GSEC Cryptography Application Practice Question
A security analyst is reviewing a legacy application that uses RSA for digital signatures. The application generates a 1024-bit RSA key pair and signs messages using SHA-1. The analyst must recommend an upgrade that maintains the same algorithm family but meets current security standards. Which change should be recommended?
⚠ Common exam trap
The trap here is focusing only on the hash function and overlooking the insufficient RSA key size, which also requires upgrading to meet modern standards.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Increase the RSA key size to 2048 bits and replace SHA-1 with SHA-256.
To meet current security standards while preserving the RSA algorithm family, the analyst should recommend increasing the RSA key size to 2048 bits and replacing SHA-1 with SHA-256. This addresses both the weak key length and the deprecated hash function, providing a secure and compliant digital signature solution without changing the underlying public-key algorithm.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Keep the 1024-bit RSA key but replace SHA-1 with SHA-3.
Why it's wrong here
Replacing SHA-1 with SHA-3 improves hash security, but the 1024-bit RSA key remains too weak for modern standards. NIST recommends a minimum of 2048-bit RSA keys for security beyond 2030. The key size must also be increased to meet current requirements. Thus, this change is insufficient.
- ✗
Replace RSA with HMAC-SHA256 for signing.
Why it's wrong here
HMAC-SHA256 is a symmetric message authentication code, not a digital signature algorithm. It cannot provide non-repudiation and requires a shared secret key, which is unsuitable for signing messages in a public-key infrastructure. This does not maintain the RSA algorithm family and is conceptually incorrect for digital signatures.
- ✓
Increase the RSA key size to 2048 bits and replace SHA-1 with SHA-256.
Why this is correct
Increasing RSA key size to 2048 bits and replacing SHA-1 with SHA-256 aligns with current standards such as NIST SP 800-57 and CA/Browser Forum requirements. This maintains the RSA algorithm family while addressing vulnerabilities in both key length and hash function. It provides a stronger security margin without changing the underlying cryptographic approach.
- ✗
Switch to Elliptic Curve Digital Signature Algorithm (ECDSA) with P-256 and SHA-256.
Why it's wrong here
While ECDSA with P-256 and SHA-256 is secure and efficient, it changes the algorithm family from RSA to elliptic curve. The requirement explicitly states to maintain the same algorithm family. Therefore, this recommendation does not meet the stated constraint, even though it is a valid upgrade in other contexts.
Quick reference
Asymmetric Encryption Algorithm Comparison
| Algorithm | Key Exchange | Signatures | Equivalent Security Key | Notes |
|---|---|---|---|---|
| RSA-3072 | Yes | Yes | 128-bit | Widely deployed; slow for bulk data |
| ECDSA P-256 | No | Yes | 128-bit | Fast signatures; standard TLS certs |
| ECDH / ECDHE | Yes | No | 128-bit | Perfect forward secrecy in TLS 1.3 |
| DH / DHE | Yes | No | 128-bit (3072-bit key) | Replaced by ECDHE in modern TLS |
| Ed25519 | No | Yes | ~128-bit | SSH keys, modern PKI |
About these practice questions
One of 351 original GSEC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GSEC practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GSEC exam.