8 Cryptographic Applications and Secure Implementation Free Online FlashCards

What does authenticated encryption provide for stored data?

Authenticated encryption, such as AES-GCM or AES-CCM, protects confidentiality and detects unauthorized changes.

How does envelope encryption protect a data-encryption key?

Envelope encryption uses a data-encryption key (DEK) to encrypt data, then protects the DEK with a separately managed key-encryption key (KEK).

What must an HTTPS client verify to help prevent server impersonation?

Clients should verify the server certificate and hostname. Disabling certificate validation defeats protection against impersonation.

What does a digital signature provide—and what does it not provide?

A digital signature supports integrity and shows that the signer controlled the corresponding private key; it does not encrypt the data.

Why must AES-GCM nonces not be reused with the same key?

In AES-GCM, reusing a nonce with the same key can seriously undermine security. Use library-supported generation and follow usage limits.

How can an application reduce replay risk for sensitive requests?

Use workflow controls such as unique request identifiers and duplicate detection; encryption or a valid signature alone does not necessarily prevent replay.

What should an application do when authenticated decryption fails?

Reject the data. Do not use or return partially decrypted plaintext when authentication fails.

How is associated data protected in authenticated encryption?

Associated data is authenticated but not encrypted. Supply it consistently during decryption.

How can envelope encryption support key rotation?

Rewrap the DEK under the new KEK; this can avoid re-encrypting all the data.

How do authentication and authorization differ?

Authentication identifies who is making a request; authorization checks whether that identity may perform the action on the resource.

What should an API validate when accepting a signed token?

Validate token signatures and relevant claims, such as issuer, audience, and expiration, using a maintained implementation.

How does a MAC differ from an unkeyed cryptographic hash?

A hash produces a digest but does not prove who created the data. A MAC uses a shared secret key to verify message integrity and authenticity.