問60
頻出度★★★
AさんがBさんに署名付きメールを送信したい。S/MIME (Secure/Multipurpose Internet Mail Extensions) を利用して署名付きメールを送信する場合の条件のうち, 適切なものはどれか。
平成25年度 秋期 ITパスポート試験 問60
This question's explanation and your answers so far.
解説
問 60
Incorrectア
The statement that both A and B must obtain the issuance of their own public-key certificate in advance is wrong. Certificates are needed on both sides only when encrypted mail is exchanged in both directions, or when B also replies with a signed email. This question asks only about the condition for sending a signed email from A to B, so what is required is only the certificate (and private key) of A, who creates the signature. B merely verifies using A's attached certificate and the certificate authority's certificate, so B can verify the signature even without having been issued a certificate. The option makes the condition stricter than necessary, so it is inappropriate.
Incorrectイ
The statement that both A and B must belong to the same ISP is wrong. S/MIME applies the signature or encryption to the message itself on the mail software (mail client) side, and the SMTP mail servers and ISPs that carry it along the way simply forward the contents as they are. The basis of trust is the public-key certificate issued by a certificate authority, not a match of carriers or ISPs. Signed S/MIME email can be exchanged without any problem between different ISPs, different organizations, and even different countries.
Incorrectウ
The statement that the ISP A belongs to must support S/MIME is wrong. An S/MIME signature is created by the sender's mail software and verified by the receiver's mail software, which is so-called end-to-end processing. The signature and the certificate are embedded in the mail as attached data in MIME format, so from the viewpoint of an ISP's mail server they are just the same kind of data as an ordinary mail, and no special supporting function is required on the server side. What must support S/MIME is the mail software on both the sending and receiving sides, not the ISP.
- エ
正解 The correct answer is エ. S/MIME is an Internet standard that adds encryption and digital signature functions to email, and it is built on public-key cryptography and public-key certificates (digital certificates). A signed email works as follows. First, sender A obtains a public-key certificate for themselves in advance from a certificate authority (CA). When sending the mail, A computes a hash value (message digest) from the message body, encrypts that hash with A's own private key to create the digital signature, attaches it to the mail, and also attaches A's public-key certificate. The mail software of receiver B validates the attached certificate of A by following the trust chain up to the certificate authority, then uses A's public key contained in that certificate to decrypt the signature and compares it with the hash value of the message body. If they match, B can confirm that the mail was indeed sent by A and that it was not tampered with in transit, which establishes sender authentication, integrity, and non-repudiation of sending. All of the keys used in this verification belong to A; B does not use their own key pair or certificate at all. In other words, only the signing side, A, needs a certificate in order to send a signed email, and receiver B does not. Therefore エ is appropriate. Note that B's public-key certificate becomes necessary only when A encrypts the mail with B's public key before sending it (an encrypted email), which is a different condition from the signed email in this question.
ここがポイント
- A digital signature works by creating the signature with the sender's private key and verifying it with the sender's public key. Both keys belong to the sender, so only the sender needs a public-key certificate in order to send a signed email; the receiver does not. Encryption, by contrast, encrypts with the receiver's public key and decrypts with the receiver's private key, so the receiver's certificate is needed when sending an encrypted email. Which side's keys a process uses determines whose certificate is required, and that is the main point of this question.
- S/MIME is an Internet standard that provides signing and encryption for email using public-key certificates (digital certificates issued by a certificate authority), and it works as long as the mail software of the sender and the receiver supports it. The kind of ISP or mail server, or whether they match, has nothing to do with the condition; this end-to-end nature is worth remembering as well.
用語