問65
頻出度★★★
電子商取引におけるディジタル署名で実現できることはどれか。
平成22年度 春期 ITパスポート試験 問65
This question's explanation and your answers so far.
解説
問 65
Incorrectア
Preventing a third party from accessing confidential files is a function handled by setting access rights (access control) or by encrypting the file. A digital signature only attaches a signature to data; it does not make the data itself unreadable and does not forbid viewing, so it cannot prevent unauthorized access.
Incorrectイ
Checking whether a file is infected by a virus is the job of anti-virus software (malware scanning). All a digital signature can tell you is that “the content has not changed since the moment it was signed,” so if a virus had already been mixed into the file before it was signed, signature verification will still succeed normally. It is no guarantee that the file is safe.
Incorrectウ
Preventing the leakage of content through eavesdropping is a function of encryption (SSL/TLS and the like), which makes the communication content unreadable to third parties, and it is a measure concerning confidentiality. A digital signature can even be used while the original data is sent as plain text; it is not a mechanism for hiding content. Even with a signature attached, an eavesdropper can still read the transaction content.
- エ
正解 The correct answer is エ. A digital signature is an application of public-key cryptography: the sender creates signature data with a private key that only the sender holds, and the receiver verifies it with the matching public key. Successful verification means that the signing was done by the holder of the private key paired with that public key — that is, by the legitimate trading partner — so it can prove the identity of the transaction partner. At the same time, the signature is created from a hash value of the original data, so if even one character of the transaction content is rewritten in transit, the hash value changes and verification fails. In other words, it can also confirm that the content has not been tampered with (integrity). Achieving both “identity proof (authentication)” and “tamper detection (integrity)” at the same time is exactly the role of a digital signature, and in electronic commerce it is used to guarantee that orders and contracts are genuine. Furthermore, because only the person concerned holds the private key, that person cannot later evade responsibility by saying “I never placed that order,” so the effect of non-repudiation is obtained as well.
ここがポイント
- What a digital signature achieves is “authentication (proving that the transaction partner is who they claim to be)” and “integrity (confirming that nothing has been tampered with),” plus the non-repudiation that follows from them. Confidentiality (preventing others from peeking at the content) is not something it can achieve — drawing this line is the main point being tested.
- Keep in mind how the three elements of information security (confidentiality, integrity, availability) correspond to the technologies that address them: confidentiality → encryption and access control; integrity → digital signatures and hash values; virus countermeasures → anti-virus software. If you can sort the choices by function in this way, you can solve the question.
用語