問55
頻出度★★★
データ通信における暗号化技術に関する記述のうち, 適切なものはどれか。
平成22年度 秋期 ITパスポート試験 問55
This question's explanation and your answers so far.
解説
問 55
Incorrectア
It is symmetric-key cryptography that requires devising a way to deliver the key securely, so this is wrong as a description of public-key cryptography. What is used to encrypt data with public-key cryptography is the receiver's “public key”, which, as its name says, may be known to anyone and can be openly distributed on a website or in a certificate. The private key used for decryption is held by the receiver from the start, so it never has to be handed over to the other party. On the contrary, public-key cryptography was devised precisely in order to solve the key-distribution problem that symmetric-key cryptography has.
Incorrectイ
What encryption achieves is only confidentiality (the content cannot be read even if it is eavesdropped on); it does not guarantee integrity (preventing or detecting destruction and tampering). Even with ciphertext, it is technically possible to rewrite its bits or delete it in transit, and encryption itself has no mechanism to stop that. To confirm that data has not been tampered with, separate technologies are needed, such as a message digest produced by a hash function, a message authentication code (MAC), or a digital signature. The trap here is the idea that “encryption protects everything”.
- ウ
正解 The correct answer is ウ. A digital signature is a technology that applies, just as it is, the property of the “pair of two keys” in public-key cryptography. The sender creates a signature (encrypting a message digest) with the private key that only the sender holds, and the receiver verifies it with the sender's public key, which anyone can obtain. Because only the person holding the private key can create that signature, while anyone holding the public key can verify it, two things hold at the same time: identity confirmation (authentication and non-repudiation) that the message really was sent by that sender, and tampering detection that it was not rewritten along the way. In electronic commerce, this mechanism is combined with a digital certificate issued by a certificate authority (CA), so that even the fact that the holder of the public key is the person they claim to be is guaranteed. Note also that ordinary encryption (ensuring confidentiality) encrypts with the receiver's public key and decrypts with the receiver's private key, whereas a digital signature uses the keys the other way around, which is its distinguishing feature.
Incorrectエ
It is the other way around: for data communication with an unspecified large number of parties, public-key cryptography is more suitable. Symmetric-key cryptography needs a separate key for each communication partner, and that key must be shared in advance over a secure channel, so if n parties communicate with one another, n(n-1)/2 keys are required, which cannot realistically be operated for an unspecified large number of parties whose identities are unknown. With public-key cryptography, you only publish one public key of your own, and you can then receive encrypted communication even from parties you have never met. Symmetric-key cryptography is suited to situations where the partners are limited and a large volume of data must be processed at high speed.
ここがポイント
- A digital signature is an application of public-key cryptography. The keys are used the other way around from ordinary encryption: the signature is created with the sender's private key and verified with the sender's public key. This makes identity confirmation (authentication and non-repudiation) and tampering detection possible.
- Encryption protects only confidentiality; it cannot protect integrity (tampering detection). Tampering detection requires a hash value or a digital signature — this separation of what each technology can protect is the core of this question.
- The key-distribution problem is a weakness of symmetric-key cryptography and a strength of public-key cryptography. Use public-key cryptography when the partners are an unspecified large number, and symmetric-key cryptography when the partners are limited and high-speed processing is required.
用語