CEH Cryptography and Malware Analysis Practice Question

During a penetration test, a security analyst discovers that an organization's web application uses HTTP for login forms, potentially exposing credentials to interception. Which of the following is the BEST cryptographic control to implement to protect credentials in transit?

⚠ Common exam trap

Many candidates confuse encryption at rest (hashing) or partial encryption (AES on password field) with full-session encryption (TLS), or they think digital signatures provide confidentiality, when in fact they only ensure authenticity and integrity.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Enforce HTTPS using TLS 1.2 or higher.

HTTPS with TLS 1.2 or higher encrypts the entire HTTP session, including login credentials, preventing interception and man-in-the-middle attacks. This is the standard cryptographic control for protecting data in transit, as mandated by RFC 2818 and PCI DSS. TLS 1.2+ uses strong cipher suites like ECDHE-RSA-AES256-GCM-SHA384 to ensure forward secrecy and confidentiality.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Implement password hashing with bcrypt on the server side.
Why it's wrong here
Implementing password hashing with bcrypt on the server side is a critical security measure for protecting stored credentials against database breaches. However, this process occurs *after* the password has been transmitted from the client to the server. Therefore, hashing does not protect the password during its journey across the network, leaving it vulnerable to interception in cleartext if the communication channel itself is not encrypted.
✗
Use digital signatures to sign the login request.
Why it's wrong here
Digital signatures provide authenticity and integrity for a login request, ensuring that the request originated from a legitimate source and has not been tampered with during transit. Nevertheless, digital signatures do not encrypt the content of the request. An attacker intercepting a signed request would still be able to read the plaintext username and password, as the signature only validates the data, it does not obscure it.
✓
Enforce HTTPS using TLS 1.2 or higher.
Why this is correct
Enforcing HTTPS using TLS 1.2 or higher is the most effective solution for protecting credentials during transmission. TLS establishes an encrypted tunnel between the client and the server, ensuring confidentiality, integrity, and authenticity for all data exchanged, including login credentials. This robust encryption prevents eavesdropping, tampering, and man-in-the-middle attacks by encrypting the entire communication channel end-to-end.
✗
Encrypt the password field using AES-256 before sending via HTTP.
Why it's wrong here
Encrypting only the password field using AES-256 before sending it via plain HTTP is an incomplete and insecure approach. While AES-256 provides strong encryption for the password itself, the critical challenge lies in securely distributing the encryption key to the client without an already established secure channel. Additionally, other sensitive information within the HTTP request would remain unencrypted and susceptible to interception, compromising overall session security.

Quick reference

Asymmetric Encryption Algorithm Comparison

Algorithm	Key Exchange	Signatures	Equivalent Security Key	Notes
RSA-3072	Yes	Yes	128-bit	Widely deployed; slow for bulk data
ECDSA P-256	No	Yes	128-bit	Fast signatures; standard TLS certs
ECDH / ECDHE	Yes	No	128-bit	Perfect forward secrecy in TLS 1.3
DH / DHE	Yes	No	128-bit (3072-bit key)	Replaced by ECDHE in modern TLS
Ed25519	No	Yes	~128-bit	SSH keys, modern PKI

Go deeper

CEH Cryptography and Malware Analysis Practice Question

Why each option matters

Option-by-option breakdown

Asymmetric Encryption Algorithm Comparison

Related to this question