Font size
WorksheetsUNIT 3 MCQ QUESTIONS
Total questions: 100
Worksheet time: 50mins
Given that MD5 is deterministic, which of the following strategies best exploits its predictability in a preimage attack scenario?
Constructing hash collisions using modular exponentiation
Reversing the compression function of MD5 using quantum oracles
Precomputing a rainbow table of inputs and matching against known MD5 digests
Generating keys using random salts to invalidate deterministic outputs
Consider a secure system that validates document integrity using MD5. An attacker generates two documents with the same MD5 hash but different semantics. Which attack model best describes this scenario?
First preimage attack
Chosen prefix collision attack
Birthday bound brute-force attack
Chosen ciphertext attack
Which structural feature of the MD5 algorithm makes it particularly susceptible to differential cryptanalysis?
Its use of asymmetric compression in the final round
The lack of key scheduling in the hash function
Its predictable message expansion and fixed 64-round pipeline
Its reliance on elliptic curve modular inverses
Assume an attacker has access to GPU-accelerated infrastructure and wants to generate MD5 collisions in real-time. Which property of MD5 enables this feasibility?
High entropy output
Lack of memory-hardness
Use of cryptographic salt
Randomized initialization vectors
How did the 2008 "Rogue CA" attack demonstrate the real-world implications of MD5's collision vulnerability?
By exposing the root private key of a trusted CA
By generating a fraudulent SSL certificate that chained to a trusted CA
By modifying a CA's policy document via a hash collision
By reversing the MD5 hash to reveal the signing algorithm
If two files differ in only one bit but yield the same MD5 hash, which MD5 property is violated, and what does this imply about avalanche effect?
Collision resistance is preserved, avalanche effect is intact
Preimage resistance is violated, avalanche effect is weak
Collision resistance is violated, implying broken avalanche property
None are violated since MD5 ensures output variability on input change
Which of the following best describes a major difference between MD5 and SHA-256 in terms of cryptographic resilience?
SHA-256 uses modular exponentiation, MD5 uses polynomial fields
MD5 is probabilistic, SHA-256 is deterministic
SHA-256 has a higher collision complexity due to longer hash and stronger diffusion
MD5 leverages elliptic curve cryptography, SHA-256 does not
Why is it problematic to use MD5 in combination with digital signatures, even if the signature algorithm itself is secure?
MD5 adds padding that makes the signature larger
Collision attacks allow forging of a message with the same hash, bypassing signature integrity
MD5 outputs only fixed-length messages
The output of MD5 can be converted back to the private key
From a cryptographic engineering perspective, which of the following would most effectively harden MD5 against brute-force preimage attacks in legacy systems?
Encrypt the hash with AES-256
Apply hash stretching with salts and key-derivation functions (e.g., PBKDF2)
Add an RSA wrapper to the MD5 hash
Reduce the keyspace of the input to limit entropy
How does the Merkle–Damgård construction used in MD5 contribute to its vulnerabilities?
It encrypts message blocks symmetrically
It produces non-uniform output distributions
It processes blocks linearly, making internal state attacks possible
It prevents hash chaining and salting
An attacker uses a chosen-prefix collision attack on MD5 to sign a malicious software update. The signed hash matches a trusted vendor's software. What aspect of cryptographic integrity has been violated?
Authenticity and confidentiality
Forward secrecy
Integrity and trust chaining
Key derivation and session management
In an environment requiring secure password storage, which argument most strongly justifies rejecting MD5 in favor of Argon2 or bcrypt, even with added salting?
MD5 hashes are encrypted during transmission
MD5 requires a higher entropy salt for security
MD5's lack time and memory complexity, making it GPU-attackable
MD5 hashes are compatible only with legacy Unix systems
A cryptographic engineer proposes a hybrid model where MD5 is used as a pre-hash before applying a secure SHA-512 hash. What is the main flaw in this design?
SHA-512 becomes vulnerable if preceded by MD5
The hybrid output violates key agreement protocols
The MD5 pre-hash introduces structural weaknesses exploitable via second preimage attacks
Hashing twice ensures entropy loss in secure communications
You are designing a digital forensic tool that compares file hashes to detect tampering. Why is using MD5 for this purpose problematic under adversarial conditions?
MD5 outputs variable-length digests
Hash collision generation could allow tampered files to evade detection
MD5 is computationally too expensive for real-time scanning
Files cannot be hashed unless encrypted first
Consider a blockchain-based voting system that uses MD5 to hash votes for auditability. Which core property of blockchain security is undermined, and why?
Decentralization, due to key distribution flaws
Transparency, as hashes can be decrypted
Immutability, because MD5 allows vote collisions and falsification
Latency, because MD5 slows down block propagation
SHA-2 improves upon SHA-1 by introducing which critical design enhancement that mitigates known differential attacks?
Use of a Merkle–Damgård construction
Replacing XOR with modular multiplication
Increased internal state size and rounds with different constants
Support for variable-length output
In cryptographic protocol design, why is SHA-1 considered insecure for digital signatures?
SHA-1 outputs non-uniform hashes
It leaks private key information via side channels
It is susceptible to practical collision attacks that allow forged signatures
It only supports 64-bit output, limiting entropy
If two distinct files produce the same SHA-1 hash, which cryptographic property is violated?
One-wayness
Collision resistance
Key separation
Preimage resistance
Which structural feature of SHA-3 distinguishes it from SHA-1 and SHA-2 and improves resistance to length extension attacks?
Use of HMAC padding
Merkle–Damgård construction
Keccak sponge construction
Block chaining with linear diffusion
Why does SHA-3 not replace SHA-2 despite its higher theoretical security?
SHA-3 is slower in hardware for short messages
SHA-2 is post-quantum secure
SHA-3 is not approved by NIST
SHA-2 uses elliptic curve primitives unlike SHA-3
What makes SHA-2 immune to the known length extension attacks affecting MD5 and SHA-1?
It uses HMAC internally
It finalizes the hash with a secret post-processing key
It uses a strong initialization vector
It validates input at block size during compression
SHA-512 offers more resistance to collision attacks than SHA-256 primarily due to:
Double padding
Longer bit output and wider internal state
Use of elliptic curve encoding
SHA-512 uses a sponge construction
Which scenario demonstrates a second-preimage attack vulnerability in a hash function?
Creating a fraudulent message with the same hash as a signed one
Predicting the hash of a message without seeing the input
Finding two random inputs with the same hash
Finding a message that matches a hash of a specific known message
Which of the following statements best characterizes SHA-3’s defense against side-channel attacks?
Keccak’s iterative structure is inherently resistant to timing attacks
SHA-3 masks all memory accesses
SHA-3 relies on randomized digest chaining
SHA-3’s wide-pipe architecture introduces entropy padding
In a blockchain application, replacing SHA-256 with SHA-1 would most adversely affect which property?
Throughput of consensus
Smart contract complexity
Immutability of blocks
Key management strategy
A developer attempts to use SHA-256 in a password storage system. Which flaw could still make the system vulnerable?
Lack of elliptic curve verification
SHA-256’s non-deterministic hashing
Absence of salting and iteration (no key stretching)
Output size not matching AES key requirements
How does SHA-3’s sponge construction contribute to domain separation?
It uses separate compression and expansion phases
Each application can prepend a unique customization string
It disables output reusability through XOR chaining
It masks input using a symmetric key preamble
Which feature of SHAKE (Extendable Output Function) gives it flexibility over fixed-length hash functions like SHA-256?
Variable rounds per block
Arbitrary-length output
AES-based internal core
Symmetric key expansion
A hash function produces identical outputs for every input of the same length. What fundamental property is violated?
Collision resistance
Preimage resistance
One-wayness
Key separation
Which property distinguishes a cryptographic hash from a checksum like CRC?
It provides format-preserving encryption
It ensures constant runtime
It is collision and preimage resistant
It uses cyclic polynomials for validation
In a multi-signer document approval workflow, each signer appends their digital signature sequentially. What critical vulnerability can arise if signers do not sign both the document and the prior signatures?
Weak entropy
Nested signature replay
Signature stripping
Hash chain collapse
Alice digitally signs a message using RSA + SHA-256. Mallory intercepts and modifies the message and appends a new valid signature using her own private key. The system only checks for a valid signature but not the sender identity. What attack has occurred?
Signature forgery
Chosen-message attack
Impersonation through signature injection
Public key misuse attack
Consider an enterprise using ECDSA. If the same random nonce (k) is accidentally reused across different messages, what attack becomes feasible?
Timing attack
Collision-resistance breach
Private key recovery
Birthday paradox attack
In post-quantum cryptography, signature schemes like SPHINCS+ adopt hash-based trees. What is the primary trade-off of SPHINCS+ compared to traditional schemes like RSA?
Higher entropy, lower key storage
Smaller signatures, longer key reuse cycles
Larger signatures and slower signing
Better forward secrecy, weaker authenticity
A signer includes a document hash and a timestamp in their signed payload, but the timestamp is not cryptographically bound. What attack scenario is enabled?
Chosen-ciphertext attack
Timestamp oracle poisoning
Time-shifting attack
Proof-of-work manipulation
In a digital signature verification process, a hardware security module (HSM) is used to manage private keys. A timing side-channel is detected. What aspect is being leaked?
Key entropy
Modular exponentiation time
Certificate serial number
Hash output
Which digital signature protocol would best minimize signer repudiation in a blockchain-based court-admissible evidence system?
ECDSA with ephemeral keys
RSA with offline timestamping
Hash-based Lamport signatures
BLS signatures with threshold consensus
A document is signed using a digital signature, then the signature and document are separately encrypted using asymmetric keys. What critical mistake may undermine signature integrity?
Padding error on encrypted hash
Loss of non-repudiation due to post-signature encryption
Hash-collision attack on document
Algorithmic mismatch between signer and verifier
In a zero-knowledge proof system that includes digital signatures for attestation, what unique risk does signature reuse across multiple proofs introduce?
Nonce inference
Sybil amplification
Traceability from linkage
Block entropy collapse
In the case of quantum attacks against RSA and ECDSA, why are lattice-based digital signature schemes considered more resilient?
They use random padding
They are based on non-abelian group hardness geometric problems
Their security relies on hard geometric problems
They require dynamic key regeneration
You’re designing a system where IoT devices sign messages locally and send them over an unreliable channel. Which risk is most critical?
Signature decoding errors
Signature loss due to limited bandwidth
Malleability of signature if ECC is used
Replay of previously signed commands
The company uses a timestamp authority (TSA) to bind time to digital signatures. What cryptographic assumption underlies the TSA’s trust?
Bounded leakage assumption
Trusted setup model
Hash inversion assumption
Forward secrecy assumption
What is the theoretical impact on a signature scheme’s existential unforgeability if the hash function used becomes second-preimage vulnerable?
Keys can be swapped
Signature non-determinism increases
Signatures can be reused safely
An attacker can forge a signature on a new message
If a private key used for digital signing is backed up in encrypted form on cloud storage, what additional step is essential to ensure non-repudiation remains legally valid?
Frequent key refreshing
Key escrow registration
HSM-sealed signature logging
Key compromise proof inclusion
Which advanced feature of BLS signatures makes them particularly suitable for decentralized consensus protocols?
Hash salting
Threshold certificate chaining
Signature aggregation
Timestamp obfuscation
What is the most critical assumption Kerberos makes for maintaining session security?
Integrity of the ticket granting server
Confidentiality of password hashing algorithms
Accurate and synchronized system clocks
Availability of pre-authentication metadata
In Kerberos, the client obtains a TGT from the AS. If this TGT is stolen by an insider, what is the maximum damage an attacker can do?
Gain access to all encrypted documents
Forge signatures in SSL sessions
Access services impersonating the client within ticket lifetime
Escalate to root-level privilege
Kerberos prevents replay attacks by including what in its protocol messages?
MAC and IV
Timestamps and nonce
Key salts and blockchains
OTP tokens and biometrics
A rogue admin has VPN access to monitor encrypted traffic. What Kerberos property most effectively prevents him from misusing intercepted service tickets?
Asymmetric key exchange
Client authentication chaining
Session keys encrypted with client keys
Use of biometrics
If a client fails mutual authentication with a kerberized server, which is the most probable root cause?
Incorrect DNS zone
TGS private key mismatch
Server’s keytab file is missing or outdated
Client’s password is weak
In cross-realm Kerberos trust, which component must be securely exchanged between realms?
Ticket checksum
Password hashes
Shared inter-realm key
AS key list
What risk does Kerberos face if clock drift exceeds the default 5-minute skew tolerance?
Unrestricted impersonation
Premature ticket expiration or rejection
Disabling of hash chains
Server-side DoS due to resync loops
In a hybrid cloud, what’s the best practice for ensuring Kerberos security with geographically distributed data centers?
Use only one global TGS
Replace Kerberos with SSH
Implement NTP with hierarchical trust
Allow unlimited ticket lifetimes
In Kerberos, how can you detect a ticket replay attack in real-time?
Check timestamp and reuse of authenticator
Match IP header fingerprinting
Rotate encryption keys hourly
Compare MAC address logs
A service ticket encrypted with the service’s key is unreadable by the client. What is its purpose then?
To verify server signature
To deliver session key securely
To store metadata for DNS lookup
To replace password-based login
Why can Kerberos be vulnerable to offline brute-force attacks if pre-authentication is disabled?
AS sends hash of password in cleartext
TGS issues unsigned tokens
AS returns encrypted timestamp without validation
AS returns encrypted message that can be cracked offline
Which enhancement adds forward secrecy to Kerberos-based exchanges?
AES-CBC over RC4
Use of ephemeral DH for session key exchange
Base64 padding
Static keytab verification
An attacker captures the AS-REP (response) to a client. What is a realistic mitigation to prevent credential cracking?
Pre-authentication with timestamp
AES-ECB encryption
Decentralized authentication
Disabling DNS SRV
Why is Kerberos unsuitable for environments with long session durations and no reliable time sync?
It lacks asymmetric key exchange
It does not allow symmetric key reuse
It depends on short-lived time-bound tokens
It forces password updates every 30 minutes
Which modern extension improves Kerberos resilience in cloud-native systems with dynamic users and ephemeral nodes?
Kerberos with JWT
Kerberos with SPNEGO + SAML
Kerberos with plaintext fallback
Kerberos over static routing
In a zero-trust enterprise architecture, a client authenticates using an X.509 certificate, but the backend rejects it despite a valid trust chain. The OCSP response shows “good.” Which is the most likely root cause?
OCSP response was unsigned
The certificate’s KeyUsage doesn’t include client authentication
The certificate has a short-lived lifetime
The chain lacks a CRL distribution point
A malicious insider creates a rogue intermediate CA signed by a compromised root. What is the most secure and minimal step a client system should take to mitigate trust to this rogue CA?
Update all OCSP responders
Implement explicit trust pinning and remove root CA
Add the rogue CA to CRL
Restart TLS services
During high-frequency transactions, a financial services app detects latency due to OCSP response fetching. A security architect proposes OCSP stapling. What must be in place to ensure stapled responses are secure and fresh?
DNSSEC for OCSP server IP resolution
Signed OCSP responses with freshness constraints and nonce support
Key pinning to avoid resuscitation
Static stapled data with CRL overlays
A distributed ledger integrates X.509 authentication for API access. Developers notice that revocation isn’t propagating reliably across global nodes. What’s the most scalable solution?
Move to SAML-based access
Use blockchain to verify OCSP
Implement OCSP stapling with delta CRLs
Replace X.509 with HMAC tokens
You are performing a forensic audit on a suspected MITM attack. The attacker used a self-signed cert with matching CN. TLS clients didn’t alert. What’s the most plausible misconfiguration?
OCSP stapling was disabled
Client did not validate certificate chain
CRL was not updated
TLS version mismatch
An identity federation system uses multiple CAs under different jurisdictions. Legal policy requires revocable delegation of signing rights. Which X.509 extension allows such conditional delegation?
BasicConstraints
NameConstraints
ProxyCertInfo
KeyUsage
A certificate contains a “critical” KeyUsage extension permitting only keyAgreement. It is used for mutual TLS. What failure will occur?
Server identity validation fails
Signature verification fails
Cipher negotiation fails
Client certificate rejection
In a hybrid environment, a certificate includes NameConstraints for certain subdomains. A malicious user attempts to sign a cert outside the allowed subtree. What ensures failure during verification?
BasicConstraints check
SAN wildcard mismatch
Certificate path validation enforces name constraints
CRL entry for parent CA
A critical IoT device fleet uses long-lived certificates without OCSP support due to offline deployment. What’s the best secure design pattern to ensure revocation?
Hardcoded CRL list
Proxy gateway with periodic CRL fetch and enforcement
Use DNS-based cert validation
Implement mutual TLS with symmetric fallback
A client sends a TLS ClientHello, and the server sends a certificate chain that includes a missing intermediate CA. Which result follows in a strict verification environment?
Client downloads the missing CA via AIA
Client fails to validate the chain
Server issues a new handshake
OCSP fallback triggers auto-trust
How can the BasicConstraints extension in an X.509 certificate help enforce a multi-tier PKI hierarchy?
It specifies how keys are derived from entropy pools
It marks whether a certificate can act as a CA
It adds semantic tagging for IoT use
It enables OCSP bypass for root certificates
A digital certificate is valid, but a client blocks it citing “Untrusted path length exceeded.” What’s the cryptographic interpretation?
Chain includes more than 3 RSA keys
The BasicConstraints pathLenConstraint is violated
The signature algorithm is deprecated
The keyUsage is set to nonRepudiation
Which property of a hash function ensures it is infeasible to find two different inputs that produce the same output?
Preimage resistance
Collision resistance
Second preimage resistance
Avalanche effect
What is the main purpose of using a secret key in HMAC?
To increase hash output length
To protect against preimage attacks
To provide message authentication and integrity
To speed up the hashing process
75. Assertion (A): HMAC prevents length extension attacks inherent to some hash functions. Reason (R): HMAC hashes the key both inside and outside the message hash.
Both A and R are true, and R explains A
Both A and R are true, but R does not explain A
A is true, R is false
A is false, R is true
If a secret key used in HMAC is shorter than the hash function’s block size, what happens to the key?
It is hashed first to create a fixed-length key
It is padded with zeros to match the block size
It is truncated to the block size
It is rejected as invalid
Which of the following attacks does the use of salts in hashing primarily defend against?
Collision attacks
Replay attacks
Rainbow table attacks
Length extension attacks
Which feature of a cryptographic hash function ensures that a small change in input drastically changes the output?
Collision resistance
Avalanche effect
Preimage resistance
Deterministic output
Why is HMAC preferred over a simple keyed hash for message authentication?
HMAC uses multiple hash functions to increase security
HMAC resists length extension attacks better
HMAC produces shorter hash outputs
HMAC does not use a secret key
Which one of these properties does NOT describe a good cryptographic hash function?
Deterministic
One-way
Easily invertible
Collision-resistant
If the output size of a hash function is 256 bits, approximately how many operations are needed to find a collision using the birthday attack?
2128
2256
264
2512
What is the primary difference between a MAC and a digital signature?
MACs provide non-repudiation, digital signatures do not
MACs use symmetric keys; digital signatures use asymmetric keys
MACs require public verification; digital signatures do not
MACs are computationally slower than digital signatures
In the Merkle-Damgård construction, how is variable-length input handled?
By truncating the input
By padding the input to fixed size and iteratively processing
By hashing only the first block
By concatenating all blocks without modification
Which of the following is a common method to prevent preimage attacks on a hash function?
Using a longer output hash size
Using faster hash algorithms
Increasing the input message length
Using symmetric key cryptography
85. Assertion (A): A collision attack is easier to perform than a preimage attack for the same hash function. Reason (R): Birthday paradox reduces the complexity of finding collisions compared to preimages.
Both A and R are true, and R explains A
Both A and R are true, but R does not explain A
A is true, R is false
A is false, R is true
Which hash function vulnerability led to the development of SHA-3?
Inefficiency in software implementation
Collision vulnerabilities in SHA-1 and SHA-2
Inability to handle long messages
Weaknesses to side-channel attacks
Which part of HMAC computation involves XORing the key with the outer pad?
Initial hash input
Final hash output
Second hash input after inner hash is computed
Hashing the message with the key
How does a MAC differ from a hash function?
MAC requires a secret key, hash function does not
MAC is slower than a hash function
MAC is publicly verifiable, hash function is not
MAC always produces shorter outputs
What is the main role of the compression function in a hash function?
To encrypt the input data
To produce a fixed-length output from fixed-size input blocks
To increase the input length
To generate keys for HMAC
An attacker wants to exploit a length extension attack. Which of the following hash functions is most vulnerable?
SHA-256
MD5
SHA-3
BLAKE2
Why is it important for a hash function used in MAC to have strong collision resistance?
To prevent the attacker from generating two different messages with the same MAC
To speed up the hashing process
To minimize storage requirements
To allow public verification of the MAC
Which algorithm is primarily used for generating digital signatures in the Digital Signature Standard (DSS)?
RSA
DSA (Digital Signature Algorithm)
El Gamal
Schnorr Signature
In DSS, which of the following parameters is NOT part of the public key?
A. Prime modulus p
B. Generator g
C. Private key x
D. Public key y
Assertion (A): The security of DSS relies on the difficulty of the discrete logarithm problem. Reason (R): Discrete logarithms are easy to compute in polynomial time.
Both A and R are true, and R explains A
Both A and R are true, but R does not explain A
A is true, R is false
A is false, R is true
In DSS signature generation, the random number kkk must be:
Publicly known
Kept secret and unique per signature
Equal to the private key
Chosen from the message hash
Which hash function is typically used in DSS for hashing the message before signing?
MD5
SHA-1
SHA-256
Blake2
Why is reusing the same random k in DSS signature generation dangerous?
It makes signatures invalid
It allows recovery of the private key
It speeds up verification
It enhances security
Which step verifies a DSS digital signature?
Checking if the signature equals the message hash
Computing v=g^u1*y^u2 mod p and comparing it with the signature component C
Decrypting the signature using the private key
Rehashing the signature value
Which property does DSS guarantee for the digital signatures it generates?
Confidentiality
Integrity and Non-repudiation
Anonymity
Key exchange
What is the main reason DSS uses a subgroup of order qqq instead of the entire multiplicative group modulo p?
To reduce computation cost
To enhance security by making the discrete log problem harder
To avoid collisions in signatures
To simplify key generation
