312-50 Question 455
Single answer▪ Encryption AlgorithmsDuring an internal security assessment, you discover that a legacy web application uses AES-CBC to encrypt session data stored in client-side cookies. The application does not include any separate integrity check or authentication tag. The development team asks whether this design is acceptable because AES is a strong encryption algorithm. As the ethical hacker, which finding is the MOST accurate?
- A
The design is risky because AES-CBC provides confidentiality but not integrity, making the application vulnerable to tampering such as bit-flipping or padding-oracle style attacks if error handling leaks information.
- B
The design is secure because AES is a NIST-approved algorithm, so any mode using AES automatically protects against tampering and forgery.
- C
The design is secure as long as the AES key length is increased to 256 bits, because longer keys prevent modification of encrypted cookie values.
- D
The design is acceptable because client-side cookies are only encoded for transport and do not require cryptographic integrity if encrypted with a modern block cipher.
Show answer and explanation
Correct answer: A
Explanation
The best answer is Option 1. In real-world assessments, a common mistake is assuming encryption alone is enough to secure client-side session data. AES-CBC can protect confidentiality, but it does not verify whether ciphertext has been altered. For session cookies or any client-controlled token containing authorization or state information, best practice is to use authenticated encryption, such as AES-GCM, or to combine encryption with a strong message authentication code using an encrypt-then-MAC design. NIST SP 800-38A defines CBC mode, while NIST SP 800-38D defines GCM as an authenticated encryption mode. OWASP guidance also emphasizes that sensitive client-side tokens must be protected against tampering, not just hidden from view. From a CEH perspective, identifying the lack of integrity protection is the key applied-security finding.
- A. Correct.
Correct. AES-CBC is a confidentiality mechanism, not an authenticated encryption scheme by itself. Without a separate MAC (such as HMAC) or use of an AEAD mode like AES-GCM or ChaCha20-Poly1305, encrypted cookies may be modified by an attacker. In practice, CBC-mode ciphertext can be subject to bit-flipping effects, and implementations that reveal padding errors differently from other failures can be exposed to padding oracle attacks. This is a realistic security issue in web applications that trust encrypted but unauthenticated client-side state.
- B. Incorrect.
Incorrect. While AES is NIST-approved, approval of the underlying cipher does not mean every mode of operation provides all security properties. CBC mode provides confidentiality when implemented correctly, but it does not inherently provide integrity or authenticity. This option reflects the common misconception that a strong cipher alone guarantees secure application design.
- C. Incorrect.
Incorrect. Increasing the key size from 128 to 256 bits affects resistance to brute-force key search, not protection against ciphertext tampering. An attacker who cannot decrypt the cookie may still be able to alter ciphertext in meaningful ways if the system lacks integrity protection. Key length does not substitute for authenticated encryption.
- D. Incorrect.
Incorrect. If the application stores security-relevant session state in client-side cookies, integrity is critical. Encryption alone is insufficient because the server may decrypt and trust attacker-modified data. This option confuses confidentiality with authenticity and ignores the risk of attackers manipulating encrypted state.