Applied Cryptography for Developers Module 15
End-to-end encryption and advanced protocols interview questions
Interview questions on end-to-end encryption and advanced protocols: warm-ups, then what each harder question tests and how a good answer starts.
Warm-up questions
Short questions with short answers, each answered in full.
-
Fresher to mid
What do forward secrecy and post-compromise security mean for a messaging app, and which part of the Double Ratchet gives each?
Answered in the lesson End-to-end encryption: Signal protocols and MLS
-
Fresher to mid
In an oblivious PRF login, what does the server receive, what does it return, and what does the client end up with?
Answered in the lesson OPAQUE, Privacy Pass and threshold signatures
-
Fresher to mid
An attacker records a user's Kerberos service ticket from the network. Why can it not be used to log in to the service as that user?
A ticket is only half of the credential. Using it needs an authenticator, which is the client's name and the current time sealed under the session key that sits inside the ticket. The ticket is sealed under the service's key, so the attacker cannot read the session key out of it, and the KDC sent its other copy to the client under a key made from the user's password. Without that key the attacker cannot build a valid authenticator. A recorded authenticator does not help either, since the service refuses one that is outside the clock skew, usually five minutes, and one that its replay cache has already seen. In the lesson's realm a stolen ticket used without its session key was refused, and one used with the key was accepted until it expired, which is why a credential cache needs protection.
From the lesson Kerberos tickets, authenticators and replay checks
Questions with model answers
What each question tests, the first step of a good answer and the follow-ups to expect.
-
Mid to senior
A product team wants to back up every device's ratchet state to the cloud each night, so that conversations survive a lost phone. Evaluate the idea for forward secrecy and post-compromise security, say what else it breaks, and propose a safer way to restore conversations.
- What it tests
- Seeing a backup of ratchet state as a copy of the device, seeing that restoring old state repeats keys, and designing a history backup under a separate key with fresh sessions after a restore.
- First step
- Treat the backup as one more thief's copy: whatever it holds is what a leak reveals. List what the state contains: chain keys, root key, private ratchet keys and skipped message keys. Then ask what happens when an old backup is restored while the other side has moved on.
- Follow-ups
-
- What does a leaked nightly backup open, before and after its time?
- What goes wrong when a phone restores state from last week?
- How would you back up history instead, and who holds the key?
From the lesson End-to-end encryption: Signal protocols and MLS
Model answer, Pro. Model answers open with any pass; prices are in the notice on this page.Opening the model answers with your pass…
Model answers open with any MySmartCoPilot pass.
- Pro pass · 1 week₹79$2.99
- 30 days₹179$5.99
- 1 year₹1,699$45
One payment; a pass never renews. The price shown is the total you pay: no fees or charges are added at checkout.
Passes can’t be bought right now, so the model answers can’t be opened at the moment. If you have a pass, enter your licence key.
It also opens every other in-depth part in Learn and every Pro tool. Sales are final, except where the law gives you a right to withdraw, for example in the EU and the UK (refund policy).
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
-
Mid to senior
A receiver's chain is at message 12, and a packet's header claims message 4,000,000. Say what the receiver must do before and after checking the tag, what limits you would set, and which tests prove that the rule holds.
- What it tests
- Bounding the work and storage that a sender-chosen number can cause, refusing without changing state, and writing regression tests that fail on a naive receiver.
- First step
- Cost the claim first: 4,000,000 minus 12 chain steps and as many stored 32-byte keys, about 128 MB, before any tag has been checked. Then decide the order of work: compare the gap with a limit, refuse without computing, and change state only after the tag verifies.
- Follow-ups
-
- Which values would you choose for the gap limit and for the whole store, and why?
- What should happen when the tag fails after the keys were derived?
- What do stored keys cost in forward secrecy, and how do you limit it?
From the lesson End-to-end encryption: Signal protocols and MLS
Model answer, Pro.In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
-
Mid to senior
A login service uses OPAQUE. A breach copied its record table and the configuration repository that holds the OPRF seed. Say what the attacker can now do and what stays safe, what you change in the next hour, and what you change in the design so that one breach cannot do this again.
- What it tests
- Telling what a stolen record table allows with and without the OPRF seed, what replacing the seed costs every user, and where the seed should live in the design.
- First step
- Sort what was copied by what each piece allows on its own and what the pair allows together. Then ask which of the two you can replace first, and what replacing it does to every user.
- Follow-ups
-
- How does the attacker's work differ from a breach of a table of salted SHA-256 hashes?
- What do you tell users, and who must register again?
- Where should the seed live, and who may read it?
From the lesson OPAQUE, Privacy Pass and threshold signatures
Model answer, Pro.In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 4 minutes
-
Mid to senior
A public API wants each person to have 100 requests a day without the service keeping a profile of who asks for what. Compare counting by API key with Privacy Pass tokens, then design the token flow: who attests, who issues, what the service stores, and what can still identify people.
- What it tests
- Separating issuance from redemption, choosing where the limit lives, keeping the anonymity set from splitting through keys, metadata and timing, and handling replay and hoarding.
- First step
- Write down what the service must know to enforce the limit and what it must not know. A key counts by identity. A token counts by possession, so the service needs to know that a token is valid and unspent, and nothing about its holder. Then ask who can hand out 100 tokens a day to a person without learning to whom they went.
- Follow-ups
-
- What stops one client from asking for more than 100 tokens?
- What do key rotation, metadata and issuing times do to the anonymity set?
- What does the service store to refuse a token the second time?
From the lesson OPAQUE, Privacy Pass and threshold signatures
Model answer, Pro.In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
-
Mid to senior
After a failure of the time source, users of a Kerberos realm get clock skew errors from several services. A colleague proposes to set the allowed skew to one hour on every client and server. Evaluate the proposal and say what you would do instead.
- What it tests
- Seeing what the skew number protects and what else depends on it, costing a wider skew, and treating the time source as part of the trust.
- First step
- Ask what the skew number does for a captured authenticator, and what else reads the same number. Then ask why the clocks drifted at all.
- Follow-ups
-
- How many entries does a service with 200 logins a second keep at 300 seconds and at 3,600?
- Where else does MIT Kerberos apply the skew setting?
- How would you notice drift before users do?
From the lesson Kerberos tickets, authenticators and replay checks
Model answer, Pro.In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
-
Mid to senior
A review finds that several service principals have keys made from passwords that people chose, and that RC4 is still allowed in the realm. Explain the risk, rank the fixes, and describe how to migrate without breaking existing clients.
- What it tests
- Knowing what an ordinary user can obtain from the KDC, how the strength of a key depends on how it was made, and a migration order that keeps existing tickets working.
- First step
- Ask what an ordinary user can already obtain from the KDC without any special right. Then ask how each service key was made, how fast it can be tested, and which encryption type it uses.
- Follow-ups
-
- Why does an RC4 key from a password fall faster than an AES key from the same password?
- How do you replace a service key without breaking the tickets that exist?
- What would you look for in the KDC's logs?
From the lesson Kerberos tickets, authenticators and replay checks
Model answer, Pro.In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
-
Mid to senior
A file service in a Kerberos realm crashes and restarts, and its replay cache lived in memory. Describe the window that this opens, what the service must do after the restart, and how you would design the service so that a restart is not an opening for an attacker.
- What it tests
- Applying the rule for a service that loses its replay cache, seeing the shared-principal and failover cases, and weighing protections inside the application protocol.
- First step
- Ask what an attacker could have recorded. Every authenticator sent in the last skew interval is still valid by the clock, and the cache that would refuse a second copy is gone. Then ask for how long exactly.
- Follow-ups
-
- Why must the refusal last the whole skew, up to its last second, and not less?
- Two machines serve one service principal: what must they share?
- What can the application protocol add so that the cache is not the only defence?
From the lesson Kerberos tickets, authenticators and replay checks
Model answer, Pro.In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
All Applied Cryptography for Developers interview questions · The Applied Cryptography for Developers track