GIAC
GSLC · Question #447
GSLC Question #447: Real Exam Question with Answer & Explanation
The correct answer is B. Diffie-Hellman. Diffie-Hellman key exchange is inherently vulnerable to man-in-the-middle attacks because it establishes a shared secret without authenticating the identities of the communicating parties.
Question
John works as a professional Ethical Hacker. He has been assigned the project of testing the to a man-inthe-middle attack since the key exchange process of the cryptographic algorithm it is using does not authenticate participants. Which of the following cryptographic algorithms is being used by the Weare-secure server?
Options
- ARSA
- BDiffie-Hellman
- CTwofish
- DBlowfish
Explanation
Diffie-Hellman key exchange is inherently vulnerable to man-in-the-middle attacks because it establishes a shared secret without authenticating the identities of the communicating parties.
Common mistakes.
- A. RSA incorporates digital signatures and certificate-based authentication through PKI, which allows parties to verify each other's identities and prevents a straightforward MITM substitution of keys.
- C. Twofish is a symmetric block cipher used to encrypt data after a key has already been established; it is not a key exchange protocol and therefore not vulnerable to the MITM key substitution attack described.
- D. Blowfish is a symmetric block cipher used for bulk data encryption, not a key exchange algorithm, so it does not involve the participant authentication gap that enables a man-in-the-middle attack.
Concept tested. Diffie-Hellman unauthenticated key exchange MITM vulnerability
Reference. https://csrc.nist.gov/publications/detail/sp/800-56a/rev-3/final
Community Discussion
No community discussion yet for this question.