A hybrid attack combines a dictionary attack (using word lists) with brute-force techniques, such as adding numbers or symbols to dictionary words. This explains why the password wasn’t in a standard list but was still cracked systematically, unlike a pure dictionary or rainbow table (for hashes) attack. A birthday attack is related to hash collisions, not password cracking.

The XOR cipher, when using a repeating key, has the property where the same operation (XOR) is used for both encryption and decryption. If you XOR the plaintext with the key to get ciphertext, XORing the ciphertext with the same key returns the plaintext. The other ciphers listed use different algorithms or steps for encryption versus decryption.

HMAC (Hash-based Message Authentication Code) provides efficient integrity and authenticity verification using a shared secret key. It is computationally much less expensive than asymmetric digital signatures (RSA or ECDSA), making it ideal for resource-constrained environments. AES-GCM provides confidentiality and integrity but is heavier than HMAC alone if only integrity/authenticity is needed.

A collision occurs when two distinct inputs (messages) produce the same hash output. This is the general property described. The ‘birthday attack’ exploits the probability of finding such a collision. Second pre-image resistance is finding a different input that hashes to a specific, given hash value. Pre-image resistance is finding any input that hashes to a given output. The avalanche effect refers to a small change in input causing a large change in output.

Non-repudiation and integrity are achieved by creating a digital signature. This is typically done by hashing the message and then encrypting that hash with the sender’s private key. The recipient can decrypt the hash with the sender’s public key (verifying origin/non-repudiation) and compare it to a newly generated hash of the received message (verifying integrity). Option A is incorrect and would expose the sender’s private key. Options C and D provide confidentiality but not non-repudiation.

ECB mode encrypts identical plaintext blocks into identical ciphertext blocks. In an image, areas of uniform color or pattern (like a logo) become identical blocks. When encrypted, these repeating ciphertext blocks reveal the underlying pattern, making the original image structure discernible. This is a fundamental flaw of ECB for any data with redundancy. The other options are not direct artifacts of the ECB mode’s cryptographic weakness.

The key advantage of ECC is its efficiency. It provides the same level of cryptographic security as RSA but with much smaller key sizes (e.g., a 256-bit ECC key is roughly equivalent to a 3072-bit RSA key). This leads to faster computations, less storage, and reduced bandwidth usage, which is a tangible business benefit. Option A is not always true (verification can be slower). Option B is false; ECC is not quantum-resistant. Option D is not a general truth.

The risk described is the substitution or alteration of the ciphertext. Integrity ensures that data has not been altered in an unauthorized manner. Cryptographic mechanisms like Hashed Message Authentication Codes (HMACs) or authenticated encryption modes (e.g., GCM) can verify that the ciphertext received is exactly the one that was sent, thus preventing this type of substitution attack. Confidentiality prevents reading, non-repudiation proves origin, and availability ensures access.

Cryptography requires randomness that is unpredictable to an adversary. LCGs are simple pseudo-random number generators (PRNGs) that produce a deterministic sequence based on their seed. If an attacker knows the algorithm (often public) and can guess or approximate the seed (like system time), they can reproduce the entire sequence of ‘random’ numbers, completely compromising the security of the session tokens. Speed, distribution, and length are secondary to this fundamental flaw in predictability.

A hybrid attack combines a dictionary attack (using word lists) with brute-force techniques, such as adding numbers or symbols to dictionary words. This explains why the password wasn’t in a standard list but was still cracked systematically, unlike a pure dictionary or rainbow table (for hashes) attack. A birthday attack is related to hash collisions, not password cracking.0