問71
頻出度★★★
SSL に関する記述のうち, 適切なものはどれか。
平成23年度 秋期 ITパスポート試験 問71
This question's explanation and your answers so far.
解説
問 71
Incorrectア
The Privacy Mark is a third-party certification scheme granted to businesses that have a personal information protection system conforming to JIS Q 15001, and it is an entirely separate framework from SSL. What an SSL server certificate guarantees is the identity of the server — that it really belongs to the organization named in the certificate — which has nothing to do with whether that business has obtained the Privacy Mark. There are plenty of sites that support SSL communication whose operators have not obtained the Privacy Mark, so this statement does not hold.
Incorrectイ
The purpose it states, preventing server spoofing, is correct, but the way it says this is achieved is wrong. A certification authority (CA) only examines the server operator in advance and issues a digital certificate; it plays no part at all in the actual communication. The communication is carried out directly between the client and the server: at the start the server presents its certificate, and the browser verifies it with the CA public key that is built into the browser in advance, thereby confirming that the server is genuine. If a CA had to relay every single communication, all the communication in the world would converge on the CA, which would not be workable in practice either.
- ウ
正解 SSL (Secure Sockets Layer) is an encryption protocol for making communication over the Internet secure. What actually runs today is its successor, TLS, but the exam treats them together as SSL/TLS. When a browser address begins with https://, the HTTP exchanges are being carried on top of SSL/TLS. SSL/TLS provides three main functions: first, encryption of the communication content; second, authentication of the server by means of a digital certificate; and third, detection of tampering by means of a message authentication code. The core of these is encryption. Before communication starts, the server and the client securely share a common (symmetric) key — public key cryptography is used for that sharing — and all data after that is encrypted with that common key before being sent. So even if a third party eavesdrops on the lines, routers, or wireless LAN access points along the communication path, all that flows there is ciphertext, and contents such as passwords or credit card numbers cannot be read. Choice ウ, “By encrypting the communication, it prevents the leakage of communication content along the communication path”, states exactly this function, so the correct answer is ウ.
Incorrectエ
SSL/TLS can detect tampering, but it cannot restore the data to its original form. The method is that the sender computes a message authentication code (MAC) from the data and attaches it, and the receiver performs the same computation and checks whether the two values match. So if the values disagree, all you learn is that tampering or corruption occurred; you cannot tell what the correct content originally was. Once it is detected, the response is to break off the communication or ask for retransmission. Detection and correction (restoration) are different technologies, and that is what makes this choice wrong.
ここがポイント
- SSL/TLS provides three functions: encryption of the communication content with a common (symmetric) key, which prevents eavesdropping and leakage; authentication of the server with a digital certificate, which prevents spoofing; and detection of tampering with a message authentication code. A URL that begins with https:// indicates HTTP communication protected by SSL/TLS.
- The role of a certification authority (CA) is not to relay communication but to examine in advance and to issue and vouch for digital certificates. Also, tampering can be detected but not reversed. These two points are the traps most often set in SSL questions, so keep the exact scope of the functions clearly in mind.
用語