Cryptographic Primitives.

Where application code meets cryptographic primitives, and the choices that break it without a visible error. Covers 10 topics.

• Cryptographic Primitives · 1 of 3

  JWT Security Best Practices

  What does the registered 'exp' claim in a JWT specify?

  AThe earliest time at which the token is allowed to be processedBThe hard upper bound on the number of refreshes a token allowsCThe expiration time after which the token must not be acceptedDThe timestamp recording when the token was originally issued out

• Cryptographic Primitives · 2 of 3

  Symmetric Encryption (AES)

  What is the concept of key wrapping and when is it used?

  AEncoding a data key into a secure storage formatBA key exchange protocol used over insecure public networksCWrapping plaintext around a key to conceal itDEncrypting one key with another key for secure storage

• Cryptographic Primitives · 3 of 3

  JWT Security Best Practices

  Per RFC 7523, which freshness mechanism lets an authorization server reject a replayed JWT client_assertion?

  AA signed date claim, so the verifier rejects any assertion from an earlier dayBA unique jti tracked by the verifier within the assertion's exp windowCAn iat claim compared against a fixed two-second wall-clock skewDA monotonic counter claim that the issuer increments on each new request