Authentication and Cryptography Questions

Designing and implementing authentication systems and correct cryptographic usage, including username and password handling, multi factor authentication, single sign on, OAuth, Security Assertion Markup Language, Kerberos, certificate based authentication, and token based systems such as JSON web tokens. Candidates should understand secure password storage and hashing, salt and iteration strategies, secure session management, token generation and validation, key management practices in code, secure random number generation, certificate and key rotation, and integration with identity providers. The topic also covers common implementation vulnerabilities and pitfalls such as weak password policies, improper multi factor authentication implementation, insecure token storage or transport, hard coded secrets, incorrect use of cryptographic primitives, insufficient entropy, replay and session fixation attacks, and improper error handling. Evaluation includes choosing appropriate libraries, threat modeling authentication flows, implementing secure defaults, auditing and logging authentication events, testing strategies for authentication and cryptography, and mitigation techniques like rate limiting, account lockout, secure account recovery, and defensive coding patterns.