CAS-001 · Question #406
A security engineer wants to implement forward secrecy but still wants to ensure the number of requests handled by the web server is not drastically reduced due to the larger computational…
The correct answer is B. ECDHE. ECDHE (Elliptic Curve Diffie-Hellman Ephemeral) (B) provides Perfect Forward Secrecy (PFS) through ephemeral key pairs while using elliptic curve mathematics. Elliptic curve operations achieve equivalent cryptographic strength to traditional Diffie-Hellman at dramatically…
Question
A security engineer wants to implement forward secrecy but still wants to ensure the number of requests handled by the web server is not drastically reduced due to the larger computational overheads. Browser compatibility is not a concern; however system performance is. Which of the following, when implemented, would BEST meet the engineer's requirements?
Options
- ADHE
- BECDHE
- CAES128-SHA
- DDH
How the community answered
(24 responses)- A8% (2)
- B71% (17)
- C4% (1)
- D17% (4)
Explanation
ECDHE (Elliptic Curve Diffie-Hellman Ephemeral) (B) provides Perfect Forward Secrecy (PFS) through ephemeral key pairs while using elliptic curve mathematics. Elliptic curve operations achieve equivalent cryptographic strength to traditional Diffie-Hellman at dramatically smaller key sizes (e.g., 256-bit ECC ≈ 3072-bit RSA/DH), resulting in significantly lower CPU cost and faster handshakes. This directly addresses the performance constraint. DHE (A) also provides PFS but uses traditional discrete logarithm math, requiring larger key sizes and imposing higher computational overhead. DH (D) uses static (non-ephemeral) keys and therefore does NOT provide forward secrecy. AES128-SHA (C) is a symmetric bulk-encryption cipher suite component, not a key-exchange mechanism, and provides no forward secrecy on its own.
Topics
Community Discussion
No community discussion yet for this question.