200-201 Question 165
Single answerDuring a security audit, a cybersecurity analyst discovers that a web server is configured with the following cipher-suite: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384. What does the 'ECDHE' component in this cipher-suite indicate?
- A
The cipher-suite uses RSA for key exchange and authentication.
- B
The cipher-suite uses Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) for key exchange.
- C
The cipher-suite uses AES-256 in CBC mode for encryption.
- D
The cipher-suite provides a fixed key size for key exchange to reduce computational overhead.
Show answer and explanation
Correct answer: B
Explanation
Cipher-suites define the components used in securing communication over TLS/SSL. The 'ECDHE' component specifically refers to the key exchange mechanism, Elliptic Curve Diffie-Hellman Ephemeral, which enhances security by ensuring unique keys are generated for each session, providing perfect forward secrecy. Understanding each part of a cipher-suite is essential to evaluate its strength and suitability for secure communications.
- A. Incorrect.
This is incorrect. While RSA is listed in the cipher-suite, it is used for authentication, not for key exchange. The key exchange mechanism is indicated by 'ECDHE'.
- B. Correct.
This is correct. 'ECDHE' stands for Elliptic Curve Diffie-Hellman Ephemeral, which is a key exchange mechanism that provides perfect forward secrecy by generating ephemeral keys.
- C. Incorrect.
This is incorrect. The cipher-suite specifies AES-256 in GCM mode (Galois/Counter Mode), not CBC mode (Cipher Block Chaining).
- D. Incorrect.
This is incorrect. While 'ECDHE' is efficient in computational terms, it does not imply a fixed key size; it dynamically generates keys for each session to ensure security.