Google Cryptographer (Entry Level) Interview Preparation Guide

Cryptographer

Google

entry

6 rounds

Updated 6/18/2026

Google's entry-level Cryptographer interview process typically includes an initial recruiter screening, technical phone screens focused on cryptographic fundamentals and algorithm design, and onsite rounds covering cryptography implementation, system design of cryptographic systems, and behavioral assessment. The process emphasizes mathematical understanding, coding ability, practical cryptographic knowledge, and problem-solving skills.

Interview Rounds

Recruiter Screening

30 min3 focus topicsculture fit

Technical Phone Screen - Cryptographic Algorithms and Coding

60 min5 focus topicstechnical

What to Expect

Technical screening focused on fundamental cryptographic knowledge, algorithm understanding, and coding ability. Interviewer will ask about symmetric encryption, asymmetric encryption, hashing, and may present a coding problem involving cryptographic concepts. Expect questions about how algorithms work, why specific choices are made, and basic implementation of cryptographic primitives.

Tips & Advice

Review symmetric encryption (AES, modes of operation), asymmetric encryption (RSA, ECC), and cryptographic hashing thoroughly. Be able to explain how these algorithms work at a high level and why they're used. Code the solution step-by-step and explain your reasoning. If asked about security properties, discuss confidentiality, integrity, and authenticity clearly. Be comfortable discussing key sizes, algorithm deprecation (MD5, SHA-1), and modern standards. For entry-level, focus on understanding rather than advanced optimizations.

Focus Topics

Algorithm Security Analysis

Ability to discuss why certain algorithms are deprecated, what attacks they're vulnerable to, and current recommended standards. Understanding of post-quantum cryptography basics.

Practice Interview

Study Questions

Coding Problem - Cryptographic Implementation

Ability to code a cryptographic algorithm or solve a problem involving cryptographic concepts. May include implementing a simple cipher, working with random number generation, or analyzing code for vulnerabilities.

Practice Interview

Study Questions

Symmetric Encryption Fundamentals

Understanding of AES, DES, modes of operation (CBC, GCM, ECB), and when to use each. Ability to explain key concepts like block size, key length, and initialization vectors.

Practice Interview

Study Questions

Cryptographic Hashing and Message Authentication

Understanding SHA-256, collision resistance, how hashing differs from encryption, HMACs, and digital signatures. Knowledge of deprecated algorithms (MD5, SHA-1).

Practice Interview

Study Questions

Asymmetric Encryption and Key Exchange

Understanding of RSA, ECC, Diffie-Hellman key exchange, and when to use asymmetric vs. symmetric encryption. Knowledge of key sizes and security parameters.

Practice Interview

Study Questions

Onsite Round 1 - Cryptographic Fundamentals Deep Dive

50 min5 focus topicstechnical

What to Expect

Deep technical interview on cryptographic theory and mathematical foundations. Interviewer will explore your understanding of core cryptographic concepts including number theory basics, probability theory in cryptography, entropy, and random number generation. Expect conceptual questions rather than pure coding. This round assesses whether you have the mathematical foundation needed for algorithm design.

Tips & Advice

Review mathematical foundations: modular arithmetic, prime numbers, discrete logarithm problem, and factorization hardness. Understand entropy and randomness concepts. Be able to discuss why certain mathematical properties matter for security. For entropy discussion, reference tools like WebCrypto API and entropy sources. Discuss hardware security modules and key management at a basic level. Don't worry about proving theorems, but explain concepts clearly. Show understanding of why randomness quality matters in key generation.

Focus Topics

Side-Channel Attack Awareness

Introduction to timing attacks, power analysis, and other side-channel vulnerabilities. Understanding that secure algorithms can be broken through implementation details.

Practice Interview

Study Questions

Cryptographic Modes of Operation and Authenticated Encryption

Deep understanding of block cipher modes (CBC, CTR, GCM), why authenticated encryption matters, and how to choose appropriate modes for different scenarios.

Practice Interview

Study Questions

Key Generation and Management Basics

Understanding of key generation procedures, appropriate key lengths for different algorithms, key storage basics, and why secure key management is essential. Introduction to HSM concepts.

Practice Interview

Study Questions

Randomness, Entropy, and Random Number Generation

Understanding of cryptographically secure random number generation, entropy sources, entropy quality, and why weak randomness breaks cryptographic security. Knowledge of CSPRNG vs. PRNGs.

Practice Interview

Study Questions

Mathematical Foundations for Cryptography

Understanding of modular arithmetic, prime number generation, discrete logarithm problem, RSA problem, and why these mathematical properties are security-critical.

Practice Interview

Study Questions

Onsite Round 2 - Algorithm Implementation and Protocol Design

60 min5 focus topicstechnical

What to Expect

Practical technical round focused on implementing cryptographic algorithms and designing simple protocols. You may be asked to implement a cryptographic algorithm from scratch, design a simple secure communication protocol, or solve a problem requiring both algorithm knowledge and implementation skills. This round tests your ability to translate cryptographic theory into working code.

Tips & Advice

Practice implementing cryptographic primitives from scratch (even if libraries exist). Be able to write AES, basic RSA, or hash function implementations. Understand protocol design principles: what needs to be encrypted, authenticated, and why. When designing protocols, discuss threat models explicitly. Explain security properties your protocol provides. Ask clarifying questions about requirements. For entry-level, focus on correctness and security reasoning rather than optimization. Use cryptographic libraries correctly when allowed. Explain your implementation choices.

Focus Topics

Code Review and Vulnerability Detection

Ability to review cryptographic code, identify common vulnerabilities, and suggest improvements. Understanding OWASP principles relevant to cryptography.

Practice Interview

Study Questions

Threat Modeling and Attack Scenarios

Ability to identify what threats a cryptographic system must protect against, design protocols to mitigate specific threats, and analyze potential attack vectors.

Practice Interview

Study Questions

Cryptographic Best Practices in Implementation

Knowledge of secure coding patterns: constant-time operations, memory zeroing, avoiding padding oracle vulnerabilities, and other implementation pitfalls. Understanding when to use libraries vs. custom code.

Practice Interview

Study Questions

Cryptographic Algorithm Implementation

Ability to implement cryptographic algorithms or major components from scratch. Understanding of implementation details that affect security. Writing secure cryptographic code.

Practice Interview

Study Questions

Secure Protocol Design

Designing communication protocols that properly use cryptographic primitives. Understanding threat models, authentication requirements, and how to achieve confidentiality and integrity.

Practice Interview

Study Questions

Onsite Round 3 - Cryptographic Systems Design and Research Awareness

50 min5 focus topicstechnical

What to Expect

Systems-level thinking for cryptography. This round may involve designing a cryptographic system for a real-world scenario (e.g., secure data storage, communication between services), discussing how to integrate cryptography into larger systems, or exploring emerging cryptographic research areas. Interviewer assesses systems thinking, awareness of practical constraints, and knowledge of current cryptographic research directions.

Tips & Advice

For system design: discuss algorithms chosen, key management approach, how failures are handled, and tradeoffs. For a data protection scenario, explain encryption at rest vs. in transit, key rotation, and compliance considerations. Research post-quantum cryptography (lattice-based schemes, NIST standardization process). Be aware of quantum computing threats. Discuss NIST recommendations. Show awareness of recent cryptographic research without claiming expertise. Discuss why cryptography is only one layer of security. For entry-level, demonstrating awareness and learning ability matters more than deep research knowledge.

Focus Topics

Cryptography in Modern Systems

Understanding how cryptography is used in cloud systems, APIs, mobile applications, and distributed systems. Understanding TLS, encryption at rest, and integration challenges.

Practice Interview

Study Questions

Compliance and Standards (NIST, FIPS, etc.)

Understanding regulatory requirements, NIST guidelines for cryptographic algorithms, FIPS standards, and how compliance affects cryptographic choices.

Practice Interview

Study Questions

Post-Quantum Cryptography and Emerging Standards

Understanding quantum computing threats to current cryptography, awareness of post-quantum cryptography candidates (lattice-based like CRYSTALS-Kyber), and NIST standardization process.

Practice Interview

Study Questions

Key Management at Scale

Understanding key lifecycle management, rotation strategies, hierarchical key structures, hardware security modules, and multi-party authorization. Basics of key wrapping and split knowledge.

Practice Interview

Study Questions

Cryptographic System Architecture Design

Designing systems using cryptography: choosing algorithms, key management architecture, integration with applications, handling of failures, and operational considerations.

Practice Interview

Study Questions

Onsite Round 4 - Behavioral and Culture Fit

40 min5 focus topicsbehavioral

What to Expect

Behavioral interview assessing communication skills, teamwork, learning ability, handling of challenges, and cultural alignment with Google. Interviewer will ask about past experiences, how you handle failure, collaboration style, and approach to learning. This round evaluates whether you'll be successful working in Google's environment and whether you can grow in the role.

Tips & Advice

Use STAR method for behavioral questions (Situation, Task, Action, Result). Focus on examples showing learning ability, which is crucial for entry-level hires. Discuss a technical challenge you overcame, showing problem-solving approach. Talk about collaboration with teammates. Be honest about mistakes and what you learned. Show curiosity about cryptography and security. Ask insightful questions about team culture, learning opportunities, and how the team stays current with research. Emphasize your eagerness to learn and grow. For entry-level, demonstrating potential and the right attitude matters more than perfect execution.

Focus Topics

Passion for Cryptography and Security

Genuine interest in cryptography, security, mathematics. Examples of personal projects, research, or study beyond required coursework. Specific interests in the field.

Practice Interview

Study Questions

Handling Failure and Challenges

Honest discussion of a technical failure, mistake, or challenge you faced. What you learned, how you recovered, and how it changed your approach going forward.

Practice Interview

Study Questions

Teamwork and Collaboration

Examples of working effectively in teams, receiving and giving feedback, contributing to group goals, and supporting colleagues. Show ability to communicate technical concepts to others.

Practice Interview

Study Questions

Technical Problem-Solving Approach

Describe how you approach technical problems: research, experimentation, asking for help when needed, and learning from solutions. Share examples of challenging technical problems you've solved.

Practice Interview

Study Questions

Learning Ability and Growth Mindset

Demonstrate eagerness to learn, ability to acquire new skills, and examples of how you've grown technically. Show awareness of your current knowledge gaps and plans to fill them.

Practice Interview

Study Questions

Frequently Asked Cryptographer Interview Questions

Side Channel Security and Constant TimeHardSystem Design

70 practiced

Compare choosing constant-time software implementations versus masked implementations when designing a hardware accelerator such as an FPGA or ASIC. Discuss trade-offs in area, timing, power consumption, side-channel leakage profile, randomness requirements, verification complexity, and when you would prefer one approach over the other.

Sample Answer

**Clarify scope & goal**

When designing an FPGA/ASIC crypto accelerator, “constant-time” here means algorithmic timing-independence (no data-dependent control flow or memory access). “Masked” means algorithmic masking (secret shares + non-linear masked ops) to protect against physical side-channels (power/EM).

**High-level trade-offs**

- Area - Constant-time: minimal extra registers/logic beyond normal datapath. - Masked: significantly larger — additional share registers, combinational logic for masked S-boxes, refresh units, and RNG interfaces; usually 2–d or more shares → ~d× area blowup plus masking correction circuits.

- Timing / Frequency - Constant-time: simpler critical path; easier to meet high frequency. - Masked: extra gates and secure combination logic increase path length; non-linear masked gadgets often need re-ordering or pipelining, complicating timing closure.

- Power - Constant-time: lower static energy; but still data-dependent instantaneous power can leak. - Masked: higher average power due to extra operations and randomness; instantaneous power profile is smoothed but not eliminated — higher power budget required.

- Side-channel leakage profile - Constant-time: eliminates timing leakage but remains vulnerable to first/second-order power/EM unless combinational balancing or dual-rail logic used. - Masked: reduces first-order leakage if implemented correctly; needs higher-order masking for sophisticated attackers; still vulnerable to glitches, coupling, and implementation mistakes.

- Randomness requirements - Constant-time: none for timing protection. - Masked: high-quality, high-throughput TRNG/PRNG required; entropy consumption scales with masking order and refresh frequency — RNG becomes critical subsystem.

- Verification & Complexity - Constant-time: easier formal timing/verilog-level checks for control-flow and memory access patterns; functional verification straightforward. - Masked: much harder — requires formal proof of masking order, glitch analysis, hardware-specific leakage analysis, and often side-channel testing (NICV, t-test, higher-order CPA). Tool support is immature.

**When to prefer each**

- Prefer constant-time (possibly with logic-level balancing) when: - Area/power/timing budgets are tight. - Threat model focuses on software timing attacks or simple physical attackers. - Fast time-to-market or limited RNG/verification resources.

- Prefer masking when: - Physical side-channel attackers are realistic (lab-equipped, SPA/DPA-capable). - High-assurance products (smartcards, HSMs) where leakage must be reduced despite area/power. - You can afford RNG throughput, verification effort, and careful layout to mitigate glitches/coupling.

**Practical recommendations**

- Combine strategies: constant-time control + first-order masking for S-boxes, plus placement-aware layout, clock gating carefully, and dedicated TRNG. Use formal tools for timing and specialized leakage verification (higher-order tests). Document threat model and validation metrics (t-test, NICV, CPA resistance) before committing to masked designs.

Symmetric Cryptography FundamentalsEasyTechnical

40 practiced

Define and contrast the terms 'nonce' and 'initialization vector (IV)' in the context of symmetric encryption. For the modes CBC, CTR and GCM, state the necessary properties for IV/nonce (randomness vs uniqueness), practical generation strategies (random generation, counters, deterministic per-message IVs), and the consequences of reuse for each mode.

Secure Cryptographic ImplementationEasyTechnical

47 practiced

Explain how error messages and exception handling in cryptographic flows can leak sensitive information (for example, enabling padding oracles or revealing distinct error types). Provide practical error-handling and logging strategies that avoid leaking secrets while preserving enough diagnostic information for developers and operators.

Secure Protocol Design and ImplementationMediumTechnical

68 practiced

Compare certificate pinning, DANE (DNSSEC authenticated TLSA records), and traditional PKI for server authentication in a mobile app. Discuss deployment complexity, key rotation and recovery from compromise, trust anchor management, and compatibility across client ecosystems.

Sample Answer

**Overview**Certificate pinning, DANE (DNSSEC+TLSA), and traditional PKI are three approaches to authenticate servers to mobile apps. Each trades deployment complexity, key-rotation/compromise recovery, trust-anchor control, and client compatibility differently.

**Deployment complexity**- PKI: Low for developers (use CA-issued certs); higher operational effort to manage CA integrations and certificate lifecycle. Relies on global CA ecosystem.- Pinning: Simple to implement client-side (embed hash or public key), but operational burden rises with updates and rollout strategies.- DANE: High: requires DNSSEC deployment, TLSA management, and reliable DNS infrastructure (CDNs often complicate).

**Key rotation & compromise recovery**- PKI: CAs can revoke via CRL/OCSP but mobile apps often cache or lack timely checks; recovery depends on CA processes.- Pinning: Fast detection of unexpected keys but brittle: compromised pinned key requires app update or backup pin / trust-on-first-use strategy; recovery is cumbersome if pins are immutable.- DANE: Enables DNS-controlled rotation; if DNSSEC keys protected (e.g., HSM, KSK/ ZSK separation), rotation is smoother and revocation can be effected by updating TLSA. However compromise of DNSSEC KSK is catastrophic unless multi-signer/BGPsec mitigations exist.

**Trust-anchor management**- PKI: Trust anchor = many root CAs baked into OS; poor selective control and larger attack surface.- Pinning: App-level trust anchor gives strong control (per-app), minimal external surface.- DANE: Trust anchor is DNSSEC chain to a registry (e.g., ICANN/parent zone). Offers delegation of trust to DNS operator; requires careful KSK handling.

**Compatibility across client ecosystems**- PKI: Best compatibility (mobile OSes, browsers) — industry-standard.- Pinning: Universal in principle but must be implemented per-app and per-platform; updates via app store delays.- DANE: Limited mobile support; few TLS libraries on mobile validate TLSA; DNSSEC resolution via recursive resolver must be trusted (stub resolvers usually do not validate).

**Practical recommendation (cryptographer view)**- For high-assurance mobile apps: prefer PKI for compatibility + augment with pinning of backup key(s) or use short-lived certs with automated issuance (ACME) and robust OCSP stapling. If you control DNS and can deploy DNSSEC correctly, DANE offers canonical owner-controlled authentication but only as a complement due to limited client validation.

**Example**- Hybrid: use CA-issued certs (compatibility) with app-enforced pin of CA-subject-public-key or allowlist of short-lived cert fingerprints plus automated rotation via ACME to reduce recovery friction.

Cryptographic Key Management and InfrastructureEasyTechnical

32 practiced

Describe the core components and trust model of an enterprise Public Key Infrastructure (PKI). Explain the roles of root CA, intermediate CAs, issuing CAs, certificate profiles and validity periods, and strategies to limit blast radius if a CA is compromised (e.g., offline root, short-lived certs, cross-certification).

Sample Answer

**Overview & trust model**

An enterprise PKI is a hierarchical trust model anchored by a single (or few) trust roots. Trust flows from the root CA → intermediate CAs → issuing (leaf) CAs → end-entity certificates. Clients validate chains up to a trusted root and apply policy constraints.

**Core components**

- Root CA: ultimate trust anchor; signs intermediate CA certs; highest privileges. Typically kept offline and protected in an HSM; subject to strict key ceremony and multi-person controls.- Intermediate CAs: delegated trust boundaries; can encode policy (e.g., product, environment, region). They reduce risk by isolating issuance domains.- Issuing CAs: perform day-to-day certificate minting for servers, devices, users; often online and automated.- Certificate profiles & validity: specify key usages, extended key usages, SANs, algorithm/key size, pathLen, CA:TRUE/FALSE, and lifetimes. Profiles enforce crypto policy (e.g., RSA-4096 or ECDSA P-384, signature algorithms).- Revocation/OCSP/CRL: real-time or batched revocation checking and stapling to ensure compromised certs are rejected.- HSMs, audit logs, and automation (ACME/private PKI APIs) for secure operations and traceability.

**Limiting blast radius (compromise strategies)**

- Offline root + short-lived intermediates: keep root offline; sign short-lived intermediate certs or use offline signing to limit exposure window.- Short-lived end-entity certs: issue certificates with brief validity (hours–days) and rely on automated renewal; reduces impact of stolen keys.- Path separation and minimal privileges: use multiple intermediates per domain, strict certificate profiles, and pathLen constraints to prevent cross-use.- Hardware protection & split control: HSMs, multi-person control, key ceremony, and compartmentalized ops reduce insider risk.- Cross-certification & certificate pinning: selective cross-signing for migration; pinning for critical clients to avoid reliance on broader trust stores.- Rapid revocation + OCSP stapling: combine short lifetimes with aggressive revocation and stapling to reduce window if compromise occurs.

As a cryptographer I emphasize secure key management, crypto-agility (supporting rotations and algorithms), and precise profile enforcement to make compromise containment provable and auditable.

Key Management and Key DerivationMediumTechnical

48 practiced

Compare Argon2i, Argon2d, and Argon2id. For each variant specify whether it is data-dependent or data-independent in memory access, its suitability vs side-channel attacks, and recommended uses (e.g., password hashing vs key derivation vs keyed use). Why is Argon2id often recommended for general password hashing?

Side Channel Security and Constant TimeMediumTechnical

69 practiced

Describe how first-order Boolean masking can be applied to protect an AES S-box computation in software. Walk through masking the input, computing the masked non-linear operation, and recombining outputs. Identify remaining sources of leakage and how you would test whether the masking is implemented correctly.

Sample Answer

**Situation — brief overview**First-order Boolean masking protects single-bit (or byte) secrets by splitting a sensitive value x into x = x0 ⊕ x1 with x1 random. The S-box nonlinearity must be evaluated without combining shares.

**Masking the input**- Generate random mask m (byte).- Produce shares: x0 = x ⊕ m, x1 = m.- Feed x0 and x1 into the masked S-box routine.

**Computing the masked non-linear operation**- For AES S-box (x → S(x) = A · Inv(x) ⊕ b) two common software approaches: - Masked lookup table: precompute two tables T0, T1 such that T0[x0] ⊕ T1[x1] = S(x0 ⊕ x1). Careful: naive table splitting leaks; must add fresh randomness or use threshold implementation. - Algebraic masked inversion: compute inversion in GF(2^8) using masked field operations (masked multiplication, squaring) with first-order secure routines (use secure masked AND/AND-not primitives and refresh masks after nonlinear steps).- Always avoid operations that combine shares without protection; intermediate nonlinear steps require secure share-to-share multiplications with fresh randomness.

Example pseudocode (input masking + recombine):

// mask generation
uint8_t m = random_byte();
uint8_t x0 = x ^ m;
uint8_t x1 = m;
// masked S-box call: produces y0,y1 such that y0 ^ y1 == S(x)
masked_sbox(x0, x1, &y0, &y1);
// recombine
uint8_t y = y0 ^ y1;

**Recombining outputs**- Final result y = y0 ⊕ y1. Before recombination ensure all temporary variables holding both shares are cleared; zeroize masks and RNG state when done.

**Remaining sources of leakage**- CPU register reuse and microarchitectural leakage (speculative execution, cache).- Glitches on hardware; in software, instruction-level leaks when both shares inhabit same register or memory bus.- RNG weaknesses and reuse of masks.- Non-constant-time branches, table lookups causing cache-timing leaks.- Higher-order leakage due to unprotected multiplications or mask refresh omission.

**How to test correctness of masking**- Statistical tests: fixed vs random t-test (univariate), Welch’s t-test for first-order leakage; choose multiple points and traces.- Correlation Power Analysis (CPA) targeted at first-order combination hypotheses (e.g., test correlation with a single share).- Higher-order leakage tests: perform second-order tests (combine samples multiplicatively).- Test vectors: use fixed plaintexts/wide random masks; collect many traces (thousands); perform horizontal analysis if single-trace leakage expected.- Implementation checks: ensure masks are random per invocation; review assembly to confirm no accidental share merges; use tools (ChipWhisperer, Riscure Inspector) and mutual information analysis for deeper detection.

**Takeaway**First-order masking requires secure masked nonlinear primitives, strict management of masks and registers, and thorough statistical leakage testing (first- and second-order) to validate that no exploitable leakage remains.

Symmetric Cryptography FundamentalsHardTechnical

34 practiced

Problem-solving: Design a static and dynamic analysis framework to detect common symmetric-crypto misuse across a large codebase: hard-coded keys, ECB usage, fixed or predictable IVs, calls to insecure RNGs (e.g., rand()), incorrect use of cryptographic APIs (e.g., ignoring returned tags), and missing authentication. Describe heuristics to reduce false positives, instrumentation points for dynamic checks, and how to prioritize developer remediation.

Sample Answer

**Situation & goal** Design a combined static+dynamic framework to find symmetric-crypto misuse at scale: hard-coded keys, ECB, weak/predictable IVs, insecure RNGs, API misuse (ignored tags), and missing authentication.

**High-level approach** - Static first-pass to flag candidates cheaply; dynamic to confirm and reduce false positives and measure runtime exploitation risk.

**Static heuristics (reduce false positives)** - Hard-coded keys: detect literals or constant-derived keys used in key-derivation/cipher-init sites; require entropy test (Shannon entropy) and length checks; suppress if value loaded from secure keystore APIs. - ECB: flag calls to BlockCipher/init modes named "ECB" and patterns of repeated block ciphertext (look for repeated 16-byte-aligned constants in resources). - IV issues: flag constant or zero IV literals; if IV derived from timestamp/counter, rate-limit alerts (lower priority). - RNG: flag use of rand(), srand(), Math.random(); suppress if wrapped by approved CSPRNG adapters. - API misuse: detect calls that ignore AEAD tag return/verify functions, or use EncryptWithoutTag APIs. Cross-check with call graph to ensure authentication steps exist.

**Dynamic instrumentation points** - Hook cipher init/encrypt/decrypt, RNG seeds/outputs, key-loading, and AEAD verify calls. - Capture runtime key/IV values (mem-hash, not plaintext persist), entropy metrics, order/timestamps, and whether tags are verified. - Inject fault tests: replay with modified ciphertext/tag to confirm verification is performed. - Sample execution across inputs/threads to detect IV reuse and nonce collisions.

**Confirmation & scoring** - Combine static confidence, dynamic replication (same key/IV observed), exploitability (able to bypass auth in fault test), and data-sensitivity context (PII, secrets). Compute risk score and suggested remediation severity.

**Prioritization for remediation** 1. Failing AEAD verification / missing authentication (Critical) 2. Hard-coded keys in production code, especially long-lived (High) 3. Predictable/zero IVs or nonce reuse for AEAD (High) 4. Use of insecure RNGs when deriving keys/nonces (Medium) 5. ECB usage (Medium) 6. Low-entropy literals not used in secret context (Low)

**Developer guidance & fixes** - Provide concrete patches: replace rand() with CSPRNG, use AES-GCM/EAX with proper tag checks, use KDFs (HKDF/Argon2) with salt from secure RNG, rotate keys and move secrets to KMS/secure enclave, and use authenticated modes instead of ECB. Include unit/integration tests and small repro cases.

**Trade-offs & limitations** - Static may overflag library wrappers; dynamic adds runtime overhead and needs representative inputs. Prioritize high-risk paths and adopt incremental rollout with CI gating.

Secure Cryptographic ImplementationEasyTechnical

44 practiced

Describe authenticated encryption (AEAD). Explain why AEAD modes (for example AES-GCM and ChaCha20-Poly1305) are preferred over ad-hoc composition of encryption and MAC. Compare encrypt-then-MAC, MAC-then-encrypt, and encrypt-and-MAC and give real-world pitfalls that occur when using AES-CBC + HMAC incorrectly in application code.

Secure Protocol Design and ImplementationEasyTechnical

57 practiced

Define forward secrecy and post-compromise security. Give concrete examples of protocol mechanisms that provide forward secrecy and explain what extra mechanisms are required to achieve post-compromise recovery in asynchronous messaging systems.

Sample Answer

**Definition — forward secrecy (FS)** Forward secrecy means compromise of long-term keys does not expose past session keys or past plaintexts. Concretely: ephemeral Diffie–Hellman (e.g., ECDHE in TLS) produces per-session shared secrets that are deleted after use, so an attacker who later obtains the server’s long-term key cannot decrypt recorded sessions.

**Definition — post‑compromise security (PCS)** PCS means that after an adversary compromises a party (and obtains current state), the protocol autonomously recovers confidentiality for future messages without manual key replacement. In other words, compromise impact is limited in time and the system heals.

**Mechanisms that give FS (examples)** - Ephemeral Diffie–Hellman (ECDHE) in TLS — ephemeral keypairs per session. - X3DH key agreement — combines ephemeral DHs (including one‑time prekeys) to bootstrap a shared secret asynchronously. - Double Ratchet (Signal) — combines DH ratchet (ephemeral DH exchanges) and symmetric-key hash ratchet to produce ephemeral message keys and discard old keys.

**What extra is required for PCS in asynchronous messaging** - Regular, unidirectional key updates that an uncompromised party can initiate without synchronous interaction (e.g., prekey bundles / one‑time prekeys so the other side can perform a fresh DH later). - A DH ratchet that advances state whenever parties exchange fresh DH public keys so compromise state cannot be replayed; this requires frequent DH exchanges or one‑time prekeys to support asynchronous peers. - Secure key derivation and forward-only key deletion (KDF chains, SKIP lists for out‑of‑order messages). - Mechanisms to replace long‑term/identity keys if needed: signed prekeys tied to identity + easy rotation and server distribution. - Optional: server-assisted rekey or "account recovery" flows that minimize trust (audit/logging, key transparency) to prevent undetected rekey attacks.

Signal’s design (X3DH bootstrapping + Double Ratchet + one‑time prekeys) is the canonical example: it provides FS and — because parties can later perform new DHs via prekeys even when offline — it enables PCS recovery without manual key exchange.

Practice Cryptographer questions across all topics

Want to create your own tailored preparation guide using our deep research?

Get Started for Free

Interview-Ready Courses

Visual-first, interactive, structured learning paths

Browse Cryptographer jobs

AI-enriched listings across hundreds of company career pages

Explore Jobs

Google Cryptographer (Entry Level) Interview Preparation Guide

Interview Process Overview

Interview Rounds

Recruiter Screening

What to Expect

Tips & Advice

Focus Topics

Communication and Clarity

Practice Interview

Study Questions

Career Motivation and Fit

Practice Interview

Study Questions

Background and Relevant Experience

Practice Interview

Study Questions

Technical Phone Screen - Cryptographic Algorithms and Coding

What to Expect

Tips & Advice

Focus Topics

Algorithm Security Analysis

Practice Interview

Study Questions

Coding Problem - Cryptographic Implementation

Practice Interview

Study Questions

Symmetric Encryption Fundamentals

Practice Interview

Study Questions

Cryptographic Hashing and Message Authentication

Practice Interview

Study Questions

Asymmetric Encryption and Key Exchange

Practice Interview

Study Questions

Onsite Round 1 - Cryptographic Fundamentals Deep Dive

What to Expect

Tips & Advice

Focus Topics

Side-Channel Attack Awareness

Practice Interview

Study Questions

Cryptographic Modes of Operation and Authenticated Encryption

Practice Interview

Study Questions

Key Generation and Management Basics

Practice Interview

Study Questions

Randomness, Entropy, and Random Number Generation

Practice Interview

Study Questions

Mathematical Foundations for Cryptography

Practice Interview

Study Questions

Onsite Round 2 - Algorithm Implementation and Protocol Design

What to Expect

Tips & Advice

Focus Topics

Code Review and Vulnerability Detection

Practice Interview

Study Questions

Threat Modeling and Attack Scenarios

Practice Interview

Study Questions

Cryptographic Best Practices in Implementation

Practice Interview

Study Questions

Cryptographic Algorithm Implementation

Practice Interview

Study Questions

Secure Protocol Design

Practice Interview

Study Questions

Onsite Round 3 - Cryptographic Systems Design and Research Awareness

What to Expect

Tips & Advice

Focus Topics

Cryptography in Modern Systems

Practice Interview

Study Questions