EC-COUNCIL ECES 212-81 Questions & Answers

• Question 1:

  How can rainbow tables be defeated?

  A. Lockout accounts under brute force password cracking attempts

  B. All uppercase character passwords

  C. Use of non-dictionary words

  D. Password salting

  Correct Answer: D

  Password salting https://en.wikipedia.org/wiki/Salt_(cryptography)#Benefits Salts also combat the use of hash tables and rainbow tables for cracking passwords. A hash table is a large list of pre-computed hashes for commonly used passwords. For a password file without salts, an attacker can go through each entry and look up the hashed password in the hash table or rainbow table. If the look-up is considerably faster than the hash function (which it often is), this will considerably speed up cracking the file. However, if the password file is salted, then the hash table or rainbow table would have to contain "salt . password" pre-hashed. If the salt is long enough and sufficiently random, this is very unlikely. Unsalted passwords chosen by humans tend to be vulnerable to dictionary attacks since they have to be both short and meaningful enough to be memorized. Even a small dictionary (or its hashed equivalent, a hash table) is significant help cracking the most commonly used passwords. Since salts do not have to be memorized by humans they can make the size of the rainbow table required for a successful attack prohibitively large without placing a burden on the users.

• Question 2:

  What is the name of the attack where the attacker obtains the ciphertexts corresponding to a set of plaintexts of his own choosing?

  A. Chosen plaintext

  B. Differential cryptanalysis

  C. Known-plaintext attack

  D. Kasiski examination

  Correct Answer: A

  Chosen plaintext https://en.wikipedia.org/wiki/Chosen-plaintext_attack A chosen-plaintext attack (CPA) is an attack model for cryptanalysis which presumes that the attacker can obtain the ciphertexts for arbitrary plaintexts. The goal of the attack is to gain information that reduces the security of the encryption scheme.

• Question 3:

  A digital document that contains a public key and some information to allow your system to verify where that key came from. Used for web servers, Cisco Secure phones, E- Commerce.

  A. Registration Authority

  B. Payload

  C. OCSP

  D. Digital Certificate

  Correct Answer: D

  Digital Certificate https://en.wikipedia.org/wiki/Public_key_certificate A public key certificate, also known as a digital certificate or identity certificate, is an electronic document used to prove the ownership of a public key. The certificate includes information about the key, information about the identity of its owner (called the subject), and the digital signature of an entity that has verified the certificate's contents (called the issuer).

• Question 4:

  Juanita has been assigned the task of selecting email encryption for the staff of the insurance company she works for. The various employees often use diverse email clients. Which of the following methods is available as an add-in for most email clients?

  A. Caesar cipher

  B. RSA

  C. PGP

  D. DES

  Correct Answer: C

  PGP https://en.wikipedia.org/wiki/Pretty_Good_Privacy Pretty Good Privacy (PGP) is an encryption program that provides cryptographic privacy and authentication for data communication. PGP is used for signing, encrypting, and decrypting texts, e-mails, files, directories, and whole disk partitions and to increase the security of e-mail communications. Phil Zimmermann developed PGP in 1991.

• Question 5:

  A ______ refers to a situation where two different inputs yield the same output.

  A. Convergence

  B. Collision

  C. Transposition

  D. Substitution

  Correct Answer: B

  Collision

  https://en.wikipedia.org/wiki/Collision_(computer_science) A collision or clash is a situation that occurs when two distinct pieces of data have the same hash value, checksum, fingerprint, or cryptographic digest.

• Question 6:

  A _______ product refers to an NSA-endorsed classified or controlled cryptographic item for classified or sensitive U. S. government information, including cryptographic equipment, assembly, or component classified or certified by NSA for encrypting and decrypting classified and sensitive national security information when appropriately keyed

  A. 1

  B. 4

  C. 2

  D. 3

  Correct Answer: A

  Type 1 https://en.wikipedia.org/wiki/NSA_cryptography#Type_1_Product A Type 1 Product refers to an NSA endorsed classified or controlled cryptographic item for classified or sensitive U.S. government information, including cryptographic equipment, assembly or component classified or certified by NSA for encrypting and decrypting classified and sensitive national security information when appropriately keyed.

• Question 7:

  What is the largest key size that AES can use?

  A. 256

  B. 56

  C. 512

  D. 128

  Correct Answer: A

  https://en.wikipedia.org/wiki/Advanced_Encryption_Standard For AES, NIST selected three members of the Rijndael family, each with a block size of 128 bits, but three different key lengths: 128, 192 and 256 bits.

• Question 8:

  What is the formula m^e %n related to?

  A. Encrypting with EC

  B. Decrypting with RSA

  C. Generating Mersenne primes

  D. Encrypting with RSA

  Correct Answer: D

  Encrypting with RSA

  https://en.wikipedia.org/wiki/RSA_(cryptosystem)

  RSA Encrypting a message m (number) with the public key (n, e) is calculated:

  M' := m^e %n

• Question 9:

  If Bob is using asymmetric cryptography and wants to send a message to Alice so that only she can decrypt it, what key should he use to encrypt the message?

  A. Alice's private key

  B. Bob's private key

  C. Alice's public key

  D. Bob's public key

  Correct Answer: C

  Alice's public key https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange In asymmetric (public key) cryptography, both communicating parties (i.e. both Alice and Bob) have two keys of their own -- just to be clear, that's four keys total. Each party has their own public key, which they share with the world, and their own private key which they ... well, which they keep private, of course but, more than that, which they keep as a closely guarded secret. The magic of public key cryptography is that a message encrypted with the public key can only be decrypted with the private key. Alice will encrypt her message with Bob's public key, and even though Eve knows she used Bob's public key, and even though Eve knows Bob's public key herself, she is unable to decrypt the message. Only Bob, using his secret key, can decrypt the message ... assuming he's kept it secret, of course.

• Question 10:

  You are studying classic ciphers. You have been examining the difference between single substitution and multi-substitution. Which one of the following is an example of a multi- alphabet cipher?

  A. Rot13

  B. Caesar

  C. Atbash

  D. Vigenere

  Correct Answer: D

  Vigenere https://en.wikipedia.org/wiki/Vigen%C3%A8re_cipher The Vigenere cipher is a method of encrypting alphabetic text by using a series of interwoven Caesar ciphers, based on the letters of a keyword. It employs a form of polyalphabetic substitution. First described by Giovan Battista Bellaso in 1553, the cipher is easy to understand and implement, but it resisted all attempts to break it until 1863, three centuries later. This earned it the description le chiffre indehiffrable (French for 'the indecipherable cipher'). Many people have tried to implement encryption schemes that are essentially Vigenre ciphers. In 1863, Friedrich Kasiski was the first to publish a general method of deciphering Vigenre ciphers.