312-50 Question 454
Single answer▪ Encryption AlgorithmsDuring an internal security assessment, you capture traffic from a legacy file transfer application used between two branch offices. The payload is unreadable, but after reviewing the client configuration you discover the application uses the same symmetric key for all sessions and encrypts data with DES in ECB mode. Management asks which single change would most effectively improve confidentiality without requiring a full redesign to public-key encryption. What should you recommend?
- A
Replace DES-ECB with AES-256 in CBC or GCM mode and implement unique session keys for each connection
- B
Keep DES but increase the key reuse period so key changes happen less often and are easier to manage
- C
Switch from symmetric encryption to MD5 hashing so intercepted payloads cannot be read directly
- D
Continue using ECB mode but add Base64 encoding before transmission to obscure repeating patterns
Show answer and explanation
Correct answer: A
Explanation
The most effective recommendation is to replace DES-ECB with a modern symmetric cipher and secure mode of operation, while also eliminating long-term key reuse. NIST has long deprecated DES because its effective 56-bit key size is too small for modern security requirements. ECB mode is also discouraged because it does not hide repeating plaintext patterns. Current best practice is to use AES with an approved mode such as CBC with proper IV handling or, preferably, an authenticated encryption mode like GCM, which provides confidentiality and integrity. Rotating to unique session keys reduces the blast radius of key compromise and improves forward security within the limits of a symmetric design. Relevant guidance can be found in NIST SP 800-38A for block cipher modes of operation and NIST recommendations deprecating DES in favor of AES.
- A. Correct.
Correct. DES is obsolete because its 56-bit key is vulnerable to brute-force attacks, and ECB mode leaks patterns because identical plaintext blocks produce identical ciphertext blocks. Moving to AES-256 with a secure mode such as CBC or, preferably, authenticated encryption like GCM, significantly improves confidentiality. Using unique session keys limits exposure if one key is compromised and aligns with sound cryptographic practice.
- B. Incorrect.
Incorrect. Reusing the same DES key longer weakens security rather than improving it. DES already has an insufficient key length by modern standards, and extending key reuse increases the amount of ciphertext available for cryptanalysis while enlarging the impact of a single key compromise.
- C. Incorrect.
Incorrect. MD5 is a hash function, not an encryption algorithm, so it cannot be used to recover the original data at the receiving side. It is also considered cryptographically broken for collision resistance. This option reflects the common misconception that hashing can replace encryption for confidentiality.
- D. Incorrect.
Incorrect. Base64 is only an encoding scheme for representing binary data in ASCII form; it provides no cryptographic protection. ECB would still reveal structural patterns in the plaintext, and an attacker could easily decode Base64 before analyzing the ciphertext.