Question 1

As part of a shell program or batch program, OpenSSL commands are usually run in interactive mode.

Accepted Answer

A) True 
 B)False  False

Question 2

What is the core path for hashing with EVP API?

Accepted Answer

The core path for hashing with EVP API is as follows:
* EVP_get_digestbyname( ) : Obtain algorithm type by algorithm name. Supported name strings are MD2, MD4, MD5, MDC2, SHA1, DSS1, and RIPEMD. Both SHA1 and DSS1 are implementations of the SHA1 algorithm.
* EVP_DigestInit( , type) : Initialize context according to the algorithm type.
* EVP_DigestUpdate( , , ) : Adding data for computation from inputValue with length inputLength to the context.
* EVP_DigestFinal( , , ) : Create the hash, also called message digest, from the context, output the result to outputValue, and result length to outputLength.

Question 3

Briefly describe DES and its variants.

Accepted Answer

The data encryption standard (DES), dating back to 1976, is a cipher selected as an official federal information processing standard (FIPS) for the United States. It is certainly the most widely used cipher internationally. It uses fixed 64-bit blocks and 64-bit keys with 8- bits parity. The 54-bit key (64 - 8) is generally considered too small, and some DES keys have been broken in less than 24 hours. Most DES users now use Triple DES (3DES). In 3DES, data is encrypted with DES to produce ciphertext, and then a second key is used to "decrypt" the ciphertext. Finally, the data is encrypted again with either the original key (two-key 3DES) or with a third key (three-key 3DES). 3DES is secure but slow. A quicker alternative is DES-X, which increases the key size by XORing extra key material before and after DES.

Question 4

What is the general algorithm for a stack overrun attack?

Accepted Answer

The answer of What is the general algorithm for a...

Question 5

____ encoding is very useful when binary data needs to transfer correctly among platforms with different code pages over the Internet.

Accepted Answer

A)   Base64
B)   SHA1
C)   MD5
D)   RC4

Question 6

Totally strong type checking is possible to achieve.

Accepted Answer

A) True 
 B)False

Question 7

Buffer overflow provides the ability to overwrite a return address causing ____.

Accepted Answer

A)   heap overruns
B)   variable overruns
C)   stack overruns
D)   variable smashing

Question 8

The OpenSSL command-line tool executable is called ____ on UNIX.

Accepted Answer

A)   openssl.exe
B)   openssl
C)   cmdssl
D)   opensslcmd

Question 9

The ____ option in the ca command is used to generate the CRL.

Accepted Answer

A)   -gencrl
B)   -crl
C)   -revoke
D)   -crlcert

Question 10

Describe the structure of a configuration file for OpenSSL.

Accepted Answer

The answer of Describe the structure of a configuration file...

Question 11

One common buffer overflow attack is called the ____________________, where the target is to overwrite internal data of a program.

Accepted Answer

The answer of One common buffer overflow attack is called...

Question 12

Describe the memory arrangement of a C program.

Accepted Answer

The answer of Describe the memory arrangement of a C...

Question 13

____ is a block cipher designed by Xuejia Lai and James L. Massey in 1991.

Accepted Answer

A)   AES
B)   IDEA
C)   Blowfish
D)   RC4

Question 14

OpenSSL provides a single API set that serves as an interface to all hashing and symmetric cryptography algorithms: the ____ interface.

Accepted Answer

A)   SSL
B)   EVP
C)   Crypt
D)   Security

Question 15

A ____ cipher is a symmetric cipher in which the input digits are encrypted one at a time.

Accepted Answer

A)   block
B)   group
C)   bit
D)   stream

Question 16

OpenSSL provides the APIs ____ for Base64 encoding.

Accepted Answer

A)   EVP_B64EncodeBlock
B)   EVP_Base64EncodeBlock
C)   EVP_EncodeBlock
D)   EVP_Base64Block

Question 17

OpenSSL contains a minimal CA application that ships with the toolkit.

Accepted Answer

A) True 
 B)False

Question 18

____ is a symmetric block cipher designed in 1993 by Bruce Schneier as a fast, free alternative to existing encryption algorithms.

Accepted Answer

A)   IDEA
B)   AES
C)   RC5
D)   Blowfish

Question 19

What causes a buffer overflow?

Accepted Answer

The answer of What causes a buffer overflow?...

Question 20

C is "close to the machine," as the abstractions the language introduced are readily grounded in the concrete data types and operations supplied by conventional computers

Accepted Answer

A) True 
 B)False

Exam 8: Secure Programming With C and Openssl

As part of a shell program or batch program, OpenSSL commands are usually run in interactive mode.

What is the core path for hashing with EVP API?

Briefly describe DES and its variants.

What is the general algorithm for a stack overrun attack?

____ encoding is very useful when binary data needs to transfer correctly among platforms with different code pages over the Internet.

Totally strong type checking is possible to achieve.

Buffer overflow provides the ability to overwrite a return address causing ____.

The OpenSSL command-line tool executable is called ____ on UNIX.

The ____ option in the ca command is used to generate the CRL.

Describe the structure of a configuration file for OpenSSL.

One common buffer overflow attack is called the ____________________, where the target is to overwrite internal data of a program.

Describe the memory arrangement of a C program.

____ is a block cipher designed by Xuejia Lai and James L. Massey in 1991.

OpenSSL provides a single API set that serves as an interface to all hashing and symmetric cryptography algorithms: the ____ interface.

A ____ cipher is a symmetric cipher in which the input digits are encrypted one at a time.

OpenSSL provides the APIs ____ for Base64 encoding.

OpenSSL contains a minimal CA application that ships with the toolkit.

____ is a symmetric block cipher designed in 1993 by Bruce Schneier as a fast, free alternative to existing encryption algorithms.

What causes a buffer overflow?

C is "close to the machine," as the abstractions the language introduced are readily grounded in the concrete data types and operations supplied by conventional computers