問84
頻出度★★★
暗号化又は復号で使用する鍵 a～c のうち, 第三者に漏れないように管理すべき鍵だけを全て挙げたものはどれか。 a 共通鍵暗号方式の共通鍵 b 公開鍵暗号方式の公開鍵 c 公開鍵暗号方式の秘密鍵
平成23年度 秋期 ITパスポート試験 問84
This question's explanation and your answers so far.
解説
問 84
Incorrectア
It is correct that a and c must be kept secret, but including b, the public key, among the keys to keep secret is wrong. A public key is only useful once it has been distributed to an unspecified number of people; if it is kept secret, the other party cannot create ciphertext and cannot verify signatures, and public-key cryptography itself does not work at all.
- イ
正解 The keys that must be managed so they are not leaked to third parties are the keys whose disclosure would break the security of the encryption — in other words, keys that must be kept secret. In a, the shared key of symmetric-key cryptography is used by the sender and the receiver to perform both encryption and decryption with the same single key, so the moment it reaches a third party the ciphertext can be decrypted as it is. It must therefore be strictly managed as a secret shared only between the parties involved. In c, the private key of public-key cryptography can decrypt ciphertext that was encrypted with the matching public key, and it is also used to create digital signatures, so if it reaches anyone other than its owner it allows the contents to be read and the owner to be impersonated; it too must be kept secret. On the other hand, b, the public key of public-key cryptography, is a key that is meant from the start to be distributed widely to anyone who wants to send ciphertext or verify a signature, and working out the paired private key from the public key is computationally difficult, so there is no problem if third parties know it. Only a and c must be kept secret, so the correct answer is イ.
Incorrectウ
This option is wrong twice over: it includes b among the keys to keep secret and leaves a out. It treats b, which is meant to be published and distributed, as something to keep secret, while excluding a, the shared key, which would let the ciphertext be decrypted on the spot if it leaked. The judgment of what needs to be kept secret is exactly reversed.
Incorrectエ
It is correct that c must be kept secret, but a is missing, so this option does not list all of them. The shared key of symmetric-key cryptography also lets the ciphertext be decrypted if it leaks to a third party, so it too must be kept secret; the fact that safely delivering that shared key to the other party is itself a challenge (the key distribution problem) likewise shows that the shared key is a key that must be kept secret.
ここがポイント
- Symmetric-key cryptography uses the same key for both encryption and decryption, so that shared key must be strictly managed as a secret between the communicating parties (if it leaks, a third party can decrypt the ciphertext).
- In public-key cryptography, of the two paired keys, the public key may be distributed to anyone while the private key is held only by its owner. Note that, as the names suggest, this split between what must be kept secret and what need not be applies to that key pair; the shared key of symmetric-key cryptography is still something to keep secret even though its name does not contain the word “secret.” Also, symmetric-key cryptography is sometimes called secret-key cryptography, but the secret key referred to there is the shared key held in common by the parties, which is a different thing from the private key that only its owner holds in public-key cryptography — do not confuse the two.
用語