Cryptographic Attacks

Question 1 of 6

Which statement best describes why birthday attacks are effective against hash functions with small output sizes?

A birthday attack works by guessing the plaintext that produces a specific target hash, requiring N attempts for N possible outputs. Birthday attacks exploit weak random number generators used during hash computation, not the output size. Finding any two inputs that produce the same hash requires only approximately √N attempts for a hash with N possible outputs — so a 128-bit hash offers only 64-bit collision resistance. Birthday attacks only apply to MD5 and SHA-1; modern algorithms with any output size are immune by design.

Question 2 of 6

A security team discovers their document-signing system uses MD5. What is the most accurate statement about the risk?

MD5 is acceptable for document signing because its 128-bit output provides 128-bit collision resistance. MD5 has demonstrated practical collisions since 2004; in December 2008, researchers used an MD5 collision to forge a CA-signed TLS certificate without possessing the CA's private key. MD5 is vulnerable only when paired with RSA signatures; when used with ECDSA it remains collision-resistant. MD5 was deprecated due to performance limitations rather than cryptographic weaknesses.

Question 3 of 6

A victim at a coffee shop visits a bank website and submits login credentials. An on-path attacker captures the credentials in plaintext, yet the victim sees no browser warning and the server logs show a clean authenticated HTTPS session. Which attack is described?

A POODLE attack exploiting SSL 3.0 CBC padding vulnerabilities to decrypt the HTTPS session. A birthday attack that collided the TLS session key with a known value. SSL stripping — the attacker intercepted the server's HTTP-to-HTTPS redirect, kept the victim on HTTP, and maintained a separate HTTPS session with the server. A rogue certificate attack in which the attacker presented a fraudulent TLS certificate to the victim's browser.

Question 4 of 6

What does POODLE stand for, and what are its two required phases?

Protocol Override On Decrypted Legacy Encryption; Phase 1 is certificate forgery, Phase 2 is session replay. Padding Oracle On Downgraded Legacy Encryption; Phase 1 is forcing a TLS downgrade to SSL 3.0, Phase 2 is exploiting the CBC padding oracle in SSL 3.0 to recover plaintext byte-by-byte. Padding Oracle On Downgraded Legacy Encryption; it can be executed without a network on-path position if the attacker controls a JavaScript injection. Protocol Oracle On Deprecated Legacy Encryption; Phase 1 is hash collision, Phase 2 is session token forgery.

Question 5 of 6

Why does HSTS prevent SSL stripping when a simple HTTP-to-HTTPS 301 redirect does not?

HSTS encrypts the initial HTTP request with a temporary session key before the full TLS handshake completes. HSTS prevents SSL stripping by displaying a browser warning when an HTTP response is received, allowing the user to cancel the request. The 301 redirect can be intercepted by the attacker before it reaches the browser; HSTS is stored in the browser itself and causes it to refuse to send any HTTP request to the domain in the first place — the initial HTTP request that SSL stripping requires is never sent. HSTS configures the server to refuse HTTP connections at the network level, blocking the attacker's interception point.

Question 6 of 6

A security architect disables SSL 3.0, TLS 1.0, and TLS 1.1 on a web server. Which attack does this configuration change directly prevent, and why?

POODLE and TLS downgrade attacks — without a fallback target, the downgrade phase of the attack has nowhere to land, and TLS 1.2/1.3 do not have the CBC padding oracle weakness SSL 3.0 does. SSL stripping — disabling legacy protocols prevents the attacker from maintaining an HTTP connection with the victim. Birthday attacks — removing older protocol versions prevents use of the weaker hash functions (MD5, SHA-1) they negotiate. Padding oracle attacks in TLS 1.2 — TLS 1.2 uses the same CBC padding as SSL 3.0, so only disabling all CBC cipher suites would provide protection.

Matching — Attack to Definition

Match each term on the left to its correct definition on the right.

1. Birthday Attack

2. SSL Stripping

3. POODLE

4. MD5

1. 2. 3. 4.

A. Forces TLS negotiation to SSL 3.0 by injecting errors into successive handshake attempts until the client falls back to the legacy protocol

B. A 128-bit hash algorithm published in 1992; practical collisions demonstrated in 2004; used to forge a CA-signed certificate in December 2008

C. A search strategy that finds any two inputs producing the same hash digest in approximately √N operations for a hash with N possible outputs

D. An on-path attack that intercepts a server's HTTP-to-HTTPS redirect, keeping the victim on plaintext HTTP while the attacker maintains an HTTPS session with the server

Cryptographic Attacks Quiz

Matching — Attack to Definition