Cryptography and PKI, Interview Questions.

Symmetric uses one shared key (AES): fast, used for bulk data, but the key must be shared securely. Asymmetric uses a key pair (RSA, ECC): slower, solves key exchange and enables signatures. Real protocols use asymmetric methods to agree on a symmetric key.

A hash is a one-way fixed-length fingerprint (SHA-256). It is not reversible and has no key. Encryption is reversible with a key. Hashes give integrity checks, and with a salt and slow algorithm they store passwords.

The sender hashes a message and signs the hash with a private key. Anyone with the public key verifies origin, integrity and non-repudiation.

An X.509 certificate binds a public key to an identity, signed by a Certificate Authority that clients trust. Clients validate the chain up to a trusted root, check validity dates, hostname match and revocation status.

A random value added before hashing a password so identical passwords produce different hashes and precomputed tables (rainbow tables) are useless. It is stored with the hash and is not secret.

A message authentication code proves integrity and authenticity using a shared secret. HMAC builds one from a hash function and a key. Authenticated encryption modes such as AES-GCM combine confidentiality and integrity.

The client sends supported groups and key shares, the server replies with its key share, certificate and a signature proving it holds the private key, both derive session keys through ephemeral Diffie-Hellman, and encrypted application data starts after one round trip. Forward secrecy is built in and legacy options are gone.

Using ephemeral session keys so that compromise of a long-term private key does not reveal past recorded traffic. Achieved with ephemeral Diffie-Hellman (ECDHE).

CRLs are lists downloaded periodically (large, slow). OCSP queries a responder per certificate (privacy and latency concerns). OCSP stapling lets the server attach a signed fresh response. Short-lived certificates reduce reliance on revocation altogether.

Public append-only logs of issued certificates. Browsers require certificates to be logged, which lets domain owners monitor for mis-issued certificates for their names.

Inventory all certificates, automate issuance and renewal (ACME), set monitoring for expiry, standardise key sizes and algorithms, protect private keys in HSMs or managed key stores, and have a rapid reissue path. Outages from expired certificates are a classic, avoidable failure.

Inspect the chain, expiry, SAN names and protocol support from the command line.

# subject, issuer, dates, SANs for a live endpoint
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
  | openssl x509 -noout -subject -issuer -dates -ext subjectAltName

ECC gives equivalent security with much smaller keys (256-bit ECC is roughly comparable to 3072-bit RSA), so faster operations and smaller certificates. RSA is widely supported. Both are vulnerable to a large quantum computer.

A data key encrypts the data, and a key-encryption key (often in a KMS or HSM) encrypts the data key. This lets you rotate the master key cheaply and keep master keys inside secure hardware.

DES and 3DES, RC4, MD5 and SHA-1 for security uses, ECB mode, unauthenticated CBC without a MAC, RSA key exchange without forward secrecy, TLS versions before 1.2, and short RSA keys. Prefer AES-GCM or ChaCha20-Poly1305.

Quantum computers running Shor's algorithm would break RSA and ECC. NIST standardised post-quantum schemes: ML-KEM (FIPS 203) for key establishment, ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) for signatures. Plan by inventorying cryptographic use, prioritising long-lived secrets exposed to "harvest now, decrypt later", adopting hybrid key exchange, and building crypto-agility.

Hardware security modules hold keys in tamper-resistant devices that perform operations without exporting the key. A key ceremony is a scripted, witnessed, logged process to generate and back up a root key with split knowledge (several custodians), offline storage and audited access.

An offline root CA, one or more online intermediate CAs with constrained policies, automated issuance for servers and devices, short certificate lifetimes, templates per use, monitoring of issuance, revocation infrastructure, and protection of the CA hosts like crown jewels. Compromise of an issuing CA is a domain-level event.

Reusing nonces or IVs with AES-GCM, using a non-cryptographic random number generator, comparing MACs with non-constant-time checks, hardcoded keys, rolling your own crypto, skipping certificate validation, and storing keys next to the data they protect.

Revoke the affected certificates, distrust or remove the CA where needed, investigate scope using transparency logs, reissue from a clean hierarchy, and communicate. This is why constrained intermediates, monitoring and the ability to rotate quickly matter.

TLS everywhere, field-level encryption for sensitive fields with keys in a KMS or HSM, separate keys per tenant or data class, strict access control and audit, key rotation, secure backups and defined retention and deletion. Document which threats each control addresses.

Issue and deploy a renewed certificate immediately, confirm the full chain, clear caches and CDN edges, then find why automation failed and add expiry monitoring with multiple alert thresholds across all certificates.

Treat it as compromised: revoke and reissue the certificate with a new key, rotate anything the key protected, review usage logs, then remove it from history and add scanning. Deleting the file does not make the key safe.

Explain the risk, offer an isolated gateway or proxy that terminates the legacy protocol with strict access control and monitoring, set a deadline to upgrade, and document the risk acceptance.