312-50 Question 453
Single answer▪ Encryption AlgorithmsDuring an internal security assessment, you discover that a legacy file-transfer application encrypts large customer data exports with RSA using the server's public key before sending them to a partner. Transfers are timing out and CPU usage on both systems is unusually high when files exceed several hundred megabytes. The partner insists that the data must remain confidential in transit and at rest until they decrypt it. Which change would BEST improve performance while preserving strong encryption practice?
- A
Replace RSA file encryption with a hybrid approach: encrypt each file with a random AES session key, then encrypt that AES key with the partner's RSA public key
- B
Continue using RSA for the full file, but reduce the RSA key size to 1024 bits to improve performance
- C
Use a one-way SHA-256 hash instead of encryption for the file contents, then send the hash alongside the plaintext file
- D
Split the file into smaller chunks and encrypt each chunk directly with RSA using the same public key
Show answer and explanation
Correct answer: A
Explanation
The best answer is the hybrid-encryption model: use a fast symmetric algorithm such as AES for the actual file data and use RSA only to encrypt the symmetric session key. This approach is standard because symmetric encryption is designed for bulk data, while asymmetric encryption is designed for key exchange, digital signatures, and small payloads. In real-world implementations, RSA encryption also depends on padding schemes such as OAEP and has input-size constraints, making direct encryption of large files impractical. Guidance from NIST and common industry practice favor strong symmetric ciphers like AES for data encryption and reserve RSA/ECC for key establishment and related functions. From a CEH perspective, recognizing the misuse of RSA for large data and recommending hybrid encryption reflects practical cryptographic design and secure implementation knowledge.
- A. Correct.
Correct. This is the standard hybrid-encryption design used in real systems such as TLS, PGP/GPG, and many secure file-exchange products. Symmetric algorithms like AES are efficient for encrypting large amounts of data, while asymmetric algorithms like RSA are computationally expensive and are typically used only to protect small pieces of data such as session keys. Encrypting the file with a random AES key and then encrypting that AES key with RSA preserves confidentiality while greatly improving performance.
- B. Incorrect.
Incorrect. Reducing RSA to 1024 bits may improve speed somewhat, but 1024-bit RSA is no longer considered sufficient for long-term security in most environments and is deprecated by modern guidance. It also does not address the core design problem: RSA is inefficient and unsuitable for bulk data encryption compared to symmetric ciphers.
- C. Incorrect.
Incorrect. SHA-256 is a cryptographic hash function, not an encryption algorithm. A hash can help verify integrity, but it cannot provide confidentiality because it is one-way and does not hide the original plaintext. Sending the plaintext file with a hash would leave the contents exposed.
- D. Incorrect.
Incorrect. Chunking the file does not fix the fundamental inefficiency of using RSA for bulk data. In practice, RSA has strict limits on how much data can be encrypted per operation based on key size and padding scheme, and repeatedly applying RSA to file chunks would remain inefficient and operationally poor compared with hybrid encryption.