問73
頻出度★★★
電子商取引において, 取引当事者から独立している第三者機関である認証局が発行するものはどれか。
平成22年度 秋期 ITパスポート試験 問73
This question's explanation and your answers so far.
解説
問 73
- ア
正解 A certificate authority (CA) is an independent third-party organization belonging to neither side of a transaction, and its role is to guarantee that a given public key really belongs to the person who claims it. The CA first verifies the applicant's identity (checking that the applicant really exists), then bundles that user's “public key” together with owner information (name, organization name, expiry date, and so on), attaches its own digital signature, and issues a “digital certificate (public key certificate)”. The party who receives it verifies that signature with the CA's public key, and can thereby confirm that the public key at hand has not been swapped for a fake one — that is, that the other party is who they claim to be — which prevents impersonation. Therefore, what a certificate authority issues is “a digital certificate for a transacting party's public key”, and the correct answer is ア.
Incorrectイ
A digital signature is created by the signer themselves using their own private key; a CA, being a different party, does not create and hand out signatures on a transacting party's behalf. What the CA does is certify that the “other party's public key”, which is needed to verify that signature, is genuine — not issue the signature itself.
Incorrectウ
A password is secret information for identity verification that is set and managed between a user and each individual system (the service provider or the system administrator); it is not something issued by the CA, the third-party organization in a public key infrastructure (PKI). Moreover, a password must never become known to a third party, so the very scheme of an outside organization issuing it and putting it into circulation does not fit.
Incorrectエ
A private key is a key that must be kept strictly secret by its owner alone and must never be handed to anyone else. What is placed in a certificate and distributed widely is always the matching public key; a mechanism such as “a digital certificate for a private key” does not exist. This option mixes up the roles of the public key and the private key.
ここがポイント
- A certificate authority (CA) is a trusted third-party organization that guarantees who a public key belongs to, and what it issues is “a digital certificate for a public key (a public key certificate)”. The whole mechanism made up of the CA, certificates, and public keys is called a public key infrastructure (PKI).
- In public-key cryptography, a fundamental premise is the division of roles: the private key is held only by its owner and never made public, while the public key is distributed widely and used for encryption and signature verification. Keep in mind as well that a digital signature is created by the person themselves with their private key, not by the CA.
用語