Cryptographic Primitives.

Where application code meets cryptographic primitives, and the choices that quietly break it. Covers 10 sub-skills.

• Cryptographic Primitives · 1 of 3

  JWT Security Best Practices

  What does the registered 'exp' claim in a JWT specify?

  AThe earliest time at which the token is allowed to be processedBThe hard upper bound on the number of refreshes a token allowsCThe expiration time after which the token must not be acceptedDThe timestamp recording when the token was originally issued out

• Cryptographic Primitives · 2 of 3

  Symmetric Encryption (AES)

  What is the concept of key wrapping and when is it used?

  AEncoding a data key into a secure storage formatBA key exchange protocol used over insecure public networksCWrapping plaintext around a key to conceal itDEncrypting one key with another key for secure storage

• Cryptographic Primitives · 3 of 3

  JWT Security Best Practices

  Per current IETF guidance, replay protection for one-time JWT-style assertions (e.g., client_assertion in OAuth) should rely on which freshness primitive in 2025?

  AA nonce echoed back from a prior unauthenticated server challenge stepBA unique jti tracked by the verifier within the assertion's exp windowCAn iat claim compared against a fixed two-second wall-clock skewDA monotonic counter claim that the issuer increments on each new request