Notification of the bid-opening results is something the bidding implementation body, which has tallied the bids, tells the participating companies, so in the figure it corresponds to the final step (6), from the bidding implementation body to the bidding participant company. The certificate authority is not involved in the content of the bids or in who wins, so it does not match the counterpart of step (4), which is the certificate authority.
×Incorrectイ
Issuance of the digital certificate is the certificate authority's response to the application in step (1), so in the figure it corresponds to step (2), from the certificate authority to the bidding participant company. Step (4) is the arrow from the bidding implementation body to the certificate authority, and both the sender and the receiver are the reverse of the issuance scene, so it does not apply.
○ウ
正解Step (4) is the arrow in the figure that runs from the bidding implementation body to the certificate authority. Immediately before it, in step (3), the bidding participant company submits its electronic bid to the bidding implementation body, attaching the digital certificate it received from the certificate authority in steps (1) and (2). From the standpoint of the bidding implementation body that receives the bid, it cannot judge on its own whether that certificate is really genuine, that is, whether it is still within its validity period and whether it has been revoked in the meantime. The party that issues certificates and also manages revocation information is the certificate authority (CA), so the body asks the issuing certificate authority and confirms with it. This is the “confirmation of the validity of the digital certificate” in step (4), and the reply to it corresponds to the arrow in step (5), from the certificate authority to the bidding implementation body. Therefore the correct answer is ウ.
×Incorrectエ
Conducting the electronic bidding is the act in which the participating company submits its bid document with the certificate attached, so in the figure it corresponds to step (3), from the bidding participant company to the bidding implementation body. The bidding implementation body never places the bid itself with the certificate authority, so this does not apply to step (4).
ここがポイント
The role of a certificate authority (CA) is not only to issue digital certificates but also to manage revocation and to respond to validity-confirmation (verification) inquiries from the party that received a certificate. A verifier who has received a certificate queries the issuing certificate authority about its validity.
In a figure of a procedure that uses a public key infrastructure (PKI), identify each step by the direction of the arrow, that is, by who sends to whom. Application and issuance take place between the company and the certificate authority, bidding and the bid-opening results between the company and the bidding implementation body, and validity confirmation and its reply between the bidding implementation body and the certificate authority; the steps can be told apart by which pair of parties is involved.