ITPEC FE Subject B April 2025 Question 18

Topic: Security Scenarios

From the answer group below, select the most appropriate combination of answers to be inserted into A and B in the description.

Company Z wants to provide secure file transfer service especially for very large files for their customers. Mr. K, the system architect of the company, designed the sequence of uploading, storing, and downloading customer files on the web service. In this system, customers register their email addresses and their public keys during sign up. The associated private keys reside on the customers’ computers and the email address is used as the user id. The requirements for the file transfer service are as follows:

-Customers transfer files between each other by uploading files to or downloading them from the web service provided by Company Z.-When uploading a file, the sender supplies the recipient’s email address and the password that will be used with the particular file (Upload function).-The file uploaded by the sender is encrypted with the supplied password and then stored in the database of the web service. (StoreFile function).-The web service assigns a file id to the uploaded file and notifies the sender of it upon uploading.-The encrypted file can only be decrypted by the sender and the recipient of the file using the password supplied by the sender.-The password is encrypted and sent to the recipient as an email message along with the file id (Message function).-When downloading the file, the recipient supplies the file id and the password. The web service then decrypts the stored file and provides it for the recipient.-Even if the database is leaked, it will be difficult to decrypt the uploaded files stored in the database.

Figure 1 shows the sequence of uploading file by customer P for customer Q.

PServerDatabaseQUpload(Q’s email, file, password)LoadPublicKeys(Q’s email)Q’s public keyStoreFile(A(file, KDF(password)))file idMessage(file id,B(password, Q’s public key))file id

Figure 1 Sequence on file uploading

In this system, Mr.K uses KDF (Key Derivation Function) to improve the strength of the supplied password and uses A and B algorithms to accomplish above requirements. Note that the format of encryption algorithms used here is algorithm(data, key).

Answer group

OptionAB

Explanation

A: symmetric key encryption, B: asymmetric key encryption — the file is locked with a key derived from the shared password, and that password travels protected by Q's public key.

  • •Blank A, StoreFile(A(file, KDF(password))): the same password-derived key must encrypt the file and later decrypt it for the sender or the recipient. One shared key for both directions is symmetric encryption, which is also fast enough for the very large files the service is built for.
  • •Blank B, Message(file id, B(password, Q's public key)): the key is Q's public key, and only Q's private key, kept on Q's computer, can reverse it. A public and private key pair is asymmetric encryption.
  • •The database holds only the encrypted file, never the password, so a leaked database is hard to decrypt, the last requirement.

Together this is hybrid encryption, the same pattern TLS uses.

Answer (e)

Why not others:

  • •(a) and (b) — A as asymmetric: the file key is derived from a password both parties know, not from a key pair, and public-key encryption is far too slow for very large files
  • •(c) and (d) — A as a hash: a hash is one-way, so the stored file could never be decrypted for download
  • •(b) and (d) — B as symmetric: the password is encrypted with Q's public key, which only works in an asymmetric scheme
  • •(f) — B as a hash: Q must recover the actual password to download the file, and a hash cannot be reversed

Key rule: Bulk data goes under a symmetric key, that secret travels under the recipient's public key, and a hash fits only where nothing has to be recovered.

Security Scenarios · AI-written, may contain errors

Practice this exam

This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.