Effective CISSP Questions

The symmetric cipher uses a secret key to encrypt and decrypt data. Which of the following has the least overhead in negotiating a shared key between two communication parties? (Wentz QOTD)
A. Web of trust
B. Diffie-Hellman
C. Trusted couriers
D. Public key infrastructure

Kindly be reminded that the suggested answer is for your reference only. It doesn’t matter whether you have the right or wrong answer. What really matters is your reasoning process and justifications.

My suggested answer is B. Diffie-Hellman.

Key distribution is the process of sending cryptographic keys from one party to another. Both symmetric and asymmetric cryptography are facing key distribution challenges. This question asks about shared key distribution in symmetric cryptography.

  • The recipient’s public key in a certificate managed by the web of trust or the X.509 public key infrastructure (PKI) is typically used to encrypt the pre-determined, instead of negotiated or agreed-upon shared key. Certificate and infrastructure management is the primary overhead.
  • Diffie-Hellman is a public key-based protocol that supports the key agreement (shared keys are generated and agreed) without the overhead of certificate management.

The Distribution of Secret Keys

A secret key can either be pre-determined by one party and sent to the other party or negotiated and agreed upon between both parties. The author calls the former pre-determined approach as “key exchange,” while the latter agreed-upon approach as “key agreement.” However, it’s not uncommon for people to refer to “key exchange” as an umbrella term covering both approaches.

  • Key exchange: One party generates the key and sends it to the other party; The other party does not influence the key. e.g., Public Key Encryption.
  • Key agreement: Both of the two parties can agree on a key in such a way that both influence the outcome. e.g., Diffie-Hellman.
Key Distribution
Key Distribution in Symmetric Cryptography

The Distribution of Public Keys

The distribution of public keys used in asymmetric cryptography can be achieved by the following general schemes:

Diffie-Hellman Protocol



My new book, The Effective CISSP: Security and Risk Management, helps CISSP aspirants build a solid conceptual security model. It is not only a tutorial for information security but also a study guide for the CISSP exam and an informative reference for security professionals.

對稱式加密器(cipher)使用密鑰來加密和解密數據。在協商兩個通信方之間的共享密鑰時,以下哪項額外負擔最小? (Wentz QOTD)
A. Web of trust
B. Diffie-Hellman
C. Trusted couriers
D. Public key infrastructure

Leave a Reply