nerdexam
CompTIA

CAS-002 · Question #256

When generating a new key pair, a security application asks the user to move the mouse and type random characters on the keyboard. Which of the following BEST describes why this is necessary?

The correct answer is B. The user is providing entropy so the application can use random data to create the key pair. Mouse movements and random keystrokes supply entropy - unpredictable input - that the application uses to seed its random number generator for cryptographic key pair creation.

Enterprise Security

Question

When generating a new key pair, a security application asks the user to move the mouse and type random characters on the keyboard. Which of the following BEST describes why this is necessary?

Options

  • AThe user needs a non-repudiation data source in order for the application to generate the
  • BThe user is providing entropy so the application can use random data to create the key pair.
  • CThe user is providing a diffusion point to the application to aid in creating the key pair.
  • DThe application is requesting perfect forward secrecy from the user in order to create the

How the community answered

(23 responses)
  • A
    4% (1)
  • B
    96% (22)

Why each option

Mouse movements and random keystrokes supply entropy - unpredictable input - that the application uses to seed its random number generator for cryptographic key pair creation.

AThe user needs a non-repudiation data source in order for the application to generate the

Non-repudiation involves binding an identity to an action through digital signatures; it is not a data source required as input during key pair generation.

BThe user is providing entropy so the application can use random data to create the key pair.Correct

Cryptographic key generation requires a source of unpredictable, high-quality random data known as entropy to ensure the resulting key cannot be guessed or reproduced. User actions such as mouse movements and keystrokes introduce non-deterministic input that increases the randomness of the underlying random number generator. Without sufficient entropy, the key generation process may produce weak or predictable keys that are vulnerable to brute-force attacks.

CThe user is providing a diffusion point to the application to aid in creating the key pair.

Diffusion is a cryptographic property of cipher design that spreads plaintext influence throughout ciphertext, not a concept related to key pair generation input collection.

DThe application is requesting perfect forward secrecy from the user in order to create the

Perfect forward secrecy is a key-agreement property ensuring past session keys remain secure if long-term keys are later compromised; it is not something requested from the user as input during key generation.

Concept tested: Entropy and randomness in cryptographic key generation

Source: https://csrc.nist.gov/publications/detail/sp/800-133/rev-2/final

Topics

#entropy#key generation#cryptography#randomness

Community Discussion

No community discussion yet for this question.

Full CAS-002 Practice