Study. uk . com
  1. Home
  2. All questions
  3. Question 276

CISSP study material · question 276 of 500

A deployment enables ESP encryption but disables its integrity service to save cycles. What does RFC 4303 say about this configuration?

  1. It is prohibited outright by the specification.
  2. It is permitted but not recommended: encryption without strong integrity defends only against a passive attacker.
  3. It is recommended where AH is also in use in transport mode.
  4. It is acceptable provided the cipher operates in an authenticated mode.
Show the answer

Answer: B. It is permitted but not recommended: encryption without strong integrity defends only against a passive attacker.

ESP allows encryption-only use, but RFC 4303 warns this generally defends only against passive attackers, and that encryption without strong integrity may be insecure against some active attacks.

Source: RFC 4303 (IETF) — RFC 4303 > 1. Introduction

Challenge yourself on this topic → Study as cards