Test on Digital Signatures, PKI, and Cryptographic Protocols

Question 1: If a system encounters an X.509v3 certificate extension field it does not recognize and the field is marked as critical, the system can proceed by ignoring only that specific field and processing the rest of the certificate.

A. Ano

B. Ne

Explanation: According to the study materials, if a system encounters an extension field it doesn’t know and the field is marked critical, the system must reject the whole certificate, not just ignore the field and continue processing.

Question 2: According to the study materials, which statement accurately describes a Certificate Revocation List (CRL)?

A. A CRL is also known as a blacklist.

B. A CRL is fundamentally a list of all current digital certificates issued by a Certification Authority.

C. A CRL contains specific details for each revoked entry, including the certificate's serial number and revocation time.

D. The Online Certificate Status Protocol (OCSP) is generally preferred over CRLs due to its superior freshness.

Explanation: The study materials state that a CRL is a 'Blacklist', making option 0 correct. It also explicitly mentions that a CRL 'is not a list of certificates !', making option 1 incorrect. For its content, the materials specify 'revokedCertificates : CertificateSerialNumber , Time, (Extensions)', confirming option 2 is correct. Lastly, the materials indicate that OCSP is the 'Preferred method (freshness)' compared to CRLs, making option 3 correct.

Question 3: Random numbers provide freshness guarantees and chain protocol messages together, requiring them to be unpredictable and never intentionally re-used by honest parties.

A. Ano

B. Ne

Explanation: Random numbers offer freshness guarantees and link protocol messages. They must be unpredictable, never intentionally re-used by honest parties, and sufficiently long.

Question 4: Zero-knowledge authentication is the most common principal level of entity authentication.

A. Ano

B. Ne

Explanation: The study materials state that 'Challenge - response with cryptographic key' is the 'Most common' level, while 'Zero - knowledge' is 'Best in theory, often very complicated – not much used for decades', not the most common.

Question 5: According to the study materials, when establishing a simple public-key encrypted session key using the format A → B: P B (S A ( “ B ” , K , t A )), what is a key characteristic if a signature scheme with message recovery is employed?

A. It is not possible to obtain the session key (K).

B. It allows the recipient to retrieve the session key (K).

C. It is primarily used for signature schemes that rely on an appendix.

D. It necessitates that the session key (K) is sent in plaintext.

Explanation: The study materials state: "A → B: P B (S A ( “ B ” , K , t A )) • For signature schemes with message recovery (otherwise cannot get K)". This indicates that using a signature scheme with message recovery in this specific example allows the recipient to obtain the session key (K).