問56
頻出度★★★
A さんが B さんに暗号化メールを送信したい。S/MIME (Secure/Multipurpose Internet Mail Extensions) を利用して暗号化したメールを送信する場合の条件のうち，適切なものはどれか。
平成24年度 秋期 ITパスポート試験 問56
This question's explanation and your answers so far.
解説
問 56
Incorrectア
Saying that both A and B need public-key certificates describes the condition for when A also attaches a digital signature in addition to encrypting, and it is excessive as a condition for this question, which involves encryption only. The only keys used for encryption are receiver B’s public key and private key, and sender A’s key pair does not appear at all in the encryption process. Therefore, this statement, which makes A’s certificate mandatory as well, is not appropriate.
Incorrectイ
S/MIME is an end-to-end mechanism in which the message body itself is encrypted by the sender’s email client and decrypted by the receiver’s email client. The mail servers along the way merely forward the encrypted content as an ordinary email, so there is no need at all for the sender and the receiver to belong to the same ISP. Even between email addresses at different ISPs or different organizations, encrypted email can be exchanged as long as the other party’s public-key certificate can be obtained.
Incorrectウ
S/MIME encryption and decryption are performed by the user’s email client (MUA), and the ISP’s mail server takes no part in that processing. From the ISP’s point of view, an email encrypted with S/MIME is just an ordinary email containing data in a form whose body cannot be read, and it can be relayed as is. Therefore, whether the ISP that A has a contract with supports S/MIME is not a condition. What is required is that the email clients of both the sender and the receiver support S/MIME.
- エ
正解 The correct answer is エ “B must have obtained their own public-key certificate in advance, but A does not need to.” S/MIME is a standard that adds encryption and digital signature functions to email, and it uses public-key cryptography for encryption. The basic principle of public-key cryptography is that encryption uses the receiver’s public key, while decryption uses the private key that only the receiver holds. In actual S/MIME, the message body is encrypted with fast symmetric-key encryption using a randomly generated symmetric key, and that symmetric key is then encrypted with the receiver’s public key and attached to the message (a hybrid method), but the roles of the keys do not change. Therefore, what A must prepare in advance in order to send an encrypted email to B is B’s public key, and in order to guarantee that this public key really belongs to B, B must have their own public-key certificate (digital certificate) issued by a certificate authority (CA) beforehand. A only obtains B’s certificate and uses it to encrypt, so A’s own key pair and public-key certificate are not used for encryption and are not required. Note that A needs their own certificate (private key) when attaching a digital signature to the email in order to prevent spoofing and tampering; this question asks only about the conditions for sending an encrypted email, so what is needed is the certificate on the receiver B’s side. Hence エ is appropriate.
ここがポイント
- The direction of the keys for encrypted email under public-key cryptography — encryption uses the receiver’s public key, and decryption uses the receiver’s private key. Therefore, the side that must create a key pair in advance and have a public-key certificate issued by a certificate authority is the receiver, while the sender needs their own certificate when attaching a digital signature. S/MIME is the standard that provides email with both this encryption and this signing.
- S/MIME is an end-to-end mechanism that is completed between email clients — encryption and decryption are carried out by the MUAs of the sender and the receiver, and the ISPs and mail servers in between merely forward the encrypted email as is, so belonging to the same ISP or S/MIME support on the ISP side is not a prerequisite.
用語