Cryptography interview questions
Questions about using cryptography in applications: passwords, encryption, signatures, nonces and key management. The focus is choosing and using the right mechanism, rather than recalling mathematical definitions.
This topic has 13 opening questions and 48 follow-ups in the interview. Choose this domain in setup to practise it by voice or text.
How should a web app store user passwords, and what would you reject in a code review?
In a code review you find a password reset token generated with the language's ordinary random function — Math.random, rand(), that family. What is the problem, and what do you ask for instead?
A teammate wants to stop people guessing user IDs in URLs by base64-encoding them. When you object, they offer to use AES instead. What do you say to each?
A service issues a JWT at login, the browser keeps it, and every API verifies the signature and trusts the claims. No session store. What did they buy, and what did they give up?
A webhook verifier computes an HMAC, then compares equal-length signatures one byte at a time and returns false at the first mismatch. What would you flag?
A backend encrypts per-user settings with AES-GCM, and the nonce for each row is the current time in seconds. What worries you?
Two internal services need to verify each other's requests. One engineer proposes a shared secret in both configs, another proposes each service having its own key pair. Which do you back, and why?
You need to encrypt customer PII at rest in a database. Walk me through keys: what encrypts the rows, where that key lives, and how you rotate it.
A customer says they want to store files with you, but they do not want your company to be able to read them. What do you actually offer them, and what does it cost?
A mobile team's staging build disables TLS certificate verification so QA is not blocked by an expired cert. What did they buy, and what did they give up?
You are designing API keys for a public API. Customers will put the key in their backend. Design issuance, storage, use, and revocation.
A signing key is used by a dozen services to issue and verify tokens. You need to rotate it with no downtime and no invalid tokens in flight. How do you do it?
Your product advertises end-to-end encrypted messaging. Product now wants server-side search over message content, and a report-abuse button that shows the reported message to your staff. Reconcile those.
Each question is beginner or advanced. The tier describes the starting question; it is a practice label, not a certification. Questions by Pratik Amin.