Exam SSCP topic 5 question 15 discussion

Actual exam question from ISC's SSCP

Question #: 15
Topic #: 5

Brute force attacks against encryption keys have increased in potency because of increased computing power. Which of the following is often considered a good protection against the brute force cryptography attack?

A. The use of good key generators.
B. The use of session keys.
C. Nothing can defend you against a brute force crypto key attack.
D. Algorithms that are immune to brute force key attacks.

Show Suggested Answer

Suggested Answer: B 🗳️
If we assume a crytpo-system with a large key (and therefore a large key space) a brute force attack will likely take a good deal of time - anywhere from several hours to several years depending on a number of variables. If you use a session key for each message you encrypt, then the brute force attack provides the attacker with only the key for that one message. So, if you are encrypting 10 messages a day, each with a different session key, but it takes me a month to break each session key then I am fighting a loosing battle.
The other answers are not correct because:
"The use of good key generators" is not correct because a brute force key attack will eventually run through all possible combinations of key. Therefore, any key will eventually be broken in this manner given enough time.
"Nothing can defend you against a brute force crypto key attack" is incorrect, and not the best answer listed. While it is technically true that any key will eventually be broken by a brute force attack, the question remains "how long will it take?". In other words, if you encrypt something today but I can't read it for 10,000 years, will you still care? If the key is changed every session does it matter if it can be broken after the session has ended? Of the answers listed here, session keys are
"often considered a good protection against the brute force cryptography attack" as the question asks.
"Algorithms that are immune to brute force key attacks" is incorrect because there currently are no such algorithms.
References:

Official ISC2 Guide page: 259 -
All in One Third Edition page: 623

by e098e9c at April 10, 2024, 12:15 a.m.

Comments

Submit Cancel

e098e9c

7 months, 2 weeks ago

Someone please give me clarity on this. Wouldnt the use of good key generators be good protection against brute force? Hypothetically if you had session keys but a weak key generator, it is still prone to a brute force attack (maybe even more prone with a poor key generator) and be compromised mid session. Just a thought, please feel free to help my thinking here

upvoted 1 times

...

Exam SSCP All Questions

View all questions & answers for the SSCP exam

Exam SSCP topic 5 question 15 discussion

Comments

e098e9c

Get IT Certification

New Version GCP Professional Cloud Architect Certificate & Helpful Information

The 5 Most In-Demand Project Management Certifications of 2019