Exam CISSP topic 1 question 99 discussion

Rsa or dsa shall be over 2048 bits So, A is correct.

B: ...This Standard specifies three choices for the length of the modulus (i.e., nlen): 1024, 2048 and 3072 bits. Federal Government entities shall generate digital signatures using one or more of these choices... https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf

Answer A) DSA lengths 2048 or 3072 are recommended by NIST for lifetime key security.

Option A aligns with FIPS 140-2 requirements as it includes the recommended key sizes and algorithms. It uses Diffie-Hellman (DH) key exchange with a key size of at least 2048 bits, Advanced Encryption Standard (AES) with a key size greater than 128 bits for symmetric encryption, and Digital Signature Algorithm (DSA) with a key size of at least 2048 bits for digital signatures.

A. Diffie-hellman (DH) key exchange: DH (>=2048 bits) Symmetric Key: Advanced Encryption Standard (AES) > 128 bits Digital Signature: Digital Signature Algorithm (DSA) (>=2048 bits) According to Federal Information Processing Standard (FIPS) Publication 140-2, the combination of algorithms that are compliant for non-legacy systems are: Diffie-hellman (DH) key exchange: DH (>=2048 bits) Symmetric Key: Advanced Encryption Standard (AES) > 128 bits Digital Signature: Digital Signature Algorithm (DSA) (>=2048 bits) Option A is the only one that matches these requirements for the algorithm used for DH, AES and DSA.

The correct answer is A not B. FIPS 140-2 allows or approves using key length >= 2048 bit for DSA and RSA . reference : https://cryptosense.com/blog/which-algorithms-are-fips-140-3-approved

A. https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp3488.pdf [FIPS 186-4] RSA (2048/3072 with all SHA-2 sizes) [FIPS 186-4] DSA (1024/2048/3072 with all SHA-2 sizes)

Agee with A.

FIPS140-2 approved Signature Generation DSA – 2048-bit key length and longer which is A RSA - RSA – 2048-bit key length and longer, with SHA1, and SHA2 with 256-bit to 512-bit key lengths. B is not correct as it uses only 1024-bit key length which is not approved especially SHA1.

d is out because of < AES128 (needs to be >=), C because of at least blowfish, and B because of sig-algo < 1024 (at leas 2048 needed)

What algorithms are compliant with FIPS 140-2? The following algorithms are compliant with FIPS 140-2: Symmetric Key Encryption & Decryption Advanced Encryption Standard (AES) Triple-DES Encryption Algorithm (TDEA) Digital Signatures Digital Signature Standard (DSS), which includes the Digital Signature Algorithm (DSA), Rivest-Shamir-Adleman (RSA), and the Elliptic Curve Digital Signature Algorithm (ECDSA) Secure Hash Secure Hash Standard (SHS), which includes Secure Hash Algorithm (SHA) 1, SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, and SHA-512/256 SHA-3 Standard, which includes SHA-3 hash algorithms, SHA-3 extendable output functions (XOF), and SHA-3 derived functions Message Authentication Triple-DES Encryption Algorithm (TDEA) Advanced Encryption Standard (AES) Hash-Based Message Authentication Code (HMAC) https://www.trentonsystems.com/blog/fips-140-2-explained#:~:text=If%20a%20cryptographic%20module%20is,features%20outlined%20in%20the%20standard.

Both AES and RSA are FIPS 140-2 compliant.