15 — Revision

Common Exam Questions + Answers

The ten most-asked comparisons — each with 10 differences and 10 exam key points. Learn the tables, quote the one-liners.

Q1 · RBAC vs ABAC

#	Aspect	RBAC	ABAC
1	Decision basis	User's role only	Attributes of subject, object, action, environment
2	Decision time	At role-assignment time (static)	At request time (dynamic evaluation)
3	Context awareness	None — same role always same access	Time, location, device posture factored in
4	Granularity	Coarse (whole role)	Fine-grained (single attribute combinations)
5	Scalability problem	Role explosion when rules get fine-grained	Avoids it — policies compose via Boolean logic
6	Audit question	Easy: "who has role X?"	Hard: must simulate policies over attribute space
7	Policy language	Role→permission matrix	XACML / Rego / Cedar attribute expressions
8	Change handling	Re-assign roles manually	Automatic — attribute change flips decisions instantly
9	Example	"Editors can publish"	"Doctors read own-dept records, weekdays 07–19"
10	Relation	RBAC is a special case of ABAC where the only attribute is "role"

RBAC = user → role → permission; ABAC = policy(subject, object, env, action).
ABAC's four sources: subject, object, action, environment.
XACML flow: PEP intercepts, PIP supplies attributes, PDP decides, PAP manages.
PDP verdicts: Permit / Deny / NotApplicable / Indeterminate — fail closed.
Combining: deny-overrides is the safe default.
RBAC audits easily; ABAC needs policy simulation to answer "who can access X".
ABAC is dynamic — no stale role assignments.
Context examples: business hours, managed device, external network.
Role explosion is the classic RBAC failure at scale.
Exam line: roles say who you are, attributes say everything about the request.

Q2 · MAC (Mandatory) vs DAC (Discretionary)

#	Aspect	MAC	DAC
1	Who decides	The system (central policy)	The resource owner
2	Basis	Labels: clearance vs classification	Identity + ACL entries
3	Formal model	Bell–LaPadula (no-read-up, no-write-down)	Access matrix / ACLs, no lattice
4	Trojan-horse resistance	Strong — malware can't relabel	Weak — malware inherits owner's rights
5	Flexibility	Rigid, users can't override	Flexible, owner grants at will
6	Admin overhead	High (label everything, clear everyone)	Low (owners self-manage)
7	Commercial fit	Poor — built for military secrecy	Good — matches files, sharing, collaboration
8	Granting rights	Only security admin via clearance	Owner can delegate further (leakage risk)
9	Examples	SELinux enforcing, military Top Secret systems	Unix rwx bits, Google-Docs "share" button
10	Info flow	Up-only lattice (Secret → Top Secret)	Any direction the owner permits

MAC = system says; DAC = owner says.
BLP rules: no-read-up (confidentiality), no-write-down (no leaks down).
Biba mirrors BLP for integrity; Clark-Wilson adds well-formed transactions.
DAC's fatal flaw: permission leakage via Trojans and delegation chains.
MAC's fatal flaw: rigidity — every object needs a label, every user a clearance.
Labels form a lattice: levels × compartments (e.g. {NATO}).
Unix permissions and ACLs are textbook DAC.
SELinux/AppArmor are textbook MAC on Linux.
Revocation in DAC is hard (copies propagate); in MAC it's central.
Exam line: MAC stops Trojans, DAC serves collaboration — pick by threat model.

Q3 · AES vs DES

#	Aspect	AES	DES
1	Block size	128 bits	64 bits (birthday bound at 2³² blocks)
2	Key size	128 / 192 / 256 bits	56 bits effective (8 parity bits)
3	Rounds	10 / 12 / 14 by key size	16 Feistel rounds
4	Structure	SPN (SubBytes/ShiftRows/MixColumns)	Feistel network (F need not invert)
5	S-boxes	One 8-bit S-box (inverse + affine)	Eight 6→4-bit S-boxes + E-expansion + P-box
6	Brute force	2¹²⁸ — infeasible	2⁵⁶ — broken 1998 (Deep Crack, ~22 h)
7	Status	Secure, NIST standard since 2001	Withdrawn; 3DES as stopgap, now also retired
8	Speed	Fast in software + AES-NI hardware	Slower, bit-permutation heavy
9	Key schedule	RotWord/SubWord/Rcon, 44/52/60 words	PC-1 → 16 LS shifts → PC-2, 16×48-bit keys
10	Final round	Omits MixColumns (decryption symmetry)	Ends with swap + IP⁻¹

AES-128 = 10 rounds; more key bits = more rounds (12/14).
DES's 56-bit key is its death sentence — memorise 2⁵⁶ and Deep Crack 1998.
SPN needs invertible layers; Feistel needs none (XOR trick, p.08).
AES S-box = GF inverse + affine; DES strength = its 8 S-boxes.
64-bit blocks leak after ~2³² blocks (Sweet32) — second DES killer.
3DES = EDE with 2–3 keys, 64-bit blocks remain — only a bandage.
FIPS vectors: AES Round-1 → a4 68 6b 02…; DES K₁ → 1B02EFFC7072.
AES-NI makes AES ~10× faster than DES in practice.
Grover halves symmetric strength: AES-128 ≈ 64-bit quantum — prefer AES-256 long-term.
Exam line: DES taught us Feistel; AES replaced everything with SPN + big keys.

Q4 · AES vs DES vs RSA

#	Aspect	AES	DES	RSA
1	Family	Symmetric block	Symmetric block	Asymmetric (public-key)
2	Key sizes	128/192/256-bit secret	56-bit secret	2048/3072-bit modulus
3	Hard problem	None (brute force only)	None (brute force only)	Factoring n = pq
4	Speed	Very fast (GB/s)	Moderate	~1000× slower — bulk data impossible
5	Key distribution	Needs pre-shared secret	Same problem	Solves it: publish (e,n), keep d
6	Primary use	Bulk encryption (TLS records)	Legacy only	Key exchange, signatures, certs
7	Security status	Secure	Broken	Secure at 2048+ (classical)
8	Signatures?	No	No	Yes (swap e/d roles)
9	Padding/modes	Needs mode (GCM/CBC) + nonce	Same + Sweet32 limits	Needs OAEP/PSS — textbook RSA broken
10	Quantum outlook	Halved (Grover) — use 256-bit	Dead anyway	Killed by Shor → migrate to PQC

Symmetric = one secret, fast; asymmetric = keypair, slow but solves distribution.
Real systems are hybrid: RSA/DH move the key, AES moves the data (TLS).
Never compare "56-bit vs 2048-bit" directly — different math, different units.
RSA can sign; no symmetric cipher can (needs MAC/signature layer).
Textbook RSA without OAEP/PSS is insecure — always name the padding.
DES is the "broken" answer to any "which is secure" question.
Factoring is sub-exponential; AES brute force is fully exponential.
Shor breaks RSA/DH/ECC; Grover only halves AES — know which is which.
2048-bit RSA ≈ 112-bit symmetric strength (NIST equivalence).
Exam line: AES encrypts fast, RSA distributes keys and signs, DES is history.

Q5 · RSA vs Diffie-Hellman

#	Aspect	RSA	Diffie-Hellman
1	Purpose	Encryption + signatures	Key agreement only — encrypts nothing itself
2	Hard problem	Factoring n = pq	Discrete log a = log_g A
3	What travels	Ciphertext c = m^e mod n	Publics A = g^a, B = g^b — secret K never sent
4	Keys	Long-term keypair (e,n)/(d,n)	Ephemeral secrets a,b + public params (p,g)
5	Authentication	Built-in via certs + signatures	None — needs STS/signatures (p.11–12)
6	Forward secrecy	RSA key-transport: no (leaked d opens past traffic)	Ephemeral DHE: yes (erase a,b)
7	Core equation	c = m^e, m = c^d, ed ≡ 1 mod φ	K = B^a = A^b = g^(ab) mod p
8	Worked anchor	(3,55)/(27,55), m=14 ↔ c=49	p=23,g=5: A=8,B=19,K=2
9	Typical use	Certificates, signatures, key wrap	TLS-DHE/ECDHE session keys
10	Quantum fate	Broken by Shor	Broken by Shor (discrete log too)

DH establishes a key; RSA moves data or signs — different jobs.
DH's security = discrete log; RSA's = factoring — both fall to Shor.
Plain DH is anonymous → MITM gives K₁≠K₂ (p.11); fix with STS (p.12).
Ephemeral DH gives forward secrecy; static RSA transport doesn't.
Signatures belong to RSA (σ = H(m)^d); DH has no signing mode.
Both need parameter hygiene: RSA ≥2048-bit, DH safe primes + validate peer values.
Small-subgroup attacks hit sloppy DH; small-e/no-padding hits sloppy RSA.
Modern TLS uses ECDHE (DH over elliptic curves) + RSA/ECDSA signatures — both together.
Key confirmation in DH comes only via STS/SIGMA-style follow-ups.
Exam line: RSA speaks (encrypts/signs), DH agrees (shared secret, needs a voice = signatures).

Q6 · Monoalphabetic vs Polyalphabetic

#	Aspect	Monoalphabetic	Polyalphabetic
1	Definition	One fixed substitution alphabet	Many rotating alphabets (key decides which)
2	Same-letter mapping	Always same ciphertext letter	Varies with position (A→L here, →X there)
3	Examples	Caesar, simple substitution, (Playfair is digraph-mono)	Vigenère, autokey, Enigma rotors
4	Keyspace	Caesar 25; substitution 26! ≈ 2⁸⁸	26^L for length-L key (grows with key)
5	Frequency analysis	Breaks directly (~25–50 letters)	Flat singles — need key length first
6	Breaking method	Count → map E/T/A → digraphs → THE	Kasiski (repeats→GCD) or Friedman (IC) → L Caesars
7	Key-length role	None (single alphabet)	Everything: L unknown = hard, L known = L easy Caesars
8	History	Broken by Arab scholars ~9th c.	"Indéchiffrable" 300 yrs, broken 1863 (Kasiski)
9	Ciphertext needed	Tens of letters	Hundreds (statistics per sub-alphabet)
10	Core lesson	Big keyspace ≠ security (26! still falls)	Periodicity is the fatal flaw (→ one-time pad needs L = message)

Mono = 1 alphabet; poly = L interleaved Caesars (Vigenère formula p.05).
Doubles/word patterns survive mono; poly smears them.
Kasiski: repeated blocks → distances → GCD ≈ L.
Friedman: IC ≈ 0.066 English vs 0.038 random → estimate L.
Once L is known, attack each of the L columns as Caesar.
Running key as long as the message = one-time pad = unbreakable (if random, single-use).
Playfair raises symbols 26→625 digraphs but stays mono at digraph level.
Enigma = polyalphabetic with huge period — broken via period + crib flaws.
Exam trap: "26! therefore secure" — false, statistics bypass keyspace.
Exam line: mono preserves statistics; poly hides them until the period leaks.

Q7 · Stream Cipher vs Block Cipher

#	Aspect	Stream Cipher	Block Cipher
1	Unit	Bit/byte at a time	Fixed blocks (64/128-bit)
2	Core idea	Keystream ⊕ plaintext (like OTP approximation)	Rounds of substitution + permutation
3	Examples	ChaCha20, Trivium (RC4 retired)	AES, DES, 3DES
4	Padding	Never needed	Required (except CTR/streaming modes)
5	IV / nonce	Mandatory per message — reuse = catastrophe	IV per message in CBC/CTR/GCM modes
6	Error propagation	1 flipped bit = 1 flipped bit (malleable!)	1 flipped bit = whole block garbled (CBC/ECB)
7	Synchronisation	Must stay in sync (lost bit kills stream)	Self-syncing per block
8	Speed/profile	Very fast, tiny hardware, no padding overhead	AES-NI very fast; needs mode machinery
9	Typical uses	TLS ChaCha20, mobile, real-time media	Disk, TLS-AES-GCM, general encryption
10	Classic failure	Nonce/keystream reuse (two-time pad)	ECB penguin — equal blocks show patterns

Stream = OTP with pseudorandom keystream; security lives in keystream + nonce discipline.
Never reuse (key, nonce) in a stream cipher — XOR of two ciphertexts kills both.
Block ciphers need modes: ECB (never), CBC (needs MAC), CTR/GCM (modern).
AEAD (AES-GCM, ChaCha20-Poly1305) adds integrity — raw stream/block gives none.
Malleability: flipping ciphertext bits flips plaintext bits predictably in streams/CTR.
Block-cipher modes turn blocks into streams (CTR) or chains (CBC).
RC4/WEP is the canonical stream-cipher failure (biased keystream + IV reuse).
ChaCha20-Poly1305 is the modern stream answer (TLS 1.3).
Disk encryption uses wide-block modes (XTS), not raw ECB.
Exam line: streams need nonces, blocks need modes — both need authentication.

Q8 · Symmetric vs Asymmetric Encryption

#	Aspect	Symmetric	Asymmetric
1	Keys	One shared secret	Public + private pair
2	Speed	Fast (GB/s with AES-NI)	~1000× slower (big-number math)
3	Key distribution	Hard — secret must pre-exist (n² keys for n users)	Easy — publish public key
4	Key sizes	128–256-bit secret	2048-bit+ (different security units)
5	Examples	AES, ChaCha20, DES (dead)	RSA, DH, ECDH, ECDSA
6	Authentication	No (MAC needed on top)	Yes — signatures + certs
7	Non-repudiation	Impossible (both holders can forge MACs)	Possible (only private holder signs)
8	Scaling	n users need ~n²/2 pairwise keys	n keypairs + directory of publics
9	Real-world use	Bulk data (TLS records, disk)	Handshake, signatures, PKI
10	Quantum impact	Halved strength (Grover)	Broken (Shor) — PQC migration

One secret vs keypair is the entire distinction — everything follows.
n² scaling is why the internet can't run on symmetric alone.
Hybrid encryption (TLS): asymmetric moves the key, symmetric moves the data.
Kerckhoffs applies to both: secrecy in the key, never the algorithm.
Symmetric + MAC = authenticated; asymmetric + hash = signed.
2048-bit RSA ≈ 112-bit symmetric — memorise one equivalence row.
Private keys never travel; public keys travel inside certificates.
Key exchange (DH) and encryption (RSA) are different asymmetric jobs.
Post-quantum: Kyber/Dilithium replace RSA/DH/ECC; AES-256 stays.
Exam line: asymmetric distributes trust, symmetric moves bytes.

Q9 · Hash vs MAC vs Digital Signature

#	Aspect	Hash	MAC	Signature
1	Keyed?	No	Yes (shared secret)	Yes (private signs, public verifies)
2	Reversible?	No	No	No (verify-only with public key)
3	Provides	Integrity detection	Integrity + authenticity	Integrity + auth + non-repudiation
4	Verifier needs	Nothing (recompute)	The shared key	Signer's public key/cert
5	Examples	SHA-256, SHA-3, BLAKE2	HMAC-SHA256, Poly1305	RSA-PSS, ECDSA, Dilithium
6	Output	Digest (256-bit)	Tag (128–256-bit)	Signature (2048-bit RSA / 512-bit ECDSA)
7	Repudiation?	N/A	Repudiable (either key-holder forged it)	Non-repudiable (only signer holds d)
8	Broken example	MD5/SHA-1 collisions	CBC-MAC on variable lengths (no length prefix)	Textbook RSA w/o PSS, ECDSA nonce reuse
9	Speed	Fastest	Fast (2 hashes)	Slow (modular exponentiation)
10	Use when…	Checksums, commitments, Merkle trees	Two parties share a key (TLS records)	Public verifiability / legal proof needed

Hash detects change; MAC proves a key-holder sent it; signature proves which one.
HMAC = H((K⊕opad) ‖ H((K⊕ipad) ‖ m)) — two nested hashes.
Birthday bound: n-bit hash = 2^(n/2) collision effort (p.02).
Sign-then-hash flow: σ = Sign(H(m)), verify H(m) ≟ Verify(σ).
Anyone can hash — so hashes alone never authenticate.
ECDSA leaks d if the per-signature nonce repeats or is biased (PS3 hack).
Certificates = CA's signature over (identity, public key).
TLS 1.3 uses HMAC-style HKDF + signatures for handshake auth.
Password storage wants slow salted hashes (bcrypt/Argon2), not SHA-256.
Exam line: unkeyed → keyed-shared → keyed-public = hash → MAC → signature.

Q10 · Substitution vs Transposition (Classical)

#	Aspect	Substitution	Transposition
1	What changes	Letters (A→Q)	Positions (read order shuffled)
2	Letter multiset	Changed (E becomes S)	Preserved — same letters, new order
3	Frequency profile	Mapped but intact (breakable)	Identical counts — frequencies useless
4	Examples	Caesar, monoalphabetic, Vigenère, Playfair	Rail fence, columnar, route ciphers
5	Key form	Alphabet permutation / keyword shifts	Permutation of positions / column order
6	Keyspace	26! (mono) / 26^L (Vigenère)	w! for width-w columnar (small!)
7	Attack	Frequency analysis (mono) / Kasiski (poly)	Anagramming + digraph-position stats
8	Digraph fate	TH→?? (mapped pairs)	TH split apart but both survive
9	Modern descendant	S-boxes (SubBytes, DES S-boxes)	P-boxes (ShiftRows, DES-P, IP)
10	Combined	Product ciphers alternate both: DES/AES = substitution + transposition × rounds (confusion + diffusion)

Substitution confuses what; transposition diffuses where — Shannon's pair.
Rail fence: zigzag rows then read rows; columnar: write rows, read columns by key order.
Transposition preserves multiset — frequency counting fails, anagramming wins.
Columnar with width w has only w! keys — tiny vs 26!.
Double columnar was field-grade (WWI–WWII) — product of two transpositions.
Playfair substitutes digraphs (625 symbols) — still substitution family.
DES/AES round = S-box (substitution) + permutation (transposition) — classical ideas, modern math.
Homophonic substitution (many→one symbols) flattens frequencies — bridge between families.
ECB-mode pattern leak is a transposition-style failure (positions leak).
Exam line: substitute to confuse, transpose to diffuse, iterate both to be secure.

How to use this page in the exam: for any "compare X vs Y" question, write the 10-row table first (marks for structure), then 3–4 key points as sentences. The one-liners at each table's row 10 / list end are your closing lines.

← Prev

14 · ABAC

Home