nerdexam
GIAC

GSEC · Question #206

SSL session keys are available in which of the following lengths?

The correct answer is A. 40-bit and 128-bit. SSL symmetric session keys are available in two standard lengths - 40-bit (export-grade) and 128-bit (full-strength domestic) - reflecting historical US export regulations on cryptography.

Defense in Depth and Protocols

Question

SSL session keys are available in which of the following lengths?

Options

  • A40-bit and 128-bit.
  • B64-bit and 128-bit.
  • C128-bit and 1,024-bit.
  • D40-bit and 64-bit.

How the community answered

(59 responses)
  • A
    83% (49)
  • B
    10% (6)
  • C
    2% (1)
  • D
    5% (3)

Why each option

SSL symmetric session keys are available in two standard lengths - 40-bit (export-grade) and 128-bit (full-strength domestic) - reflecting historical US export regulations on cryptography.

A40-bit and 128-bit.Correct

SSL/TLS historically used 40-bit symmetric session keys for export-compliant ciphers (required by US export law prior to 2000) and 128-bit keys for full-strength domestic encryption. These two lengths represent the practical range of SSL session key strengths used in real-world deployments.

B64-bit and 128-bit.

64-bit is not a standard SSL session key length; SSL skipped from 40-bit export keys directly to 128-bit full-strength keys.

C128-bit and 1,024-bit.

1,024-bit keys are associated with RSA asymmetric key exchange (used for authentication and key negotiation), not the symmetric session keys SSL uses for bulk data encryption.

D40-bit and 64-bit.

While 40-bit is a valid SSL session key length, 64-bit is not a recognized SSL symmetric session key length.

Concept tested: SSL symmetric session key length standards

Source: https://www.rfc-editor.org/rfc/rfc6101

Topics

#SSL#session key length#encryption key size#symmetric encryption

Community Discussion

No community discussion yet for this question.

Full GSEC Practice