Choosing a cryptographic technique for a scenario

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A school stores student records on a server hard drive. Which technique best protects the data at rest?

A Hashing the records

B Symmetric encryption such as AES

2. Two computers must agree on a secret key over the internet without anyone intercepting it. Which technique is used?

A Hashing the key and sending the hash

B Asymmetric key exchange such as ECDH

3. You download a file and want to check it has not been altered. What should you do?

A Hash the file and compare it with the published hash

B Encrypt the file with a Caesar cipher

4. A website needs to store user passwords in its database. Which is the better choice?

A Store a salted hash of each password

B Encrypt passwords so staff can decrypt and read them

5. You must prove an email really came from a particular sender. Which technique fits?

A A digital signature using the sender's private key (e.g. ECDSA)

B Encrypting the email with a symmetric key both people share

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1AES-256 encrypt the database file		ASymmetric encryption protects stored (at rest) data so only people with the key can read it, keeping it confidential.
2SHA-256 hash of the downloaded file		BECDH key exchange
3Two strangers need to agree on a shared key over the internet without sending the key itself, so they use asymmetric key exchange.		CHashing does not protect confidentiality because the data cannot be recovered from the hash. Use encryption to keep a file secret and a hash to check integrity.
4A website stores user passwords so that a breach does not reveal them, and it still needs to check a login. It uses a salted hash.		DPasswords should be hashed (and salted), not encrypted. Encryption can be reversed with the key, so a thief who steals the key can read every password.
5Store customer passwords using AES encryption		EA hash gives a fixed-length fingerprint, so you can check the file has not been changed (integrity).
6Use a hash to keep a file secret from outsiders		Fstored = hash(salt + password)

Definitions

Match technique to job

Fill in the Blanks

Complete each line of code by filling in the missing parts.

IF job = "stored data" THEN technique ← "_________ encryption" END IF

IF job = "swap keys" THEN technique ← "__________ keys" END IF

IF job = "check integrity" THEN technique ← "_______" END IF

stored ← ____(password + salt) SAVE stored TO database

IF goal = "_________" THEN technique ← "hashing" END IF

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A job = "customer data at rest"

B need = "confidentiality"

C technique = "AES symmetric"

D key = "public/private pair"

Question 2

A job = "check file unchanged"

B need = "integrity"

C technique = "AES encryption"

Question 3

A job = "store user passwords"

B need = "protect if DB leaked"

C technique = "hash with salt"

D store = encrypt(pw, key)

Question 4

A job = "share a key over Wi-Fi"

B technique = "hash (SHA-256)"

C need = "secure in transit"

Question 5

A job = "sign a document"

B need = "prove who sent it"

C use = "public key to sign"

Answer Key

Choosing a cryptographic technique for a scenario

Section A: Quick Questions

B — Symmetric encryption such as AES

B — Asymmetric key exchange such as ECDH

A — Hash the file and compare it with the published hash

A — Store a salted hash of each password

A — A digital signature using the sender's private key (e.g. ECDSA)

Section B: Match the Pairs

AES-256 encrypt the database file → Symmetric encryption protects stored (at rest) data so only people with the key can read it, keeping it confidential.

SHA-256 hash of the downloaded file → A hash gives a fixed-length fingerprint, so you can check the file has not been changed (integrity).

Two strangers need to agree on a shared key over the internet without sending the key itself, so they use asymmetric key exchange. → ECDH key exchange

A website stores user passwords so that a breach does not reveal them, and it still needs to check a login. It uses a salted hash. → stored = hash(salt + password)

Store customer passwords using AES encryption → Passwords should be hashed (and salted), not encrypted. Encryption can be reversed with the key, so a thief who steals the key can read every password.

Use a hash to keep a file secret from outsiders → Hashing does not protect confidentiality because the data cannot be recovered from the hash. Use encryption to keep a file secret and a hash to check integrity.

Section C: Definitions

Match technique to job — Choose symmetric encryption for stored data, asymmetric keys to swap keys and sign, and hashing to check integrity and store passwords. Justify the choice.

Section D: Fill in the Blanks

IF job = "stored data" THEN
  technique ← "symmetric encryption"
END IF

IF job = "swap keys" THEN
  technique ← "asymmetric keys"
END IF

IF job = "check integrity" THEN
  technique ← "hashing"
END IF

stored ← hash(password + salt)
SAVE stored TO database

IF goal = "integrity" THEN
  technique ← "hashing"
END IF

Section E: Spot the Error

D — Symmetric encryption like AES uses one shared secret key to both encrypt and decrypt. A public/private pair belongs to asymmetric encryption. The line should be key = "one shared secret key".

C — Checking that a file is unchanged is an integrity job, so you compare hashes. Encryption protects confidentiality and does not provide a digest to compare. It should be technique = "hash (SHA-256)".

D — Passwords should be stored as salted hashes, which cannot be reversed. Encrypted passwords can be decrypted if the key is stolen. The line should be store = hash(salt + pw).

B — Swapping a key safely over an open network needs asymmetric methods such as ECDH or RSA. A hash is one-way and cannot be used to exchange a key. It should be technique = "asymmetric (ECDH)".

C — A digital signature is created with the sender's private key, which only they hold. Anyone then checks it with the public key. The line should be use = "private key to sign".