This page needs a newer browser to run its tools. You can still read everything here.

Applied Cryptography for Developers Module 8

Inside DES, 3DES and AES interview questions

Interview questions on inside DES, 3DES and AES: short warm-ups, then what each harder question tests, the first step of a good answer and its follow-ups.

15 questions: 4 warm-ups and 11 with model answers · Levels: Fresher to staff

Warm-up questions

Short questions with short answers, each answered in full.

Fresher to mid

What is a Feistel network, and why can it decrypt even when its round function cannot be inverted?

Answered in the lesson Feistel networks and a worked DES example
Fresher to mid

What is a meet-in-the-middle attack, and why is double DES not used?

Answered in the lesson Multiple encryption, 3DES and 64-bit block limits
Fresher to mid

Name the four steps of an AES round in order, and say which one uses the key and which one the last round leaves out.

AES lays a 16-byte block out as a 4 by 4 grid of bytes, the state, and runs 10, 12 or 14 rounds on it for a 128-, 192- or 256-bit key. Each round does SubBytes, ShiftRows, MixColumns and AddRoundKey, in that order. SubBytes replaces every byte through a fixed 256-entry table, the S-box. ShiftRows moves row r of the grid r places to the left. MixColumns mixes the four bytes of each column so that each output byte depends on all four. AddRoundKey XORs a 16-byte round key into the state, and it is the only step that uses the key: one round key is added before round 1 and one at the end of every round. The last round leaves out MixColumns. Key expansion makes the 11, 13 or 15 round keys from the cipher key.
From the lesson AES rounds and key expansion, step by step
Fresher to mid

What is CBC-MAC, and what does CMAC change?

CBC-MAC is CBC encryption with the IV fixed at zero, keeping only the last output block as the tag: H1 = E(K, m1) and Hi = E(K, H(i-1) XOR mi). CMAC, from NIST SP 800-38B and RFC 4493, keeps that chain and changes only the last block. It derives two subkeys from the one key, L = E(K, 0), K1 = L doubled in GF(2^128) and K2 = K1 doubled. A complete last block is XORed with K1; a short or empty one is padded with 80 and zeros and XORed with K2. That lets CMAC take a message of any length, the empty message included, where raw CBC-MAC is built for messages of a fixed number of blocks. A correct implementation reproduces the four examples of RFC 4493 under the key 2b7e1516…4f3c, such as bb1d6929… for the empty message and 070a16b4… for 16 bytes.
From the lesson CBC-MAC, CMAC and hashes built from block ciphers

Questions with model answers

What each question tests, the first step of a good answer and the follow-ups to expect.

Mid to senior

A partner sends nightly files encrypted with single DES in CBC mode under a key shared years ago, and your service must keep reading them for six more months. Design the reading path and the move to something safe, and say what you would test.
What it tests

Seeing that single DES is a key-search problem, containing a legacy decrypt path, planning a move to an AEAD with the partner, and proving the old path with known-answer tests until it is deleted.

First step

Separate the two jobs. Reading old files is decryption of data that is already exposed to whoever recorded it, so contain it: one module, one key, read-only. Protecting new files needs a new format with the partner, an AEAD under a fresh key, and a date after which the old path is removed.
Follow-ups
- What can someone who recorded last year's files do with them today?
- Node.js 24 hides des-cbc. How do you read the files without weakening every other part of the service?
- How do you know the legacy path still decrypts correctly the day you remove it?
From the lesson Feistel networks and a worked DES example
Model answer, Pro. Model answers open with any pass; prices are in the notice on this page.
Opening the model answers with your pass…
Model answers open with any MySmartCoPilot pass.
Pro pass · 1 week₹79$2.99
30 days₹179$5.99
1 year₹1,699$45
One payment; a pass never renews. The price shown is the total you pay: no fees or charges are added at checkout.
Passes can’t be bought right now, so the model answers can’t be opened at the moment. If you have a pass, enter your licence key.
Choose a pass I have a licence key
It also opens every other in-depth part in Learn and every Pro tool. Sales are final, except where the law gives you a right to withdraw, for example in the EU and the UK (refund policy).
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Mid to staff

A pull request adds a hand-written block cipher module that passes every NIST known-answer record, so that a small service can drop its crypto library dependency. Review the proposal: what do the tests prove, what do they not, and what do you ask for instead?
What it tests

Knowing what known-answer tests establish and what they cannot, naming implementation attacks such as timing, and steering to a validated library while keeping test vectors in the test suite.

First step

Credit what the tests show: every output the files check is right. Then name what they do not show: how long each call takes for different keys, what the code leaks through memory access, how it fails, and whether anyone will maintain it. FIPS 197 itself says suggested implementations do not protect against implementation attacks.
Follow-ups
- The author says the service is internal. Does that change your answer?
- What would make you accept a hand-written implementation anywhere?
- How should the known-answer tests be kept after the module is removed?
From the lesson Feistel networks and a worked DES example
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Mid to senior

A design document for a new file format says: encrypt every file twice with AES-128, under key A and then under key B, for "256-bit security". Review the claim. What is the real strength, what does the design cost, and what do you propose instead?
What it tests

Counting a meet-in-the-middle search on stacked ciphers, seeing that the table's size does not defend a claim, and replacing stacking with one authenticated cipher or an honest hedge.

First step

Count the attack, not the keys. With one known plaintext and its ciphertext, a meet-in-the-middle search needs about 2 x 2^128 AES calls and a table of 2^128 entries, so the design is worth about 129 bits, not 256. Then ask what threat the second layer was meant to cover.
Follow-ups
- A colleague says the table of 2^128 entries makes the attack impossible. Does that rescue the design?
- When is encrypting under two different algorithms reasonable?
- What does the file format look like after your change?
From the lesson Multiple encryption, 3DES and 64-bit block limits
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 4 minutes
Mid to senior

A scan of a partner integration finds a 24-byte Triple DES key whose first 16 bytes are one 8-byte value twice, followed by 8 different bytes. What does the configuration really compute, how do you check for it in your own code, and what do you do next?
What it tests

Seeing that K1 = K2 collapses Triple DES to single DES, including keys that differ only in parity bits, writing the check, and planning a safe replacement.

First step

Work out the bundle. K1 equal to K2 means the first two calls cancel, so the integration computes single DES under K3, a 56-bit key. Check K2 = K3 and all-equal bundles too, comparing keys without the lowest bit of each byte, which DES does not use. Then treat the data as protected by 56 bits.
Follow-ups
- The two halves differ only in their parity bits. Does your answer change?
- How would you test every key bundle in a configuration repository?
- The partner cannot change the key for a year. What do you do meanwhile?
From the lesson Multiple encryption, 3DES and 64-bit block limits
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Mid to staff

A nightly job encrypts 40 GiB of backups with Triple DES in CBC mode under one long-lived key. A report cites the Sweet32 research. Put numbers on the risk, say what is exposed, and propose the fix and the order of the migration.
What it tests

Applying the birthday bound to a real volume, relating NIST's cap of 2^20 blocks to the job, and planning a move to an authenticated cipher with an order that follows exposure.

First step

Convert the volume to blocks: 40 GiB is 5.4 billion 8-byte blocks a night. Expected repeated pairs under one key are about n squared over 2^65, so one night gives 0.78 and a year of nights under the same key about 104,000. Each repeat gives away the XOR of two plaintext blocks.
Follow-ups
- Could you keep Triple DES and rotate the key often enough?
- What can someone do with a repeated block, and what can they not do?
- In what order do you migrate years of old backups?
From the lesson Multiple encryption, 3DES and 64-bit block limits
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Mid to senior

A teammate's AES implementation passes NIST's known-answer files for 128-bit and 192-bit keys and fails every 256-bit record. Where do you look first, how do you localise the fault, and what test keeps it from coming back?
What it tests

Knowing that only the key schedule and the round count differ between key sizes, using published word-level values to find the first wrong word, and turning the fix into a lasting test.

First step

The round function is shared by all key sizes, so it is right. Compare the key schedule instead: FIPS 197 Appendix A.3 prints all 60 words of the 256-bit schedule. Print the implementation's words and find the first one that differs; its index says which rule of the schedule failed.
Follow-ups
- Which word differs first, and what does each possible answer tell you?
- How does the fault look in the KeySbox and VarKey files?
- What tests do you add so that it cannot return?
From the lesson AES rounds and key expansion, step by step
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Mid to staff

A designer wants a faster cipher and proposes AES with MixColumns removed from every round, keeping ten rounds of SubBytes, ShiftRows and AddRoundKey. Show with numbers why that breaks the design, and what the original's two-round behaviour says about it.
What it tests

Explaining diffusion with measured numbers, seeing that the variant acts on every byte independently, and separating full dependence after two rounds from security.

First step

Change one input byte and count the output bytes that differ. With MixColumns the answer is 4 after one round and 16 after two. Without it the answer is 1 at every round count, so each output byte depends on a single input byte whatever the key.
Follow-ups
- Is the original cipher secure after only two rounds?
- What changes if ShiftRows is removed and MixColumns kept?
- What do you tell the designer who needs more speed?
From the lesson AES rounds and key expansion, step by step
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Senior to staff

You maintain a wrapper around a vetted AES library. Design the known-answer tests you keep in the repository: which files, which key sizes and directions, and what these tests do not tell you.
What it tests

Choosing known-answer tests that probe different failure classes, covering all key sizes and both directions, and stating what correctness tests cannot show about timing, modes and key handling.

First step

Take the four CAVP ECB families for all three key sizes in both directions, 2,078 records, because each family varies a different input: blocks, keys, key bits and block bits. Then list what they cannot show: timing, nonces, mode behaviour and how keys are stored.
Follow-ups
- Why test decryption when your wrapper only encrypts?
- Which tests do you add for the mode you use on top of AES?
- How do you keep the vector files trustworthy in the repository?
From the lesson AES rounds and key expansion, step by step
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Mid to senior

A device SDK tags messages of 1 to 200 bytes with AES-CBC, a zero IV, zero padding to whole blocks and the last block as the tag. Review the design: what can someone do without the key, how do you show it with a test on your own system, and what replaces it?
What it tests

Knowing that raw CBC-MAC of variable length accepts an extension built from a message and its tag, noticing the ambiguity of zero padding, writing the forgery check, and replacing the scheme with CMAC under a key of its own.

First step

Write the check before the fix. Take a tagged one-block message m with tag t, build m followed by m XOR t from those two values alone, and ask the verifier whether it accepts that 32-byte message with the tag t. If it does, the design has a hole, whatever the key length.
Follow-ups
- Does fixing the message length in the protocol help, and where must the length come from?
- What else is wrong with padding by zeros?
- The device has AES hardware and no hash function. What do you ship?
From the lesson CBC-MAC, CMAC and hashes built from block ciphers
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Senior to staff

A teammate proposes hashing uploaded files with AES in Davies-Meyer mode, to avoid a new dependency. Evaluate it: what do you compute first, what does a toy version show about the feed-forward, what are the digest numbers, and what do you recommend instead?
What it tests

Applying the birthday bound to a block-cipher hash, explaining what the feed-forward removes, relating the numbers to ASVS, and steering to a standard hash while keeping the construction as understanding.

First step

Compute the numbers before arguing about the design. The digest is one AES block, 128 bits, so collisions cost about 2^64 work, below the 128 bits of security that ASVS 5.0 asks for of every primitive and far below the 256-bit output it wants where collision resistance matters.
Follow-ups
- What does the toy show happens without the feed-forward?
- Would two AES calls for a 256-bit digest fix the numbers?
- Which standard hash do you use, and where is it in Node.js 24?
From the lesson CBC-MAC, CMAC and hashes built from block ciphers
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Senior to staff

A sensor has hardware AES and no hash function, and the server runs Node.js 24. Every message needs integrity and some need secrecy. Choose the primitives and the tag length, set a limit for each key, and say what you test on both ends.
What it tests

Choosing CMAC or an AEAD by what the device can run, handling a server platform without CMAC, applying the tag-length and message-span guidance of SP 800-38B, and separating keys by purpose.

First step

Split the messages by need. Integrity only fits AES-CMAC on the device; integrity with secrecy fits an AEAD such as AES-CCM or AES-GCM if the hardware has it. Then check what the server can verify: Node.js 24 has no CMAC, so the server needs a vetted library for it.
Follow-ups
- How long does one device key last at ten messages a minute, with a 128-bit and a 64-bit block?
- How do the device and the server derive their keys?
- What happens if the server cannot get a CMAC library?
From the lesson CBC-MAC, CMAC and hashes built from block ciphers
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes

The lessons of this module

Feistel networks and a worked DES example Free lesson, Pro answers: 35 minutes
Multiple encryption, 3DES and 64-bit block limits Free core, Pro depth: 10 of 30 minutes free
AES rounds and key expansion, step by step Free intro, Pro: 6 of 35 minutes free
CBC-MAC, CMAC and hashes built from block ciphers Free intro, Pro: 6 of 35 minutes free

All Applied Cryptography for Developers interview questions · The Applied Cryptography for Developers track

Warm-up questions

What is a Feistel network, and why can it decrypt even when its round function cannot be inverted?

What is a meet-in-the-middle attack, and why is double DES not used?

Name the four steps of an AES round in order, and say which one uses the key and which one the last round leaves out.

What is CBC-MAC, and what does CMAC change?

Questions with model answers

A partner sends nightly files encrypted with single DES in CBC mode under a key shared years ago, and your service must keep reading them for six more months. Design the reading path and the move to something safe, and say what you would test.

A pull request adds a hand-written block cipher module that passes every NIST known-answer record, so that a small service can drop its crypto library dependency. Review the proposal: what do the tests prove, what do they not, and what do you ask for instead?

A design document for a new file format says: encrypt every file twice with AES-128, under key A and then under key B, for "256-bit security". Review the claim. What is the real strength, what does the design cost, and what do you propose instead?

A scan of a partner integration finds a 24-byte Triple DES key whose first 16 bytes are one 8-byte value twice, followed by 8 different bytes. What does the configuration really compute, how do you check for it in your own code, and what do you do next?

A nightly job encrypts 40 GiB of backups with Triple DES in CBC mode under one long-lived key. A report cites the Sweet32 research. Put numbers on the risk, say what is exposed, and propose the fix and the order of the migration.

A teammate's AES implementation passes NIST's known-answer files for 128-bit and 192-bit keys and fails every 256-bit record. Where do you look first, how do you localise the fault, and what test keeps it from coming back?

A designer wants a faster cipher and proposes AES with MixColumns removed from every round, keeping ten rounds of SubBytes, ShiftRows and AddRoundKey. Show with numbers why that breaks the design, and what the original's two-round behaviour says about it.

You maintain a wrapper around a vetted AES library. Design the known-answer tests you keep in the repository: which files, which key sizes and directions, and what these tests do not tell you.

A device SDK tags messages of 1 to 200 bytes with AES-CBC, a zero IV, zero padding to whole blocks and the last block as the tag. Review the design: what can someone do without the key, how do you show it with a test on your own system, and what replaces it?

A teammate proposes hashing uploaded files with AES in Davies-Meyer mode, to avoid a new dependency. Evaluate it: what do you compute first, what does a toy version show about the feed-forward, what are the digest numbers, and what do you recommend instead?

A sensor has hardware AES and no hash function, and the server runs Node.js 24. Every message needs integrity and some need secrecy. Choose the primitives and the tag length, set a limit for each key, and say what you test on both ends.