問86
頻出度★★★
ディジタル署名に関する記述のうち, 適切なものはどれか。
平成21年度 春期 ITパスポート試験 問86
This question's explanation and your answers so far.
解説
問 86
Incorrectア
A public key is, as its name says, a key that is made open to anyone so that they can use it for verification. The receiver needs the sender’s public key in order to verify a signature, so if the public key were kept secret, nobody could check the signature and the digital signature would not work at all. What must be kept secret is not the public key but the private key, so this statement has the two reversed.
- イ
正解 The correct answer is イ. With a digital signature, the sender does not encrypt the document itself. Instead, the sender runs the document through a hash function to obtain a short summary value (a hash value), encrypts that hash value with their own private key, and attaches it to the document as a signature. The receiver decrypts the signature with the sender’s public key to recover the hash value, at the same time recomputes a hash value from the document that was received, and compares the two. Because a hash value becomes a completely different value if even one character of the original data changes, the two hash values will not match if the document was rewritten along the way, so tampering can be detected. Furthermore, only the person who holds the matching private key can create that signature, so it also guarantees at the same time that the sender really is who they claim to be (authenticity) and that they cannot later deny having sent it (non-repudiation). Therefore, “It can detect tampering of data” correctly describes the effect of a digital signature.
Incorrectウ
Preventing eavesdropping (keeping a third party from reading the contents of a communication, that is, ensuring confidentiality) is a function achieved by encrypting the document itself, and it is not the job of a digital signature. Even when a signature is attached, the document itself is still sent as plaintext, so it cannot prevent the contents from being read on the communication path. What a signature guarantees is not that the data cannot be read, but that it has not been rewritten and that it really was sent by that person.
Incorrectエ
A private key is a key that only its owner keeps under strict control, and regardless of whether it is compressed, it must never be handed to anyone else or sent over a communication line. If a private key falls into someone else’s hands, that person can impersonate the owner and create signatures, and the signature loses all meaning. The only key given to the other party is the public key used for verification, so the very statement of transmitting a private key contradicts the premise of public-key cryptography.
ここがポイント
- What a digital signature guarantees is two things: that the data has not been tampered with (integrity), and that it really was sent by that person (authenticity and non-repudiation). Confidentiality, which prevents eavesdropping, is the job of encryption and cannot be achieved by a signature; this division of roles is the most frequently tested point.
- Do not reverse the roles of the two keys. A signature is created with the sender’s private key (only that person can create it), and it is verified with the sender’s public key (anyone can check it). Never hand over the private key and distribute the public key widely — that is the principle of public-key cryptography.
用語