Certified Ethical Hacker (CEH) Cloud Computing, Cryptography, and Social Engineering Syllabus

What key sizes does AES support, and what is its block size?

AES supports 128, 192, and 256-bit keys with a fixed 128-bit block size.

What is the key length of DES and why is it considered insecure?

DES uses a 56-bit effective key, which is too short and can be brute-forced quickly with modern hardware.

What is 3DES (Triple DES) and its effective key strength?

3DES applies the DES algorithm three times; with three independent keys it has an effective key strength of about 112 bits.

Which symmetric algorithm was selected as the AES standard, and who designed it?

The Rijndael algorithm, designed by Joan Daemen and Vincent Rijmen.

What is RSA and what is it based on?

RSA is an asymmetric algorithm used for encryption and digital signatures, based on the difficulty of factoring the product of two large prime numbers.

What is the Diffie-Hellman algorithm used for?

Securely exchanging a shared secret key over an insecure channel; it provides key exchange, not encryption itself, based on the discrete logarithm problem.

What advantage does Elliptic Curve Cryptography (ECC) offer over RSA?

ECC provides equivalent security with much smaller key sizes, making it faster and more efficient (e.g., a 256-bit ECC key ≈ a 3072-bit RSA key).

What is a cryptographic hash function and name two common examples.

A one-way function that produces a fixed-size digest from arbitrary input, used for integrity. Examples: SHA-256 and MD5.

Why is MD5 considered cryptographically broken?

MD5 (128-bit) is vulnerable to collision attacks, where two different inputs produce the same hash, so it cannot be trusted for integrity or signatures.

What is an HMAC?

A Hash-based Message Authentication Code that combines a cryptographic hash with a secret key to provide both data integrity and authentication.

What is the difference between encryption and hashing?

Encryption is reversible (with a key) and protects confidentiality; hashing is one-way (irreversible) and protects integrity.

What is a digital signature and what does it provide?

A value created by hashing a message and encrypting the hash with the sender's private key; it provides integrity, authentication, and non-repudiation.

In a digital signature, which key signs and which key verifies?

The sender's private key signs (encrypts the hash); the sender's public key verifies (decrypts the hash).

What is a Public Key Infrastructure (PKI)?

A framework of hardware, software, policies, and procedures to create, manage, distribute, store, and revoke digital certificates and public keys.

What is the role of a Certificate Authority (CA) in PKI?

A trusted entity that issues, signs, and vouches for the authenticity of digital certificates binding a public key to an identity.

What is an X.509 digital certificate?

The standard format for a digital certificate containing the subject's identity, public key, validity period, issuer, and CA's digital signature.

What is a Certificate Revocation List (CRL) and its real-time alternative?

A CRL is a list of revoked certificates published by the CA; the real-time alternative is OCSP (Online Certificate Status Protocol).

What is the function of a Registration Authority (RA) in PKI?

It verifies and authenticates the identity of certificate requesters before the CA issues a certificate; it does not issue certificates itself.

What is a known-plaintext attack in cryptanalysis?

An attack where the analyst has access to both the plaintext and its corresponding ciphertext and uses them to deduce the key or algorithm.

What is a chosen-plaintext attack?

An attack where the attacker can choose arbitrary plaintexts to be encrypted and observe the resulting ciphertexts to derive the key.

What is a birthday attack and what does it target?

A brute-force attack based on the birthday paradox that targets hash functions to find two inputs producing the same hash (a collision).

What is a rainbow table attack and the best defense against it?

An attack using precomputed tables of hashes to reverse password hashes; the best defense is adding a unique random salt to each password before hashing.

What is a meet-in-the-middle attack?

A cryptanalytic attack against multiple-encryption schemes (like 2DES) that reduces brute-force effort by encrypting from one end and decrypting from the other to find matching intermediate values.

Define social engineering in the context of information security.

The art of manipulating people through deception to divulge confidential information or perform actions that compromise security, exploiting human trust rather than technical flaws.

What are the typical four phases of a social engineering attack?

Research (information gathering/reconnaissance), Developing a relationship/hook, Exploitation (extracting information or access), and Execution/Exit.

What is phishing, and how do spear phishing and whaling differ from it?

Phishing is fraudulent mass email to steal data; spear phishing targets a specific individual/organization, and whaling targets high-profile executives (the 'big fish').

What are pretexting, baiting, and quid pro quo social engineering techniques?

Pretexting uses a fabricated scenario to gain trust; baiting lures victims with something enticing (e.g., a malware USB); quid pro quo offers a service/benefit in exchange for information.

What are tailgating and piggybacking in physical social engineering?

Tailgating is following an authorized person through a secure door without their consent; piggybacking is the same but with the authorized person's knowing consent/help.

What is an insider threat and what are its main categories?

A security risk originating from within the organization (employees, contractors). Categories: malicious insider, negligent/careless insider, and compromised insider (whose credentials are stolen).

What is identity theft and how is it used in social engineering attacks?

Identity theft is stealing someone's personal/identifying information to impersonate them; attackers use it for fraud, to gain trust, or to bypass authentication and access systems.