Study. uk . com
  1. Home
  2. All questions
  3. Question 39

CISSP study material · question 39 of 500

A team is migrating a payment gateway to TLS 1.3 and asks why its static RSA key exchange and its CBC-mode cipher preferences must be replaced by authenticated encryption with associated data (AEAD) suites. Which statements describe the changes made in TLS 1.3? Choose two.

  1. Suite identifiers still name the key-agreement and authentication methods alongside the bulk protection algorithm.
  2. Renegotiation was retained, so a static RSA suite can still be selected once the initial handshake completes.
  3. Only AEAD algorithms remain for bulk protection, and a suite identifier names record protection and a hash.
  4. Static RSA and static Diffie-Hellman were removed, so every surviving public-key negotiation yields forward secrecy.
Show the answer

Answer: D. Static RSA and static Diffie-Hellman were removed, so every surviving public-key negotiation yields forward secrecy.
C. Only AEAD algorithms remain for bulk protection, and a suite identifier names record protection and a hash.

TLS 1.3 dropped static RSA and static Diffie-Hellman, making every key exchange forward secret, and kept only AEAD bulk algorithms; suite identifiers stopped naming key agreement or authentication.

Source: RFC 9846 (IETF) — RFC 9846 > 1.3 Major Differences from TLS 1.2

Challenge yourself on this topic → Study as cards