Quiz: Affine and Stream Ciphers — 60 questions

1. Regarding cryptology, which statement or statements are correct?

A. Cryptography attempts to defeat cryptosystems, whereas cryptanalysis builds protections.

B. Cryptology includes the study of constructing and attacking cryptosystems.

C. Cryptology is the general field encompassing cryptography and cryptanalysis.

D. The broad scope of cryptology covers protective and adversarial techniques.

E. Cryptography and cryptanalysis are both subfields within cryptology.

Answer: (B), (C), (D), (E)

Explanation

Cryptology is the overarching field that includes both cryptography and cryptanalysis. Cryptography builds protections for communication, whereas cryptanalysis studies ways to defeat cryptosystems; cryptology therefore covers both activities.

2. Cryptography and cryptanalysis are distinguished by which correct statements?

A. Cryptography and cryptanalysis both focus on producing secret keys.

B. Cryptography builds protections, whereas cryptanalysis attempts to defeat cryptosystems.

C. Cryptography and cryptanalysis are identical terms for encryption procedures.

D. Cryptography attacks cipher structure, whereas cryptanalysis secures communication.

E. Cryptography studies how to break systems, whereas cryptanalysis constructs protections.

Answer: (B)

Explanation

Cryptography secures communication against adversaries, while cryptanalysis studies how cryptosystems can be broken. The other statements reverse or erase this distinction.

3. Which statements correctly compare symmetric and asymmetric cryptography?

A. Symmetric and asymmetric algorithms have identical key arrangements.

B. Symmetric cryptography uses separate private and public keys.

C. Symmetric encryption and decryption use one shared secret key.

D. Asymmetric cryptography uses the same secret key for both users.

E. Asymmetric encryption uses a private key, while decryption uses a public key.

Answer: (C)

Explanation

Symmetric encryption and decryption use one shared secret key, so symmetric algorithms do not have identical key arrangements, separate private and public keys, or distinct secret keys for the two users. Asymmetric cryptography uses a public key for encryption and the corresponding private key for decryption, rather than reversing these roles.

4. In a symmetric cryptosystem, Alice encrypts plaintext $x$ with key $k$ to obtain ciphertext $y$. Which statements are correct?

A. Bob recovers plaintext $x$ by decrypting ciphertext $y$ with a different key.

B. Alice encrypts plaintext $x$ with a public key and Bob decrypts it privately.

C. Bob decrypts ciphertext $y$ with the same key $k$ to recover plaintext $x$.

D. The symmetric process produces ciphertext $x$ and recovers plaintext $y$.

E. Alice decrypts ciphertext $y$ with key $k$ before Bob receives it.

Answer: (C)

Explanation

The symmetric process is $x \xrightarrow{k} y$ followed by decryption of $y$ with the same key $k$ to recover $x$. Public-key use, a different decryption key, reversed operations, and swapped plaintext labels do not describe this process.

5. Which statements accurately distinguish brute-force and analytical attacks?

A. An analytical attack checks every key as a black-box search.

B. A brute-force attack tests possible keys without analyzing cipher structure.

C. Brute-force and analytical attacks use the same method of key discovery.

D. A brute-force attack depends on identifying structural weaknesses first.

E. An analytical attack exploits the internal structure of a cipher.

Answer: (B), (E)

Explanation

Brute force treats the cipher as a black box and searches keys, whereas analytical attacks exploit internal structure. The remaining statements exchange or collapse these distinct methods.

6. A ciphertext and its corresponding plaintext are available for testing. Which statements describe a brute-force attack?

A. The attack requires discovering the cipher’s internal weakness first.

B. Each candidate key is used to decrypt ciphertext $y$.

C. The attacker infers substitutions primarily from letter-frequency statistics.

D. The attacker tests candidate keys across the entire key space.

E. The attacker encrypts plaintext $x$ to generate unrelated test messages.

Answer: (B), (D)

Explanation

A brute-force attack searches candidate keys and decrypts $y$ with each one, checking whether the result matches known plaintext $x$. Frequency inference and structural analysis describe other approaches, while generating unrelated messages is not the stated procedure.

7. Regarding the congruence relation $a\equiv r\pmod m$, which statements are correct?

A. The remainder determines the modulus used in the congruence.

B. The modulus determines the relevant equivalence relation.

C. The positive integer $m$ is called the modulus.

D. The relation holds when $m$ divides $a-r$.

E. The value $r$ is called a remainder in the relation.

Answer: (B), (C), (D), (E)

Explanation

The congruence holds precisely when $m\mid(a-r)$; $m$ is the modulus and $r$ is a remainder. The modulus determines the equivalence relation, not the remainder.

8. Which statements correctly describe the division representation of an integer?

A. The associated congruence is $a\equiv q\pmod m$.

B. The representation requires $r\ge m$ for every positive modulus.

C. Every integer $a$ can be written as $a=q\cdot m+r$.

D. The quotient and remainder satisfy $a=q+m+r$.

E. The remainder satisfies $0\le r<m$.

Answer: (C), (E)

Explanation

For a positive modulus, every integer has the form $a=q\cdot m+r$ with $0\le r<m$, yielding $a\equiv r\pmod m$. The other formulas impose an incorrect remainder condition or alter the quotient and remainder relationship.

9. An element $a$ of $\mathbb Z_m$ has a multiplicative inverse under which condition?

A. A multiplicative inverse exists exactly when $\gcd(a,m)=1$.

B. An inverse exists when $a$ is divisible by $m$.

C. Every element has an inverse whenever $m$ is positive.

D. Invertibility requires $a=m$ in the integer ring.

E. An inverse exists when $a$ and $m$ share a common factor.

Answer: (A)

Explanation

An element of $\mathbb Z_m$ is invertible if and only if $a$ and $m$ are coprime, meaning $\gcd(a,m)=1$. Sharing a factor, equality with the modulus, positivity alone, or divisibility by the modulus does not establish invertibility.

10. Regarding the affine cipher, which statements are correct?

A. Decryption uses the modular inverse of the multiplier.

B. Encryption combines multiplication and addition modulo 26.

C. The cipher uses addition without multiplication, like a shift cipher.

D. The multiplier may be any residue modulo 26.

E. The key consists of a single additive displacement value.

Answer: (A), (B)

Explanation

Affine encryption uses multiplication by a and addition of b modulo 26, while decryption uses the inverse of a. A shift cipher uses addition only, the affine key contains two values, and the multiplier must be relatively prime to 26.

11. The key space of the affine cipher has which characteristics?

A. The total number of keys is 312.

B. The cipher has 676 possible keys from unrestricted parameter pairs.

C. The multiplier contributes 26 valid choices modulo 26.

D. There are 26 possible additive values for b.

E. There are 12 possible valid multiplier values for a.

Answer: (A), (D), (E)

Explanation

The affine cipher has 12 valid choices for a and 26 choices for b, giving $12\times26=312$ keys. The multiplier is restricted to residues relatively prime to 26, so unrestricted parameter counting is incorrect.

12. Concerning the cryptanalytic weaknesses of the affine cipher:

A. Its small key space permits exhaustive search attacks.

B. Its security is limited by the fixed nature of its mapping.

C. Each plaintext letter maps consistently to one ciphertext letter.

D. Fixed letter mappings support letter-frequency analysis.

E. Frequency patterns can remain detectable under its substitution.

Answer: (A), (B), (C), (D), (E)

Explanation

The affine cipher has only 312 keys, making exhaustive search feasible. Its fixed plaintext-to-ciphertext mapping preserves exploitable frequency patterns, so frequency analysis can assist attacks.

13. Regarding security, safety, and reliability, select the correct statement.

A. Reliability focuses on hostile human behavior during operation.

B. Security addresses threats from malicious human actors.

C. Cybersecurity primarily concerns random hardware failures.

D. Technical safety and security describe identical threat models.

E. Technical safety primarily addresses deliberate cyberattacks.

Answer: (B)

Explanation

Security and cybersecurity protect against malicious human actors. Technical safety and reliability primarily concern random technical failures during normal operation, so the other statements confuse these threat models.

14. Which statements accurately describe the basic security goals?

A. Availability belongs to the traditional CIA triad.

B. Confidentiality belongs to the traditional CIA triad.

C. Authenticity may be treated as an additional security goal.

D. Integrity belongs to the traditional CIA triad.

E. The CIA triad consists of confidentiality, authenticity, and availability.

Answer: (A), (B), (C), (D)

Explanation

The CIA triad comprises confidentiality, integrity, and availability. Authenticity is often added as a further goal, whereas it does not replace integrity within the traditional triad.

15. A systematic IT-security approach includes which activities?

A. It examines possible paths attackers could use.

B. It identifies assets and their security needs.

C. It specifies countermeasures suited to the application.

D. It selects countermeasures before identifying assets.

E. It evaluates possible attack potential against the environment.

Answer: (A), (B), (C), (E)

Explanation

A systematic approach defines assets and needs, evaluates attack potential and attack paths, and specifies adequate countermeasures. Countermeasures are selected as part of an informed process rather than before assets are identified.

16. Concerning Kerckhoffs’ Principle, which propositions are correct?

A. The principle requires the encryption key to be publicly disclosed.

B. Compromising the system should not inconvenience correspondents.

C. The principle is associated with Auguste Kerckhoffs.

D. The cryptographic design should not depend on design secrecy.

E. Kerckhoffs stated the principle in 1883.

Answer: (B), (C), (D), (E)

Explanation

Kerckhoffs’ Principle requires security not to depend on keeping the system design secret, and compromise of the system should not inconvenience correspondents. It is attributed to Auguste Kerckhoffs in 1883, but it does not require publishing the key.

17. Regarding stream and block ciphers, which statements are correct?

A. A block cipher processes a block containing b plaintext bits.

B. A stream cipher combines plaintext bits with key-stream bits.

C. Stream ciphers operate on individual bits.

D. Block ciphers operate on groups of bits under one key.

E. A stream cipher encrypts fixed blocks of b bits as its basic unit.

Answer: (A), (B), (C), (D)

Explanation

Stream ciphers combine individual plaintext bits with key-stream bits, whereas block ciphers process blocks of b bits under the same key. Therefore, fixed blocks are characteristic of the block-cipher description, not the stream-cipher basic unit.

18. How do synchronous and asynchronous stream ciphers differ?

A. The two constructions generate key streams from identical inputs.

B. Asynchronous generation depends on the key but not ciphertext.

C. An asynchronous key stream also depends on ciphertext.

D. Synchronous generation requires ciphertext feedback.

E. A synchronous key stream depends on the key.

Answer: (C), (E)

Explanation

In a synchronous stream cipher, the key stream depends only on the key. In an asynchronous stream cipher, ciphertext also contributes to key-stream generation, so the remaining statements reverse or erase this distinction.

19. For stream-cipher bits, select the correct propositions:

A. The ciphertext satisfies $y_i\equiv x_i+s_i\pmod{2}$.

B. The plaintext satisfies $x_i\equiv y_i+s_i\pmod{2}$.

C. Decryption adds ciphertext and key-stream bits modulo 2.

D. Encryption adds plaintext and key-stream bits modulo 2.

E. Decryption subtracts the key-stream bit modulo 2.

Answer: (A), (B), (C), (D)

Explanation

Both encryption and decryption use modulo-2 addition: $y_i\equiv x_i+s_i\pmod{2}$ and $x_i\equiv y_i+s_i\pmod{2}$. Modulo-2 addition is its own inverse, so decryption is not described as subtraction here.

20. Modulo-2 addition in a stream cipher has which equivalent interpretation?

A. It produces the same result as logical AND for binary inputs.

B. It combines two binary inputs using XOR logic.

C. It is equivalent to ordinary decimal addition without carries.

D. It is equivalent to the exclusive-OR operation.

E. It is the operation used for bitwise stream-cipher mixing.

Answer: (B), (D), (E)

Explanation

Modulo-2 addition is equivalent to exclusive OR, or XOR, and is used to combine plaintext and key-stream bits. It is not ordinary decimal addition without carries in every interpretation, nor is it equivalent to AND.

21. Regarding true and pseudorandom number generators, which propositions are correct?

A. A pseudorandom generator obtains each output directly from an unpredictable physical process.

B. A pseudorandom generator computes a deterministic sequence from an initial seed.

C. A true random generator obtains non-reproducible outputs from a physical process.

D. A pseudorandom generator can produce reproducible outputs when its seed is known.

E. A true random generator reproduces its entire sequence from a stored seed.

Answer: (B), (C), (D)

Explanation

True random generators rely on physical processes and therefore produce non-reproducible outputs. Pseudorandom generators compute deterministic sequences from seeds, so known seeds permit reproducibility; they do not directly obtain each output from physical randomness.

22. A cryptographically secure pseudorandom number generator is characterized by which propositions?

A. Its output sequence is required to originate from a physical random process.

B. Its subsequent bits remain computationally infeasible to predict from consecutive outputs.

C. Its security concerns both future and past output-bit prediction.

D. Its preceding bits are efficiently recoverable from any consecutive output segment.

E. It remains difficult to compute hidden sequence bits from observed consecutive bits.

Answer: (B), (C), (E)

Explanation

A cryptographically secure pseudorandom generator makes computing subsequent or preceding bits computationally infeasible from consecutive outputs. This is a computational property of a PRNG, not a requirement that the generator use a physical process.

23. Unconditional security means that a cryptosystem has which property?

A. It cannot be broken even when an attacker has unlimited computational resources.

B. Its security depends on an attacker having insufficient computational resources.

C. It cannot be defeated by increasing the available computation.

D. Its protection remains valid against attackers with infinite computing power.

E. It is secure because its key stream is generated deterministically.

Answer: (A), (C), (D)

Explanation

Unconditional security means that breaking the cryptosystem is impossible even with infinite computational resources. Security based on limited computational power is computational security, and deterministic generation alone does not establish unconditional security.

24. Which propositions correctly describe a one-time pad?

A. The key stream is generated deterministically from a short secret key.

B. The key stream is known to the legitimate communicating parties.

C. Each key-stream bit is used exactly once during encryption.

D. Each key-stream bit may be reused across several messages.

E. Its key stream is generated using a true random number generator.

Answer: (B), (C), (E)

Explanation

A one-time pad uses a true-random key stream shared by the legitimate parties, with every bit used once. It is not generated deterministically from a short key, and reusing key-stream bits violates the one-time-pad construction.

25. Concerning the structure of a linear feedback shift register, which propositions are correct?

A. The number of flip-flops determines the register degree.

B. The register is clocked to shift its stored contents over time.

C. Its structure differs from nonlinear designs that include AND operations.

D. Its feedback operation is linear over binary values.

E. Its input is formed by XORing selected bits of the register.

Answer: (A), (B), (C), (D), (E)

Explanation

An LFSR is clocked and uses the XOR-sum of selected register bits as its input. Its degree equals the number of flip-flops, and XOR feedback is linear, unlike constructions incorporating nonlinear operations such as AND.

26. For an LFSR of degree $m$, which recurrence statements are correct?

A. The sequence value at position $m+i$ depends on the preceding $m$ sequence values.

B. The recurrence is evaluated modulo $2$.

C. The feedback coefficients are denoted $p_0$ through $p_{m-1}$.

D. The recurrence combines terms using ordinary integer arithmetic without reduction.

E. The recurrence requires nonlinear products between sequence terms.

Answer: (A), (B), (C)

Explanation

The LFSR recurrence uses the preceding $m$ values, coefficients $p_0$ through $p_{m-1}$, and arithmetic modulo $2$. It is linear binary arithmetic, not unreduced integer arithmetic or nonlinear multiplication.

27. Which propositions correctly describe the maximum period of a degree-$m$ LFSR?

A. An all-zero state eventually develops nonzero register bits through feedback.

B. The all-zero state is excluded from the maximum-length sequence.

C. The maximum length includes the all-zero state as a cycling state.

D. The all-zero state remains stuck because its feedback remains zero.

E. Its maximum sequence length is $2^m-1$.

Answer: (B), (D), (E)

Explanation

A degree-$m$ LFSR can have maximum length $2^m-1$ because the all-zero state is excluded. That state remains stuck at zero, so it neither cycles through the maximum sequence nor develops nonzero bits.

28. A known-plaintext attack against a degree-$m$ LFSR involves which steps?

A. The recurrence supplies $m$ linear equations for the unknown coefficients.

B. Gaussian elimination can solve the resulting linear system.

C. The attack requires guessing the entire feedback sequence without using equations.

D. The attacker must first introduce nonlinear AND equations into the recurrence.

E. The attacker derives the key stream from known plaintext and ciphertext.

Answer: (A), (B), (E)

Explanation

Known plaintext and ciphertext reveal the key stream, allowing the attacker to form $m$ linear recurrence equations. Gaussian elimination or matrix inversion can solve for the feedback coefficients; nonlinear equations and blind guessing are not required.

29. Regarding Salsa20 and ChaCha20 encryption and decryption, which propositions are correct?

A. The key stream is generated from a key, nonce, and block number.

B. Decryption XORs the ciphertext with the same key stream.

C. Encryption XORs the plaintext with a key stream.

D. The secret key must remain confidential during normal use.

E. The nonce does not need to be kept secret from observers.

Answer: (A), (B), (C), (D), (E)

Explanation

Salsa20 and ChaCha20 generate a key stream from the key, nonce, and block number. XOR with plaintext encrypts, XOR with ciphertext decrypts, the nonce may be public, and the key must remain secret.

30. Why must a nonce change for every encryption session in these stream-cipher constructions?

A. Nonce variation protects against repeated key-stream generation.

B. Changing the nonce prevents key-stream reuse under the same key.

C. Using a new nonce separates encryptions performed with one secret key.

D. A fixed nonce guarantees a fresh key stream for every session.

E. The nonce must be kept secret to prevent key-stream reuse.

Answer: (A), (B), (C)

Explanation

A new nonce ensures that encryptions under the same key do not reuse the same key stream. A fixed nonce can reproduce the stream, and nonce secrecy is not the required protection mechanism.

31. During Trivium initialization, which propositions are correct?

A. The remaining positions are set to zero except for three rightmost bits of register C.

B. The 80-bit key fills the leftmost locations of register A.

C. The cipher is clocked 1152 times before output generation begins.

D. The 80-bit initialization vector fills register C.

E. The cipher produces keystream output during all 1152 initialization clocks.

Answer: (A), (B), (C)

Explanation

Trivium places the key in register A, the initialization vector in register B, and initializes the remaining positions with zeros except for three rightmost bits of register C. It then performs 1152 clocks without producing output, so the initialization vector does not fill register C and output is not produced during these clocks.

32. Which statements correctly describe the arithmetic in Trivium's register-update equations?

A. The remaining additions in the update equations represent XOR operations.

B. The AND terms in the update equations are multiplications modulo 2.

C. The nonlinear terms use modulo-2 exponentiation rather than multiplication.

D. The update equations contain no nonlinear products involving register bits.

E. Every term in the update equations is evaluated as an ordinary integer sum.

Answer: (A), (B)

Explanation

The products in Trivium's update equations are modulo-2 multiplications, creating the nonlinear terms. The other additions are XOR operations; therefore, the equations are not ordinary integer sums and do contain nonlinear products.

33. A Trivium implementation has completed its initialization phase. Which statements about the warm-up phase are correct?

A. The warm-up phase ends when output begins in cycle 1152.

B. The warm-up phase lasts 1152 clock cycles.

C. The warm-up length equals four times the total register length.

D. The warm-up phase lasts 288 clock cycles.

E. The total register length used in this calculation is 288 bits.

Answer: (B), (C), (E)

Explanation

Trivium performs a warm-up phase of 1152 clock cycles, equal to four times its total register length of 288 bits. Output begins in cycle 1153, so the warm-up does not end in cycle 1152 and does not last 289 or 288 cycles.

34. Which statements accurately describe how Trivium is initialized?

A. The initialization vector is loaded into register C.

B. All three registers are initialized entirely with zeros.

C. The 80-bit key is loaded into register A.

D. The 80-bit initialization vector is loaded into register B.

E. The three rightmost bits of register C are set to one.

Answer: (C), (D), (E)

Explanation

Initialization loads the 80-bit key into A and the 80-bit initialization vector into B. Other positions are zero, while the three rightmost bits of C are one; thus C is not entirely zero and the initialization vector is not loaded there.

35. Which statements correctly characterize the known attack context for Trivium?

A. Reducing initialization to 799 iterations enabled the reported attack.

B. The weakened version required more than $2^{80}$ steps for the reported attack.

C. No attack on full Trivium was known below a complexity of $2^{80}$ steps.

D. A weakened version using 799 initialization iterations could be attacked in $2^{68}$ steps.

E. The full cipher was attacked in $2^{68}$ steps with its standard initialization.

Answer: (A), (C), (D)

Explanation

No attack on full Trivium was known below $2^{80}$ steps, whereas a version with 799 initialization iterations was attacked in $2^{68}$ steps. The reported attack applies to the weakened initialization, not standard full Trivium, and its complexity is below $2^{80}$.

36. Concerning true random number generators, which proposition is correct?

A. A true random number generator uses an entropy source that behaves truly randomly.

B. A true random number generator derives bits primarily from a deterministic recurrence.

C. A true random number generator requires a fixed secret key as its entropy source.

D. A true random number generator replaces physical entropy with a cryptographic permutation.

E. A true random number generator produces bits from a predictable clock sequence.

Answer: (A)

Explanation

A true random number generator exploits an entropy source that behaves truly randomly to produce random bits. A deterministic recurrence, a fixed secret key, a cryptographic permutation, or a predictable clock sequence does not provide the stated random entropy source.

37. Regarding confusion in block-cipher design, which statements are correct?

A. Confusion primarily spreads one plaintext symbol across many ciphertext symbols.

B. Confusion obscures the relationship between the key and the ciphertext.

C. Permutation is the operation commonly associated with confusion in the definition.

D. Substitution is a common way to provide confusion.

E. Claude Shannon identified confusion as an encryption operation.

Answer: (B), (D), (E)

Explanation

Confusion obscures key–ciphertext relationships and is commonly achieved through substitution. It is attributed here to Claude Shannon; spreading plaintext influence is diffusion, while permutations are commonly associated with diffusion.

38. Which statements correctly describe diffusion?

A. Permutations commonly contribute to diffusion.

B. Diffusion primarily obscures the relationship between the key and ciphertext.

C. Diffusion spreads the influence of one plaintext symbol over many ciphertext symbols.

D. Claude Shannon described diffusion as an encryption operation.

E. Substitution is the operation identified here as the common mechanism for diffusion.

Answer: (A), (C), (D)

Explanation

Diffusion spreads plaintext influence across many ciphertext symbols and commonly uses permutations. Claude Shannon described this operation; obscuring key–ciphertext relationships and using substitution characterize confusion instead.

39. For a DES Feistel round, which statements correctly apply the round transformation?

A. The new right half satisfies $R_i=L_{i-1}\oplus f(R_{i-1},k_i)$.

B. The new right half satisfies $R_i=R_{i-1}\oplus f(L_{i-1},k_i)$.

C. The round update uses the round function on the previous left half.

D. The new left half satisfies $L_i=L_{i-1}$.

E. The new left half satisfies $L_i=R_{i-1}$.

Answer: (A), (E)

Explanation

A DES Feistel round copies the previous right half into the new left half and computes the new right half as $L_{i-1}\oplus f(R_{i-1},k_i)$. The alternatives either preserve the wrong half or apply the round function to the wrong input.

40. Regarding the DES key representation and effective key size, which statement(s) are correct?

A. The effective DES key contains 56 bits available for cryptographic use.

B. The standard DES input representation contains 64 bits, including eight parity bits.

C. DES input keys are commonly represented with 56 total bits, including parity.

D. The eight parity bits contribute to the effective cryptographic key space.

E. DES generates sixteen round keys, each having a length of 48 bits.

Answer: (A), (B), (E)

Explanation

DES produces sixteen 48-bit round keys from an effective 56-bit key. Its input is commonly represented as 64 bits, of which eight are parity bits; those parity bits do not enlarge the effective key space.

41. The DES key schedule performs which sequence of operations?

A. PC–2 expands each 28-bit half into a 64-bit round key.

B. The post-PC–1 key is split into halves named C0 and D0.

C. PC–2 selects a 48-bit subkey from the rotated halves.

D. Both key halves are rotated left before round-key selection.

E. PC–1 removes parity bits before the key is divided into two halves.

Answer: (B), (C), (D), (E)

Explanation

PC–1 removes the eight parity bits and leaves two 28-bit halves, C0 and D0. The halves are rotated left each round, and PC–2 selects the resulting 48-bit subkey; it does not expand them to 64 bits.

42. A DES implementation is decrypting a ciphertext with the standard Feistel construction. Which statement(s) are correct?

A. The first decryption round uses subkey k16.

B. Decryption replaces the Feistel network with a separate substitution process.

C. Decryption uses the same Feistel structure as DES encryption.

D. The decryption subkeys are applied in reverse order from encryption.

E. The final decryption round uses subkey k16.

Answer: (A), (C), (D)

Explanation

DES decryption retains the Feistel structure and reverses the subkey order. Thus it begins with k16 and proceeds through k1, so the final round uses k1 rather than k16.

43. Which statement(s) correctly describe the vulnerability of DES to exhaustive key search?

A. DES has a key space containing $2^{56}$ possible effective keys.

B. Analytical attacks and exhaustive search are identical because both test every key.

C. DES is resistant to exhaustive search because its input representation has 64 bits.

D. The eight parity bits increase the DES key space from $2^{56}$ to $2^{64}$ keys.

E. DES exhaustive search must examine $2^{64}$ independent cryptographic keys.

Answer: (A)

Explanation

DES has an effective 56-bit key, giving a key space of $2^{56}$ possibilities. The 64-bit representation includes eight non-key parity bits, so it does not create $2^{64}$ cryptographic keys; exhaustive and analytical attacks are different approaches.

44. During an exhaustive DES key search using a known plaintext–ciphertext pair, which statement(s) are correct?

A. The search requires a chosen plaintext–ciphertext pair for every candidate key.

B. A candidate is accepted when decryption produces a value different from the plaintext.

C. The test applies the encryption operation to the ciphertext and compares it with the key.

D. A candidate key is tested by checking whether $DES^{-1}_{k_i}(y)=x$.

E. The procedure uses a known plaintext–ciphertext pair as its reference.

Answer: (D), (E)

Explanation

Exhaustive search uses a known plaintext–ciphertext pair and tests candidate keys using the relation $DES^{-1}_{k_i}(y)=x$. It does not require a separately chosen pair for every key, and a matching plaintext—not a different value—identifies a candidate.

45. Which statements accurately compare differential and linear cryptanalysis of DES?

A. Differential cryptanalysis may require $2^{47}$ chosen plaintext–ciphertext pairs.

B. Linear cryptanalysis requires $2^{47}$ plaintext–ciphertext pairs.

C. With random plaintext, differential cryptanalysis may require $2^{55}$ pairs.

D. Linear cryptanalysis uses the same pair requirement as favorable differential analysis.

E. Differential cryptanalysis has a fixed requirement independent of plaintext selection.

Answer: (A), (C)

Explanation

In the stated favorable setting, differential cryptanalysis requires $2^{47}$ chosen pairs, while random plaintext may require $2^{55}$ pairs. Linear cryptanalysis has a separate requirement of $2^{43}$ plaintext–ciphertext pairs, so the remaining statements confuse these attack conditions.

46. What is the appropriate current security assessment of single DES for confidential data?

A. Single DES is unsafe because its effective key contains 64 bits.

B. Single DES should not be used for confidential data because its key is too easy to search.

C. Single DES is acceptable when its 64-bit input representation is retained.

D. Single DES remains suitable because analytical attacks are practically efficient against it.

E. Single DES should be preferred because its key search cost is prohibitively high.

Answer: (B)

Explanation

Single DES should no longer protect confidential data because its effective 56-bit key can be searched at relatively low cost. Its 64-bit input representation includes eight parity bits, which are not key material. Current analytical attacks are not practically efficient against DES, but brute-force search is still feasible enough to rule out its use for confidential data.

47. Which statement(s) correctly characterize AES in comparison with DES?

A. AES is the algorithm of choice for many modern applications.

B. AES supports key lengths of 128, 192, and 256 bits.

C. AES offers substantially larger standard key sizes than DES.

D. AES accepts 64-bit keys with eight parity bits in its standard configurations.

E. AES uses an effective 56-bit key like single DES.

Answer: (A), (B), (C)

Explanation

AES supports 128-, 192-, and 256-bit keys and is the algorithm of choice for many modern applications. These standard key sizes are substantially larger than DES’s effective 56-bit key. AES does not use 64-bit keys with DES-style parity bits, nor does it use a 56-bit effective key.

48. Triple DES applies which transformation to a plaintext block?

A. Triple DES applies encryption, then two successive decryptions.

B. Triple DES applies encryption, then decryption, then encryption.

C. Triple DES applies a single DES encryption followed by a key permutation.

D. Triple DES applies decryption, then encryption, then decryption.

E. Triple DES applies three successive encryption operations with one key.

Answer: (B)

Explanation

Triple DES uses the EDE sequence: encryption under $k_1$, decryption under $k_2$, and encryption under $k_3$. The other sequences do not match the specified construction.

49. Regarding AES and Rijndael, which statement or statements are correct?

A. AES uses a 128-bit block for every supported key length.

B. Rijndael permits block lengths of 192 and 256 bits.

C. AES retains a fixed block size when its key length changes.

D. AES uses 192-bit blocks with its 192-bit keys.

E. Rijndael supports a broader range of block lengths than AES.

Answer: (A), (B), (C), (E)

Explanation

AES uses a fixed 128-bit block, while Rijndael also permits 192- and 256-bit blocks. Changing the AES key length changes the number of rounds, not the block size; AES does not use 192-bit blocks with 192-bit keys.

50. The number of AES rounds varies with the key length as follows:

A. A 256-bit AES key is processed through 12 rounds.

B. A 256-bit AES key is processed through 14 rounds.

C. A 192-bit AES key is processed through 12 rounds.

D. A 128-bit AES key is processed through 10 rounds.

E. Longer AES keys require more rounds than shorter supported keys.

Answer: (B), (C), (D), (E)

Explanation

AES uses 10, 12, and 14 rounds for 128-, 192-, and 256-bit keys, respectively. Thus, longer supported keys correspond to more rounds, while a 256-bit key does not use 12 rounds.

51. Which statements correctly describe NIST’s standardization of AES?

A. FIPS PUB 197 published Rijndael as the DES replacement in 1999.

B. NIST’s AES publication occurred in the year 2001.

C. NIST selected Rijndael as the new AES in 2001.

D. FIPS PUB 197 published AES as a United States standard.

E. The AES standardization decision identified Rijndael as the selected algorithm.

Answer: (B), (C), (D), (E)

Explanation

NIST selected Rijndael as AES and published it in FIPS PUB 197 in 2001. The publication was not issued in 1999, and the stated fact identifies it as the AES standard rather than describing it as a DES replacement.

52. AES candidates were expected to satisfy which requirements?

A. They had to offer competitive security.

B. They had to support 128-, 192-, and 256-bit keys.

C. They had to operate efficiently in software and hardware.

D. They had to use a 128-bit block size.

E. They were required to use 192-bit blocks for every candidate.

Answer: (A), (B), (C), (D)

Explanation

AES candidates were required to use 128-bit blocks, support the three specified key lengths, provide competitive security, and be efficient in both software and hardware. A 192-bit block size was not the stated requirement.

53. Which statements about the order of a finite field are correct?

A. The prime p in $q=p^m$ is the field characteristic.

B. A finite field of order q can exist when q is a prime power.

C. A finite field of order 12 is permitted because 12 is even.

D. A finite field of order 15 is permitted because 15 has prime factors.

E. The order can be written as $q=p^m$ with p prime.

Answer: (A), (B), (E)

Explanation

Finite fields have prime-power order, expressed as $q=p^m$, where p is prime and is the characteristic. Twelve and fifteen are not prime powers, so their being composite does not make them valid finite-field orders.

54. Regarding the algebraic structure of a field, which statements are correct?

A. Multiplication distributes over addition in a field.

B. The field elements form an additive abelian group.

C. A field permits nonzero elements without multiplicative inverses.

D. The nonzero field elements form a multiplicative abelian group.

E. A field requires multiplication to be noncommutative.

Answer: (A), (B), (D)

Explanation

A field has an additive abelian group, a multiplicative abelian group on its nonzero elements, and distributive multiplication. Nonzero elements must have multiplicative inverses, and multiplication is commutative rather than noncommutative.

55. A byte in AES is represented algebraically in which way?

A. The polynomial coefficients belong to GF(3).

B. AES represents each byte by a polynomial of degree at most 8.

C. Each byte is treated as an element of GF(2^8).

D. The byte is represented by a polynomial of degree at most 7.

E. The corresponding finite field contains 256 elements.

Answer: (C), (D), (E)

Explanation

AES represents bytes as elements of GF(2^8), which has 256 elements. The polynomial representation has degree at most 7 and coefficients in GF(2); a degree of at most 8 is not the stated representation.

56. Which statements characterize the prime field GF(p)?

A. GF(p) contains the elements from 0 through p−1.

B. Its arithmetic is performed modulo a composite number p.

C. Multiplication in GF(p) is performed modulo the prime p.

D. GF(p) contains p+1 elements.

E. Addition in GF(p) is performed modulo the prime p.

Answer: (A), (C), (E)

Explanation

The prime field GF(p) consists of the elements from 0 through p−1, with both addition and multiplication taken modulo the prime p. It therefore contains p elements, includes zero, and excludes p itself.

57. Which statements correctly describe the transformations in an AES round?

A. A standard AES round includes byte substitution.

B. The final AES round omits ShiftRows and key addition.

C. The final AES round includes MixColumns.

D. ShiftRows contributes diffusion within the AES state.

E. Every AES round applies MixColumns, including the final round.

Answer: (A), (D)

Explanation

AES rounds use byte substitution and diffusion through ShiftRows and MixColumns, together with key addition. The final round omits MixColumns but retains ShiftRows and key addition, so statements asserting the opposite are incorrect.

58. The AES S-box construction involves which operations?

A. The field element zero is mapped to zero during inversion.

B. The affine transformation is applied before the field inversion.

C. The construction begins with inversion in GF(2^4).

D. It begins by computing inversion in GF(2^8).

E. An affine transformation is applied after the inversion step.

Answer: (A), (D), (E)

Explanation

The AES S-box first computes inversion in GF(2^8), maps zero to zero, and then applies an affine transformation. It does not begin in GF(2^4), and the affine transformation follows rather than precedes inversion.

59. Regarding the AES ShiftRows transformation, which statements are correct?

A. The second state row shifts cyclically left by three bytes.

B. The third state row shifts cyclically right by two bytes.

C. The fourth state row shifts cyclically right by one byte.

D. The first state row remains unchanged.

E. The second state row shifts cyclically right by three bytes.

Answer: (B), (C), (D), (E)

Explanation

ShiftRows leaves the first row unchanged and cyclically shifts the second, third, and fourth rows right by three, two, and one bytes. The second row therefore does not shift left by three bytes.

60. Which statements correctly describe AES Key Addition?

A. Key Addition combines the state and subkey using integer multiplication.

B. The state and subkey each contain 16 bytes.

C. Key Addition combines the state and subkey using bitwise XOR.

D. The operation incorporates a 16-byte subkey into the 16-byte state.

E. The XOR operation corresponds to addition in GF(2).

Answer: (B), (C), (D), (E)

Explanation

Key Addition combines a 16-byte state with a 16-byte subkey by bitwise XOR. XOR is addition in GF(2); integer multiplication is not the operation used for this layer.