CECS 378 - Quiz 3

During AES-GCM decryption, when may an application parse the plaintext?

Only after tag verification succeeds

A FileDrop design uses one global GCM nonce counter, but servers can roll back to an older snapshot and reuse counter values. What is the redesign?

Use a nonce-allocation scheme that remains unique across servers and rollback, or rotate to a new key namespace

A CBC encryption API permits the caller to choose the IV after seeing the plaintext. Which property required by CBC is missing?

The IV must be unpredictable when the plaintext is chosen

An image archive encrypts each 16-byte block independently with the same AES key. Reviewers can still recognize repeated regions in encrypted images. Which mode caused the problem?

ECB

A developer selects CTR because it supports parallel and random-access processing. Which additional control is still required?

Authentication of the ciphertext and relevant metadata

A service repeats a 96-bit AES-GCM nonce under the same key. Which statement is MOST accurate?

Plaintext relationships may be exposed and authentication security can also fail

A file service needs random-access decryption and must avoid exposing repeated plaintext blocks. It will authenticate records separately. Which design meets these requirements?

CTR with counter blocks that never repeat under the key.

An application returns detailed GCM errors such as 'wrong account ID,' 'bad tag,' and 'invalid ciphertext byte.' What is the safest behavior?

Return one generic failure and record only safe diagnostic information

A team must protect arbitrary-length files and wants confidentiality plus integrity in one supported construction. Which choice is BEST for a new design?

AES-GCM with disciplined nonce management

The same plaintext encrypted twice produces different valid ciphertexts under one key. Which input directly provides this freshness?

A fresh nonce or IV used according to the mode's requirements

Two CTR ciphertexts were produced with the same key and nonce. Which relationship will an attacker obtain by XORing them?

m1 XOR m2

Which input to an AEAD operation is protected from modification but remains visible?

Associated data

A file format keeps the account ID and version outside the ciphertext but must detect changes to both. What is the BEST AES-GCM design?

Supply the account ID and version as associated data

A system needs a nonce for a construction that requires uniqueness but not unpredictability. Which generator is the BEST choice if state is reliably preserved?

A monotonically increasing counter

A team generates random nonces and assumes repetition is impossible. What is the BEST review comment?

Randomness reduces collision probability but does not guarantee uniqueness

Which record contains the minimum information needed to decrypt and authenticate a versioned AES-GCM file later?

Format version, nonce, ciphertext, and tag; the key is retrieved separately

Why does CBC pad a final partial block?

AES accepts only complete 16-byte blocks

A developer says, 'CBC hides repeated blocks, so it authenticates the file.' What is the response?

Incorrect; CBC confidentiality does not detect controlled modification and must be authenticated

A CBC service reports 'bad padding' differently from 'invalid record.' What attack does this behavior MOST directly enable?

Padding oracle

An attacker changes one byte of AES-GCM ciphertext. The receiver uses the correct key, nonce, and associated data. What should happen?

Tag verification fails and no plaintext is used