Important WGU Introduction to Cryptography Exam Questions

Answer: C

Explanation:

Lattice-based cryptography refers to cryptographic constructions whose security is based on the computational hardness of problems on mathematical lattices (regular grids of points in high-dimensional space). Examples of hard lattice problems include the Shortest Vector Problem (SVP) and Closest Vector Problem (CVP), and practical schemes often use related problems like Learning With Errors (LWE) or Ring-LWE. These problems are believed to remain hard even for quantum computers, making lattice-based cryptography a major candidate family for post-quantum cryptography. Lattice schemes can support encryption, digital signatures, and key exchange, often with strong security reductions (worst-case to average-case) and efficient implementations. The word ''lattice'' here is not about simple point encoding; it's about relying on geometric/algebraic structures and noise-based hardness assumptions. It is also unrelated to blockchain ''options.'' While many lattice schemes do involve modular arithmetic internally, what defines the category is the underlying lattice hardness assumptions, not modular arithmetic alone. Therefore, the correct definition is a cryptographic scheme based on geometric lattices.

Answer: B

Explanation:

3DES (Triple DES) is a symmetric block cipher that retains DES's 64-bit block size while increasing effective security by applying DES multiple times. The common ''two-key 3DES'' variant uses two independent 56-bit DES keys (K1 and K2) in an Encrypt--Decrypt--Encrypt (EDE) sequence: Encrypt with K1, Decrypt with K2, then Encrypt again with K1. Because each DES key is 56 bits (ignoring parity bits), the total keying material is 112 bits. This matches the question's ''112-bit key size and 64-bit block size.'' Plain DES uses only a 56-bit effective key and a 64-bit block size, so it does not match the 112-bit key size. AES has a 128-bit block size and key sizes of 128/192/256. IDEA uses a 64-bit block size but has a 128-bit key. Therefore, the correct algorithm is 3DES. Although 3DES improved on DES, it is now considered legacy due to its small 64-bit block size (birthday-bound issues for large data volumes) and performance overhead compared to AES.

Answer: D

Explanation:

Lightweight cryptography refers to cryptographic primitives and profiles engineered for environments where computational resources are constrained---limited CPU, memory, power, bandwidth, and code size---while still requiring robust security. Typical targets include IoT sensors, embedded controllers, smart cards, RFID, wearables, and many mobile or edge deployments. The design goals emphasize efficiency (low energy consumption, small silicon area for hardware, small firmware footprint) and practical performance under constraints, often while providing modern security properties like authenticated encryption (confidentiality + integrity) and secure hashing. Lightweight cryptography is not simply ''stronger encryption''; it balances security with implementability in constrained systems. It is also not restricted to military settings and is not inherently outdated---many lightweight designs are modern and motivated by the rapid growth of IoT and pervasive computing. Because constrained devices are common entry points for attackers, having secure primitives that fit those devices is a critical part of contemporary security architecture. Therefore, the best description is cryptographic algorithms designed for resource-constrained environments.

Answer: D

Explanation:

The NOBUS (Nobody But Us) principle is a controversial security notion suggesting that it is possible to introduce or maintain an access capability (often framed as a ''backdoor'' or exploitable weakness) that is effectively usable only by the party that designed it---typically a government or specific organization---while remaining infeasible for everyone else to exploit. In practice, NOBUS is invoked in debates about lawful access, surveillance, and exceptional access mechanisms: proponents claim that sophisticated entities can keep exploitation techniques secret and complex enough that adversaries cannot replicate them. Critics argue that this assumption is fragile because vulnerabilities can be independently discovered, reverse engineered, leaked, or eventually exploited as tools and knowledge spread. Moreover, once a weakness exists, it becomes a systemic risk: software and cryptographic systems are widely deployed and adversaries can invest heavily in finding and weaponizing the same flaw. Modern security engineering generally favors eliminating known weaknesses rather than relying on secrecy or assumed asymmetry of capability. Therefore, the best description of NOBUS is that a vulnerability is believed to be so difficult to exploit that only its creator can exploit it.

Answer: B

Explanation:

When software is digitally signed, the organization computes a cryptographic hash (digest) of the software (or its manifest) and then signs that digest using the organization's private key. Verification works in the opposite direction: the customer (verifier) uses the organization's public key to validate the signature and recover/confirm the signed digest, then independently hashes the received software and compares the result. If the digests match and the signature validates under the public key, the customer has strong assurance that the software has not been altered since it was signed and that it was signed by the holder of the corresponding private key. The customer never needs the organization's private key---sharing it would destroy security and enable forgery. Likewise, the customer's own keys are irrelevant to verifying the publisher's signature. The organization's public key is typically delivered inside a certificate chain (code signing certificate) so the verifier can also validate publisher identity and trust. Therefore, the customer uses the organization's public key for signature verification (often described as ''decrypting'' the signed digest).