mode
  3. Counter (CTR) mode Correct answer.
  4. Ciphertext Stealing (CTS) mode

Explanation

CTR mode encrypts successive counter values and XORs them with plaintext, so blocks can be processed and decrypted in parallel. CBC chains blocks and requires sequential processing. ECB encrypts blocks independently but leaks patterns, and CTS handles partial final blocks rather than streaming.

Question 5Introduction to Cryptography and Encryption

What is the primary purpose of a cryptographic nonce in an encryption protocol?

  1. To compress the ciphertext before transmission
  2. To ensure freshness so a message cannot be replayed or reused Correct answer.
  3. To permanently archive the key for later recovery
  4. To increase the key length beyond the algorithm's design

Explanation

A nonce is a value used once to guarantee freshness, preventing replay and ensuring unique outputs even with repeated keys. It does not archive keys, extend key length, or compress data. Its uniqueness is what provides the security property.

Question 6Introduction to Cryptography and Encryption

An attacker records an encrypted session and later replays the exact ciphertext to the server, which accepts it as new. Which weakness does this demonstrate?

  1. Use of an insufficiently long RSA modulus
  2. Reliance on a hashed message authentication code
  3. Use of a stream cipher instead of a block cipher
  4. Absence of replay protection such as nonces or timestamps Correct answer.

Explanation

Replay attacks succeed when the protocol lacks freshness mechanisms like nonces, sequence numbers, or timestamps. Modulus length and cipher type do not by themselves prevent replay. A properly applied MAC also does not stop replay unless it covers freshness data.

Question 7Introduction to Cryptography and Encryption

Which statement correctly contrasts hashing with encryption?

  1. Hashing is reversible with a key, while encryption is always one-way
  2. Hashing is one-way and does not use a key to recover the input, while encryption is reversible with the correct key Correct answer.
  3. Both hashing and encryption are always irreversible
  4. Hashing uses a public key, while encryption uses only a private key

Explanation

Cryptographic hashing is designed to be one-way, producing a fixed-length digest that cannot feasibly be reversed to the input. Encryption is reversible by design when the correct key is available. This fundamental difference drives their separate uses in integrity versus confidentiality.

Question 8Introduction to Cryptography and Encryption

Why is ECB mode generally discouraged for encrypting structured data such as images or records?

  1. It cannot process data longer than one block
  2. It is the only mode that provides authenticated encryption
  3. Identical plaintext blocks produce identical ciphertext blocks, revealing patterns Correct answer.
  4. It requires a separate key for every block

Explanation

ECB encrypts each block independently, so repeated plaintext blocks yield repeated ciphertext blocks and leak structural patterns. It can process multi-block data and uses a single key. ECB also does not provide authentication.

Question 9Introduction to Cryptography and Encryption

Which construction provides both confidentiality and integrity by combining encryption with a message authentication code over the ciphertext?

  1. Encrypt-then-MAC Correct answer.
  2. Raw ECB encryption
  3. MAC-then-Encrypt
  4. Encrypt-and-MAC

Explanation

Encrypt-then-MAC computes the MAC over the ciphertext, allowing the receiver to verify integrity before decrypting and resisting certain padding-oracle attacks. MAC-then-Encrypt and Encrypt-and-MAC expose weaknesses in specific settings. Raw ECB provides neither integrity nor authentication.

Question 10Introduction to Cryptography and Encryption

In RSA, which mathematical hard problem underpins the security of key generation?

  1. Integer factorization of the product of two large primes Correct answer.
  2. Finding short vectors in arbitrary lattices
  3. Computing square roots modulo a small prime
  4. Discrete logarithm over elliptic curves

Explanation

RSA security relies on the difficulty of factoring a large modulus that is the product of two large primes. Elliptic-curve discrete logarithms underpin ECC, not RSA. Lattice problems relate to post-quantum schemes, and small primes offer no security.

Question 11Introduction to Cryptography and Encryption

A protocol uses Diffie-Hellman key exchange without authentication. Which attack does this permit?

  1. A downgrade of the block size to zero
  2. A brute-force factorization of the shared secret
  3. A man-in-the-middle substituting his own key shares Correct answer.
  4. A collision attack on the negotiated cipher

Explanation

Unauthenticated Diffie-Hellman lets an active attacker intercept and replace key shares, establishing separate secrets with each party. The shared secret itself is not factored. Collisions and block-size downgrades are separate concerns addressed by other mechanisms.

Question 12Introduction to Cryptography and Encryption

Which characteristic distinguishes a stream cipher from a block cipher?

  1. A stream cipher always requires padding to a fixed block size
  2. A stream cipher uses a different key for every byte
  3. A block cipher cannot be used in a streaming mode
  4. A stream cipher encrypts data one bit or byte at a time using a keystream Correct answer.

Explanation

Stream ciphers generate a keystream and combine it with plaintext incrementally, avoiding block padding. Block ciphers operate on fixed-size blocks and can be adapted to stream-like modes such as CTR. A stream cipher does not require a unique key per byte.

Question 13Introduction to Cryptography and Encryption

Why should an initialization vector (IV) be unpredictable or unique in CBC mode?

  1. To authenticate the message against tampering
  2. To shorten the key required for decryption
  3. To allow the cipher to run without a key
  4. To ensure identical plaintexts produce different ciphertexts across sessions Correct answer.

Explanation

A unique or unpredictable IV prevents identical first blocks from producing identical ciphertexts, hiding equality of plaintexts across sessions. The IV does not shorten keys, authenticate messages, or remove the need for a key. Authentication requires a separate MAC.

Question 14Introduction to Cryptography and Encryption

What does a digital certificate signed by a certificate authority primarily bind together?

  1. A private key and a symmetric session key
  2. A ciphertext and its corresponding plaintext
  3. A hash digest and its preimage
  4. A public key and the identity of its owner Correct answer.

Explanation

A certificate authority signs a certificate that binds a subject's identity to a public key, enabling trust in that key. It does not bind private and session keys, ciphertext to plaintext, or a digest to its preimage. This binding is central to public key infrastructure.

Question 15Introduction to Cryptography and Encryption

A developer stores user passwords by applying SHA-256 once without a salt. Which improvement most directly addresses offline cracking and precomputed tables?

  1. Use a salted, slow password-hashing function such as Argon2 or bcrypt Correct answer.
  2. Encrypt the hash with a shared symmetric key
  3. Switch from SHA-256 to SHA-1 for speed
  4. Truncate the hash to 64 bits to save space

Explanation

Salted, memory-hard or deliberately slow password hashing such as Argon2 or bcrypt defeats precomputed tables and raises the cost of offline guessing. SHA-1 is weaker than SHA-256, symmetric encryption of hashes adds little, and truncation reduces security.

Question 16Introduction to Cryptography and Encryption

Which property must a message authentication code (MAC) provide that a plain checksum does not?

  1. Compression of the message before transmission
  2. Reversibility to recover the original message
  3. Security against forgery by an adversary without the secret key Correct answer.
  4. Detection of accidental transmission errors only

Explanation

A MAC uses a secret key so that an adversary cannot forge a valid tag, whereas a checksum only detects accidental errors and is easily recomputed by anyone. MACs do not compress or reverse messages. This keyed unforgeability is the defining security property.

Question 17Introduction to Cryptography and Encryption

Which statement best describes the role of a key derivation function (KDF) in cryptography?

  1. It verifies certificate revocation status
  2. It generates random prime numbers for RSA
  3. It encrypts bulk data faster than a block cipher
  4. It derives one or more cryptographic keys from a secret such as a password or shared secret Correct answer.

Explanation

A KDF takes a secret input and produces keys suitable for specific algorithms, often with salting and iteration to resist guessing. It does not perform bulk encryption, check revocation, or generate primes. KDFs are central to deriving keys from passwords or shared secrets.

Question 18Introduction to Cryptography and Encryption

In the context of perfect forward secrecy, what property must the key exchange provide?

  1. Compromise of long-term keys does not reveal past session keys Correct answer.
  2. The same session key is reused across all connections
  3. The server's private key is shared with all clients
  4. The session key is stored in plaintext for auditing

Explanation

Perfect forward secrecy ensures that disclosure of long-term keys cannot decrypt previously recorded sessions, typically via ephemeral key exchange. Storing or reusing session keys and sharing private keys all undermine security. Ephemeral Diffie-Hellman is a common way to achieve this property.

Question 19Introduction to Cryptography and Encryption

Which of the following best explains why AES is preferred over DES for modern symmetric encryption?

  1. AES requires no key, while DES requires one
  2. AES supports 128-, 192-, and 256-bit keys, while DES's 56-bit key is too small Correct answer.
  3. AES uses asymmetric keys, while DES uses symmetric keys
  4. AES is a stream cipher, while DES is a block cipher

Explanation

AES offers key sizes of 128, 192, or 256 bits, making brute force infeasible, whereas DES's effective 56-bit key is easily exhausted. Both are block ciphers and both are symmetric. AES also requires a key, so claims otherwise are incorrect.

Question 20Introduction to Cryptography and Encryption

An application needs to verify that a large file has not changed during download. Which primitive is the most appropriate choice?

  1. A cryptographic hash such as SHA-256 Correct answer.
  2. A key exchange such as Diffie-Hellman
  3. A symmetric cipher such as AES-CTR
  4. A password KDF such as Argon2

Explanation

A cryptographic hash produces a fixed-length digest that changes if the file changes, allowing integrity verification when the expected digest is known. Ciphers provide confidentiality, key exchange establishes secrets, and password KDFs derive keys. Hashing is the direct tool for detecting modification.

Question 21Symmetric Cryptography and Block Cipher Modes

In AES, which operation provides nonlinearity and is applied to each byte of the state using a substitution table?

  1. ShiftRows
  2. SubBytes Correct answer.
  3. AddRoundKey
  4. MixColumns

Explanation

SubBytes replaces every byte of the state with a value from the fixed S-box, and this byte-wise nonlinear substitution is the primary source of confusion in AES. The other three steps are linear transformations and cannot by themselves resist linear and differential cryptanalysis.

Question 22Symmetric Cryptography and Block Cipher Modes

Which AES step spreads a single changed byte across all four columns of the state within one round?

  1. ShiftRows
  2. AddRoundKey
  3. MixColumns Correct answer.
  4. SubBytes

Explanation

MixColumns treats each column as a polynomial over GF(2^8) and multiplies it by a fixed matrix, so one altered byte influences every byte of its column. Combined with ShiftRows, which moves bytes between columns, this yields full diffusion across the state after a few rounds.

Question 23Symmetric Cryptography and Block Cipher Modes

How many 32-bit words make up the AES-128 key schedule output used across all rounds, including the initial AddRoundKey?

  1. 44 words Correct answer.
  2. 60 words
  3. 40 words
  4. 52 words

Explanation

AES-128 performs 10 rounds and needs 11 round keys of 4 words each, giving 44 words total. The initial AddRoundKey uses the first four words and each of the 10 rounds consumes four more.

Question 24Symmetric Cryptography and Block Cipher Modes

AES is defined over which algebraic structure for its byte operations such as MixColumns?

  1. The prime field GF(257)
  2. The Galois field GF(2^8) Correct answer.
  3. The integers modulo 255
  4. The ring of 8-bit integers modulo 256

Explanation

AES treats each byte as an element of GF(2^8) defined by the irreducible polynomial x^8 + x^4 + x^3 + x + 1. Arithmetic such as multiplication in MixColumns is performed in this field, which guarantees every nonzero element has a multiplicative inverse.

Question 25Symmetric Cryptography and Block Cipher Modes

Which statement correctly contrasts the AES encryption and decryption round structures?

  1. Decryption omits MixColumns entirely in every round.
  2. Decryption uses the inverse of each step in reverse order and an equivalent inverse cipher exists. Correct answer.
  3. Both directions use identical round functions in the same order.
  4. Decryption reuses the encryption S-box without any inverse substitution.

Explanation

The straightforward inverse cipher applies InvShiftRows, InvSubBytes, AddRoundKey, and InvMixColumns in the reverse order of encryption. An equivalent inverse cipher rearranges these steps so the round structure resembles encryption, which helps efficient implementations.

Question 26Symmetric Cryptography and Block Cipher Modes

In DES, what is the effective key length against exhaustive search, given that the 64-bit key includes 8 parity bits?

  1. 48 bits
  2. 128 bits
  3. 64 bits
  4. 56 bits Correct answer.

Explanation

DES discards the eight parity bits, leaving a 56-bit working key, so brute-force effort is on the order of 2^56 trials. This key space is far too small for modern hardware, which is why DES was superseded by triple DES and AES.

Question 27Symmetric Cryptography and Block Cipher Modes

Which Feistel property explains why DES decryption can use the same hardware as encryption with subkeys in reverse order?

  1. DES uses a linear round function that can be reversed algebraically.
  2. The final permutation fully restores the original plaintext before decryption.
  3. The round function need not be invertible because each round output half is combined by XOR. Correct answer.
  4. The Feistel round function is its own inverse when the round key is XORed.

Explanation

In a Feistel network the round function output is XORed into the other half, so applying the same rounds with subkeys reversed undoes the encryption regardless of whether the round function is invertible. This symmetry is a defining advantage of Feistel designs.

Question 28Symmetric Cryptography and Block Cipher Modes

Which mode of operation turns a block cipher into a stream cipher by encrypting a counter and XORing the result with plaintext?

  1. Cipher Feedback
  2. Output Feedback
  3. Counter mode Correct answer.
  4. Cipher Block Chaining

Explanation

Counter mode encrypts successive values of a nonce-based counter and XORs the keystream with the data, so blocks can be processed independently and in parallel. Because the block cipher is only used in the forward direction, decryption uses the same operation as encryption.

Question 29Symmetric Cryptography and Block Cipher Modes

What is the primary security consequence of reusing an initialization vector with the same key in CBC mode?

  1. The block cipher loses its confusion property permanently.
  2. The key schedule becomes invertible and exposes the raw key.
  3. The ciphertext length grows with each reuse.
  4. Identical plaintext prefixes produce identical ciphertext prefixes, leaking equality of data. Correct answer.

Explanation

With a repeated IV, the first blocks of two messages encrypt identical plaintext under the same input, producing identical ciphertext blocks and revealing that the prefixes match. IVs must therefore be unpredictable and unique per message for a given key.

Question 30Symmetric Cryptography and Block Cipher Modes

Why must the initialization vector for CBC encryption be unpredictable rather than merely unique?

  1. Predictable IVs cause the padding to be computed incorrectly.
  2. Predictable IVs make the ciphertext longer than the plaintext.
  3. Predictable IVs force the use of a different key schedule.
  4. Predictable IVs allow attackers to mount chosen-plaintext attacks that confirm guesses about plaintext blocks. Correct answer.

Explanation

If an attacker can anticipate the IV, they can arrange for a chosen plaintext block to be encrypted under an input they know, letting them test guesses about a target block. Random, unpredictable IVs prevent this chosen-plaintext correlation.

Question 31Symmetric Cryptography and Block Cipher Modes

Which mode is defined so that encryption of each block depends on all preceding plaintext blocks, making it unsuitable for random-access decryption of a single block?

  1. Galois/Counter Mode
  2. Electronic Codebook
  3. Cipher Block Chaining Correct answer.
  4. Counter mode

Explanation

In CBC each ciphertext block is the encryption of the current plaintext block XORed with the previous ciphertext block, so decryption of one block requires the preceding ciphertext block. This chaining creates the dependency and prevents independent random access during encryption.

Question 32Symmetric Cryptography and Block Cipher Modes

In Galois/Counter Mode, what does the authentication tag protect?

  1. The integrity and authenticity of both the ciphertext and the associated data Correct answer.
  2. The confidentiality of the counter values
  3. The length of the initialization vector
  4. Only the key schedule of the underlying block cipher

Explanation

GCM computes a GHASH over the ciphertext and any additional authenticated data, then encrypts the result with the block cipher to form the tag. Verifying the tag assures the receiver that neither the ciphertext nor the associated data was altered.

Question 33Symmetric Cryptography and Block Cipher Modes

Why is a nonce reuse catastrophic in Galois/Counter Mode?

  1. It disables the underlying block cipher entirely.
  2. It enables recovery of the authentication key and forgery of tags. Correct answer.
  3. It forces the mode to fall back to Cipher Block Chaining.
  4. It doubles the ciphertext size.

Explanation

Reusing a nonce with the same key in GCM causes keystream reuse and also allows an attacker to solve for the GHASH authentication key, after which forged messages with valid tags can be produced. Nonce uniqueness per key is therefore an absolute requirement.

Question 34Symmetric Cryptography and Block Cipher Modes

What property must a mode provide so that an attacker cannot reorder or splice ciphertext blocks without detection?

  1. Padding removal
  2. Integrity and authenticity, typically through a MAC or authenticated mode Correct answer.
  3. Key whitening
  4. Confidentiality only

Explanation

Encryption alone does not prevent an adversary from rearranging, truncating, or splicing ciphertext blocks. An authenticated mode such as GCM or an encrypt-then-MAC construction binds the ciphertext to a tag so modifications are detected.

Question 35Symmetric Cryptography and Block Cipher Modes

In a padding oracle attack against CBC encryption, what does the attacker exploit?

  1. The reuse of the same key across sessions
  2. The timing or error behavior that reveals whether padding was valid after decryption Correct answer.
  3. The length of the authentication tag
  4. The predictability of the initialization vector

Explanation

If a system reports whether decrypted padding is valid, the attacker can iteratively modify ciphertext blocks and use that signal to recover plaintext byte by byte. Authenticating the ciphertext before decryption, as in encrypt-then-MAC, prevents this oracle.

Question 36Symmetric Cryptography and Block Cipher Modes

Which mode uses the previous ciphertext block as input to the block cipher to produce keystream, giving self-synchronizing behavior after a lost block?

  1. Counter mode
  2. Cipher Feedback Correct answer.
  3. Output Feedback
  4. Electronic Codebook

Explanation

Cipher Feedback encrypts the previous ciphertext block to generate keystream, so a receiver resynchronizes after a full block of corrupted data. Output feedback instead feeds back the keystream and loses synchronization permanently after an error.

Question 37Symmetric Cryptography and Block Cipher Modes

Which statement about the relationship between Electronic Codebook mode and block-level pattern leakage is accurate?

  1. ECB adds a random salt to each block before encryption.
  2. ECB encrypts identical plaintext blocks to identical ciphertext blocks under the same key. Correct answer.
  3. ECB chains blocks so repeated plaintext produces distinct ciphertext.
  4. ECB hides repeated plaintext blocks because each block uses a fresh IV.

Explanation

ECB applies the block cipher independently to each block with no chaining or randomization, so equal plaintext blocks map to equal ciphertext blocks. This deterministic mapping leaks structure, such as repeated fields in an image or database record.

Question 38Symmetric Cryptography and Block Cipher Modes

Triple DES with two keys, known as 2TDEA, applies EDE with K1, K2, K1. What is its approximate effective security against a meet-in-the-middle attack?

  1. 80 bits
  2. 56 bits
  3. 112 bits Correct answer.
  4. 168 bits

Explanation

Although the nominal key is 112 bits, a meet-in-the-middle attack reduces effective security to roughly 2^112 operations, and practical guidance treats 2TDEA as offering about 112-bit strength. Three-key 3TDEA reaches about 112 bits as well but with a larger key.

Question 39Symmetric Cryptography and Block Cipher Modes

Which block cipher mode of operation is standardized specifically to provide both confidentiality and integrity in a single pass and is widely used in TLS 1.3?

  1. Electronic Codebook
  2. Galois/Counter Mode Correct answer.
  3. CBC with HMAC
  4. Output Feedback

Explanation

GCM combines counter-mode encryption with GHASH authentication in one pass, producing ciphertext and a tag together. TLS 1.3 restricts its cipher suites to authenticated modes such as AES-GCM and ChaCha20-Poly1305.

Question 40Symmetric Cryptography and Block Cipher Modes

What is the main reason block ciphers are commonly used in modes rather than encrypting each block independently?

  1. Modes add diffusion and randomization so identical plaintext blocks do not produce identical ciphertext. Correct answer.
  2. Modes make the underlying cipher nonlinear.
  3. Modes eliminate the need for any padding.
  4. Modes reduce the key length needed for security.

Explanation

A mode such as CBC, CFB, or CTR introduces chaining or a nonce so repeated plaintext does not yield repeated ciphertext, addressing the pattern leakage of ECB. The underlying block cipher already provides confusion and diffusion within a block.

Question 41Symmetric Cryptography and Block Cipher Modes

AES-256 differs from AES-128 primarily in which respect?

  1. It uses 14 rounds and a 256-bit key with a longer key schedule. Correct answer.
  2. It uses 10 rounds but a 256-bit key.
  3. It uses a 128-bit block size doubled to 256 bits.
  4. It replaces MixColumns with a key-dependent permutation.

Explanation

AES-256 has a 256-bit key and performs 14 rounds, compared with 10 rounds for AES-128, and its key schedule generates 60 words. The block size remains 128 bits in all AES variants.

Question 42Symmetric Cryptography and Block Cipher Modes

In CTR mode, why must the counter values never repeat for a given key?

  1. Repeating counters force a change in padding scheme.
  2. Repeating counters cause the ciphertext to be shorter than the plaintext.
  3. Repeating counters cause the keystream to repeat, so XORing two ciphertexts cancels the keystream and reveals plaintext relationships. Correct answer.
  4. Repeating counters weaken the block cipher's S-boxes.

Explanation

CTR encryption is C = P XOR E(counter), so identical counter values produce identical keystream. XORing two ciphertexts encrypted with the same keystream yields the XOR of the plaintexts, leaking information without any key knowledge.

Question 43Symmetric Cryptography and Block Cipher Modes

Which property of the AES S-box construction ensures that the substitution is invertible?

  1. It is built from multiplication by a fixed nonzero constant.
  2. It combines a multiplicative inverse in GF(2^8) with an affine transformation, both invertible. Correct answer.
  3. It XORs the round key into each byte.
  4. It applies a cyclic bit rotation to each byte.

Explanation

The AES S-box maps each byte to its multiplicative inverse in GF(2^8), with zero mapped to zero, then applies an invertible affine transformation over GF(2). Since both steps are bijections, the S-box is invertible and decryption can use the inverse table.

Question 44Symmetric Cryptography and Block Cipher Modes

What does the term tweakable block cipher refer to in modes such as XEX and XTS?

  1. A cipher that encrypts only half of each block
  2. A cipher that accepts an additional public input, the tweak, that changes the permutation without changing the key Correct answer.
  3. A cipher that requires a new random IV for each block
  4. A cipher whose key can be changed after every block

Explanation

A tweakable block cipher takes a key and a public tweak, producing a different permutation for each tweak value while keeping the key secret. XTS uses this to encrypt storage sectors so identical plaintext at different sector offsets yields different ciphertext.

Question 45Symmetric Cryptography and Block Cipher Modes

Which mode is designed for disk and sector encryption so that identical plaintext at the same offset in different sectors produces different ciphertext?

  1. Output Feedback
  2. Electronic Codebook
  3. XEX-based tweaked codebook mode with ciphertext stealing, XTS Correct answer.
  4. Cipher Block Chaining with a fixed IV

Explanation

XTS uses the sector number or offset as a tweak, so encryption of identical data at different positions yields different ciphertext while still allowing random access. It also uses ciphertext stealing to handle sectors that are not block-aligned.

Question 46Symmetric Cryptography and Block Cipher Modes

Which statement correctly describes the key schedule input for each round of AES encryption?

  1. Each round key is derived from the original cipher key by the key expansion routine, not recomputed from the plaintext. Correct answer.
  2. Each round key is generated from the plaintext block using the SubBytes transformation.
  3. Each round key is produced by encrypting the previous round's ciphertext with the master key.
  4. Each round key is a copy of the previous round's state after the MixColumns transformation.

Explanation

AES precomputes round keys by expanding the original cipher key through RotWord, SubWord, and XOR with round constants, producing one key per round. The round keys depend only on the cipher key, not on the data being encrypted. This is why the same expanded key material serves every block processed under that key.

Question 47Symmetric Cryptography and Block Cipher Modes

AES is built on a substitution-permutation network rather than a Feistel structure. What is a direct consequence of this design choice?

  1. Decryption can be performed with the identical circuit used for encryption by reversing subkeys.
  2. The cipher requires a larger key than Feistel ciphers to reach equivalent security.
  3. The cipher cannot be inverted without knowledge of the plaintext.
  4. Decryption uses inverse transformations; reversing the subkey order alone is insufficient. Correct answer.

Explanation

AES applies invertible transformations to the state. Decryption therefore uses inverse operations, including InvSubBytes and InvMixColumns, with the round keys in reverse order. Reversing subkeys alone is insufficient. These mathematical differences do not require separate physical circuits: a unified implementation can share hardware between encryption and decryption.

Question 48Symmetric Cryptography and Block Cipher Modes

Which mechanism in the AES key expansion prevents the round keys from being simple shifted copies of one another?

  1. The use of a different initialization vector for each round key.
  2. The repetition of the same S-box lookup applied uniformly to every word.
  3. The addition of a round constant and the application of SubWord within the word rotation. Correct answer.
  4. The XOR of the plaintext block with each intermediate key word.

Explanation

The key expansion rotates a word, applies SubWord, and XORs a round constant (Rcon) that differs per round. The round constant breaks symmetry so the expanded words do not repeat or relate by simple shifts. SubWord adds nonlinearity so the relationship between key bits and round key bits is not affine.

Question 49Symmetric Cryptography and Block Cipher Modes

Which statement about key whitening in block ciphers such as AES is accurate?

  1. It XORs key material before the first round and after the last round to complicate key recovery. Correct answer.
  2. It doubles the block size by concatenating the key with the plaintext before encryption.
  3. It removes the need for round keys inside the cipher's internal rounds.
  4. It replaces the final round of the cipher with an additional key-dependent substitution layer.

Explanation

Key whitening applies secret key material at the input and output of the cipher, outside the main round structure. It prevents an attacker from computing the internal state directly from known plaintext or ciphertext without first guessing key bits. This raises the effort of meet-in-the-middle and related-key style attacks without changing the core rounds.

Question 50Symmetric Cryptography and Block Cipher Modes

In CMAC, why is a distinct subkey applied to the final block depending on whether the message length is a multiple of the block size?

  1. To reduce the number of block cipher invocations needed for long messages.
  2. To permit the same key to be reused across unrelated protocols without restriction.
  3. To allow the MAC to be verified without the secret key.
  4. To ensure that messages differing only by padding cannot produce the same authentication value. Correct answer.

Explanation

CMAC derives two subkeys from the cipher key and applies K1 to a complete final block and K2 to a padded final block. This separation ensures that a padded message and a naturally aligned message do not collide in the MAC computation. Without it, an attacker could exploit padding ambiguity to forge or confuse message authentication values.