📝 PGP Pretty Good Privacy in email (23 MCQs)

📖 From Data Communication and Networks • 32. Internet Security • 23 questions available

←Previous Topic:Email security protocols📝 PGP Pretty Good Privacy in emailS/MIME secure email protocol:Next Topic→

What is PGP Pretty Good Privacy in email?

Pretty Good Privacy (PGP) is a decentralized email security program that uses a web-of-trust model combined with symmetric and asymmetric encryption to provide confidentiality, authentication, and message integrity for individual users.

Easy

Medium

Hard

📝 All PGP Pretty Good Privacy in email MCQs

Q1. If a sender encrypts a message with the recipient’s public key in PGP, which statement must be true for confidentiality?

A.Only the sender can decrypt the message

B.Only the intended recipient can decrypt the message ✅

C.Anyone with the public key can decrypt the message

D.No one can ever decrypt the message

💡 Difficulty: easy | ✅ Correct: B

📖 Explanation: Because PGP uses the recipient’s public key to encrypt, only the holder of the corresponding private key – the intended recipient – can reverse the encryption. The sender cannot decrypt, and the public key alone does not provide decryption capability, ensuring confidentiality for the intended party.

Q2. When Alice signs a message with her private signing key, what can Bob reliably infer after verifying the signature with Alice’s public key?

A.The message originated from Alice and has not been altered ✅

B.The message is encrypted for Bob

C.Alice’s private key is compromised

D.Bob can forward the message securely

💡 Difficulty: easy | ✅ Correct: A

📖 Explanation: Verification with Alice’s public key proves that the signature was produced by the matching private key, which only Alice should possess. This guarantees authenticity (the sender is Alice) and integrity (the content has not changed) but does not provide encryption or any information about key compromise.

Q3. Given the current interval $[0.685,0.690)$ in an arithmetic encoder, if the next symbol narrows the interval by a factor of $0.66$ , what is the new interval’s lower bound?

A.0.685 ✅

B.0.6883

C.0.4521

D.0.69

💡 Difficulty: medium | ✅ Correct: A

📖 Explanation: In arithmetic coding, the lower bound of the interval remains unchanged while the width is multiplied by the probability factor. Multiplying the original width $0.690-0.685 = 0.005$ by $0.66$ yields a new width of $0.0033$ . Thus the lower bound stays at $0.685$ .}

Q4. If a recipient’s private decryption key is accidentally exposed, which of the following consequences is most direct?

A.All previously encrypted messages become readable ✅

B.Future messages can no longer be encrypted to that recipient

C.The sender’s digital signatures become invalid

D.The web of trust collapses entirely

💡 Difficulty: medium | ✅ Correct: A

📖 Explanation: Exposure of the private decryption key means anyone possessing it can decrypt any ciphertext encrypted with the corresponding public key. Consequently, all past communications that relied on that key lose confidentiality, while signatures and the web of trust remain technically functional.

Q5. Why does PGP typically compress data before encrypting it?

A.Compression reduces the amount of data that must be encrypted, improving performance ✅

B.Compression adds an extra layer of security by hiding patterns

C.Compression makes the ciphertext deterministic

D.Compression eliminates the need for a symmetric key

💡 Difficulty: medium | ✅ Correct: A

📖 Explanation: Compressing plaintext reduces its size, meaning fewer bits are processed by the symmetric cipher, which speeds up encryption and decryption. Although compression can also obscure redundancy, its primary purpose in PGP is to improve efficiency rather than to provide additional cryptographic strength.

Q6. An attacker captures a large number of ciphertexts encrypted with the same symmetric session key but different public keys. Which attack becomes feasible?

A.Known‑plaintext attack on the symmetric algorithm

B.Chosen‑ciphertext attack on the RSA keys

C.Side‑channel attack on the compression stage

D.Key‑recovery attack on the session key via statistical analysis ✅

💡 Difficulty: hard | ✅ Correct: D

📖 Explanation: When many ciphertexts share the same session key, statistical patterns can emerge, allowing an attacker to perform a key‑recovery attack by exploiting the redundancy of the symmetric encryption. This is why PGP generates a fresh random session key for each message.

Q7. In PGP’s web of trust, what is the immediate effect when a user marks another’s key as “fully trusted”?

A.All keys signed by that user become automatically trusted ✅

B.The user’s own key is upgraded to a higher security level

C.The user can now encrypt messages to any key without verification

D.The user’s revocation certificates become active

💡 Difficulty: easy | ✅ Correct: A

📖 Explanation: Marking a key as fully trusted tells PGP that the signer’s judgments are reliable. Consequently, any keys that this trusted signer has certified inherit trust, simplifying verification for the user without requiring direct signatures from every individual key.

Q8. Which statement best describes the purpose of a revocation certificate in PGP?

A.It permanently disables the public key after a set date

B.It allows the key owner to announce that the key should no longer be used ✅

C.It encrypts future messages to a backup key

D.It provides a backup of the private key for recovery

💡 Difficulty: medium | ✅ Correct: B

📖 Explanation: A revocation certificate is a specially signed statement that the key owner creates (often at key generation). When published, it signals to others that the associated public key is no longer valid, preventing further use and alerting the community to stop trusting that key.

Q9. If a user’s key is revoked but several contacts still have outdated copies of the key, what is the most likely consequence?

A.All future communications are automatically encrypted with the old key

B.Recipients may continue to encrypt to the revoked key, causing decryption failures ✅

C.The revoked key becomes re‑activated after a timeout

D.PGP automatically updates all copies of the key across the network

💡 Difficulty: hard | ✅ Correct: B

📖 Explanation: Revocation does not propagate magically; contacts must obtain the updated keyring. Those who retain the old, now‑revoked key may still encrypt messages to it, which the original owner can no longer decrypt, leading to loss of confidentiality and possible communication breakdown.

Q10. Compare the use of symmetric encryption in PGP with using symmetric encryption alone. Which advantage does the hybrid approach provide?

A.It eliminates the need for key management entirely

B.It allows the same key to be reused indefinitely

C.It enables fast encryption while preserving secure key distribution ✅

D.It makes the system immune to quantum attacks

💡 Difficulty: easy | ✅ Correct: C

📖 Explanation: PGP’s hybrid scheme encrypts the bulk data with a fast symmetric cipher, then encrypts the randomly generated session key with the recipient’s public key. This combines the speed of symmetric encryption with the secure key exchange properties of asymmetric cryptography, solving the key‑distribution problem.

Q11. Evaluate the impact of using a 1024‑bit RSA key versus a 4096‑bit RSA key in PGP. Which statement is most accurate?

A.The 1024‑bit key offers comparable security with faster operations

B.The 4096‑bit key provides stronger security but incurs noticeably slower encryption and decryption ✅

C.Both keys have identical performance characteristics

D.The 4096‑bit key reduces the need for a symmetric session key

💡 Difficulty: hard | ✅ Correct: B

📖 Explanation: A 4096‑bit RSA modulus dramatically increases the difficulty of factoring, thus enhancing security. However, the larger modulus makes modular exponentiation slower, leading to longer encryption and decryption times. Therefore, the trade‑off is stronger security at the cost of performance.

Q12. Which block cipher mode is most commonly used by PGP for encrypting the session key, and why?

A.ECB, because it is the simplest to implement

B.CBC, because it provides confidentiality and randomization through an IV ✅

C.CTR, because it turns a block cipher into a stream cipher

D.OFB, because it prevents error propagation

💡 Difficulty: medium | ✅ Correct: B

📖 Explanation: PGP traditionally employs Cipher Block Chaining (CBC) when encrypting data with a symmetric algorithm. CBC introduces an initialization vector (IV) that randomizes the first block, preventing identical plaintext blocks from producing identical ciphertext blocks, thus enhancing confidentiality.

Q13. Assess the effect of compressing data before encryption on both ciphertext size and security. Which outcome is correct?

A.Compression always reduces ciphertext size and improves security

B.Compression reduces size but can leak information about plaintext structure ✅

C.Compression increases size but hides plaintext patterns better

D.Compression has no impact on size or security

💡 Difficulty: hard | ✅ Correct: B

📖 Explanation: Compressing before encryption shrinks the plaintext, leading to smaller ciphertext. However, because compression removes redundancy, it can reveal statistical information about the original data (e.g., length patterns) that an attacker might exploit, so it does not uniformly improve security.

Q14. Compare two common methods for distributing revocation information in PGP. Which pair correctly describes them?

A.Uploading to a public key server vs. sending via encrypted email

B.Embedding in the message header vs. attaching as a separate file

C.Publishing on a key server vs. sharing through a signed certificate ✅

D.Using a QR code vs. publishing on a blockchain

💡 Difficulty: medium | ✅ Correct: C

📖 Explanation: Revocation certificates can be published on public key servers, making them globally accessible, or they can be directly shared as signed revocation certificates to contacts. Both methods rely on the signature’s authenticity, but the former offers broader distribution while the latter is more targeted.

Q15. The content shows the interval $[0.685,0.690)$ and a factor of $0.66$ . If the arithmetic encoder uses this factor to select a sub‑interval, what is the most plausible new upper bound?

A.0.6883 ✅

B.0.69

C.0.6917

D.0.6925

💡 Difficulty: medium | ✅ Correct: A

📖 Explanation: Starting with width $0.005$ , multiplying by $0.66$ yields a new width of $0.0033$ . Adding this to the lower bound $0.685$ gives an upper bound of $0.6883$ . This reflects how arithmetic coding narrows the interval proportionally to symbol probabilities.

Q16. Apply the confidentiality‑integrity‑authenticity triad to a typical PGP workflow. Which sequence best reflects the order of operations?

A.Sign → Compress → Encrypt → Send ✅

B.Compress → Encrypt → Sign → Send

C.Encrypt → Sign → Compress → Send

D.Sign → Encrypt → Compress → Send

💡 Difficulty: medium | ✅ Correct: A

📖 Explanation: In a standard PGP process, the sender first creates a digital signature (authenticity), then compresses the signed data (efficiency), encrypts the compressed block with a symmetric session key (confidentiality), and finally encrypts the session key with the recipient’s public key. This order preserves integrity and confidentiality throughout transmission.

Q17. Synthesize a secure multi‑recipient exchange using PGP. Which steps must be performed to ensure that each recipient can decrypt the file while preserving the sender’s signature?

A.Encrypt the file separately for each recipient, then sign each encrypted copy

B.Sign the file, then encrypt a single copy with a session key, and encrypt that session key with each recipient’s public key ✅

C.Compress the file, sign it, and broadcast the signature only

D.Encrypt the file with each recipient’s public key and omit the signature

💡 Difficulty: hard | ✅ Correct: B

📖 Explanation: The proper procedure is to first sign the plaintext (providing authenticity), then encrypt the signed data with a randomly generated symmetric session key (ensuring confidentiality), and finally encrypt that session key with each recipient’s public key. This allows all recipients to recover the same signed content.

Q18. Explain how the strength of a user’s passphrase influences the security of the symmetric key derived from it. Which statement is most accurate?

A.A weak passphrase makes the derived symmetric key vulnerable to dictionary attacks ✅

B.Passphrase length has no effect on key strength

C.Only the algorithm, not the passphrase, determines security

D.A strong passphrase weakens the symmetric key because it adds entropy

💡 Difficulty: medium | ✅ Correct: A

📖 Explanation: PGP often derives a symmetric key from a user‑chosen passphrase. If the passphrase is short or common, attackers can guess it using dictionary or brute‑force techniques, thereby compromising the derived key. Strong, high‑entropy passphrases dramatically increase the effort required to recover the key.

Q19. Discuss why PGP incorporates both symmetric and asymmetric encryption rather than relying on a single method. Which rationale best captures this design choice?

A.Asymmetric encryption alone is too fast, risking side‑channel attacks

B.Symmetric encryption alone cannot provide key distribution without exposure

C.Combining both allows fast data processing and secure key exchange ✅

D.The hybrid model eliminates the need for digital signatures

💡 Difficulty: easy | ✅ Correct: C

📖 Explanation: PGP’s hybrid design leverages the speed of symmetric algorithms for bulk data encryption while using asymmetric encryption to securely exchange the randomly generated session key. This balances performance with the strong key‑distribution properties of public‑key cryptography.

Q20. In a scenario where the web of trust fails because a trusted introducer is compromised, what mitigation strategy is most effective?

A.Immediately revoke all keys signed by the introducer ✅

B.Switch to a centralized PKI without further verification

C.Distribute a new master key to all users

D.Ignore the compromise and continue using existing signatures

💡 Difficulty: hard | ✅ Correct: A

📖 Explanation: If a trusted introducer’s key is compromised, all signatures that rely on that trust become suspect. Publishing revocation certificates for the compromised key and for any keys it signed forces the community to re‑evaluate trust relationships, limiting the spread of the breach.

Q21. Apply the concept of key escrow to PGP. Which implication is most accurate if an escrow authority holds a copy of users’ private keys?

A.All communications become perfectly private

B.The escrow authority can decrypt any message, reducing overall privacy ✅

C.Escrow eliminates the need for digital signatures

D.Escrow guarantees that no key can ever be lost

💡 Difficulty: medium | ✅ Correct: B

📖 Explanation: Key escrow stores a backup of private keys with a trusted third party. While it provides a recovery mechanism, it also means the escrow authority possesses the capability to decrypt any ciphertext encrypted to those keys, thereby compromising the absolute confidentiality that PGP otherwise offers.

Q22. Why does PGP employ a random initialization vector (IV) for block cipher modes like CBC?

A.To ensure the same plaintext block always encrypts to the same ciphertext block

B.To make decryption faster

C.To randomize the first block, preventing pattern leakage across messages ✅

D.To compress the ciphertext size

💡 Difficulty: easy | ✅ Correct: C

📖 Explanation: An IV introduces randomness to the first block of encryption, guaranteeing that identical plaintexts encrypted with the same key produce different ciphertexts. This prevents attackers from inferring relationships between messages, a crucial property for maintaining confidentiality in block cipher modes.

Q23. What does the acronym PGP stand for?

A.Public Global Privacy

B.Pretty Good Privacy ✅

C.Personalized Generic Protocol

D.Protected Group Protocol

💡 Difficulty: easy | ✅ Correct: B

📖 Explanation: PGP stands for Pretty Good Privacy, a widely used program that provides cryptographic privacy and authentication for data communication. It was originally created by Phil Zimmermann in 1991 and has become a de facto standard for email encryption.

🔗 Related Topics (MCQs)

📝 IPSec network layer security MCQs 📝 IPSec transport and tunnel modes: Two Modes MCQs 📝 IPSec AH and ESP Two Security Protocols MCQs 📝 IPSec security services MCQs 📝 Security Association in IPSec MCQs

←Previous Topic:Email security protocols📝 PGP Pretty Good Privacy in emailS/MIME secure email protocol:Next Topic→