IPA FE Subject A 2025 Question 9

A practical way to find hash collisions was discovered — compromise of cryptography means an algorithm can no longer give the security it was designed for, because of new attacks or growing computing power.

A hash function must make it infeasible to find two different inputs with the same hash value (collision resistance). Once a method finds such a pair within realistic time, signatures and integrity checks that rely on the function can be forged, whatever keys are used. MD5 and SHA-1 were compromised this way and replaced by the SHA-2 family. The remedy is to migrate to a stronger algorithm, not just to replace a key or a certificate.

Answer (c)

Why not others:

• •(a) — a certificate reaching the end of its validity period is a normal life-cycle event handled by renewal; the algorithm and the keys are still secure
• •(b) — a private key leaked through unauthorized access is an incident with one key (sometimes called key compromise); the algorithm itself stays secure, and the fix is to revoke and replace that key
• •(d) — the published decryption key for files a ransomware encrypted lets victims recover them; it exposes one attacker's key, not a weakness in a cryptographic algorithm

Key rule: Compromise of cryptography concerns the algorithm (or its key length) becoming breakable in practice, and is answered by moving to a stronger algorithm; leaked or expired keys are key-management problems.

Security · AI-written, may contain errors