This question's explanation and your answers so far.
次の認証方式の特徴に関する記述として，適切なものはどれか。 ・利用者にはあらかじめ乱数表が渡されている。 ・乱数表に印刷された数字は利用者ごとに異なる。 ・システムが要求する乱数表の座標位置に記載された数字をパスワードとして入力する。（座標位置は毎回異なる。） ・正しいパスワードの入力が確認できた場合に認証が成功する。 〔乱数表の例〕
| A | B | C | D | E | |
|---|---|---|---|---|---|
| 1 | 37 | 24 | 99 | 91 | 76 |
| 2 | 77 | 75 | 64 | 88 | 52 |
| 3 | 94 | 84 | 11 | 41 | 58 |
| 4 | 66 | 61 | 18 | 26 | 31 |
| 5 | 47 | 60 | 81 | 23 | 29 |
システムが要求する乱数表の座標位置が B1, C2, D3, E4 の場合 パスワードは 24644131 となる。
The numbers printed on the random number table are fixed. If the same coordinate positions are requested (for example B1, C2, D3, E4 again), the numbers read off are the same 24, 64, 41, 31, and the password is 24644131 every time. The password changes because the coordinate positions differ each time; with the same coordinates the value is the same. This statement has the cause and effect reversed.
The user does not memorize a password; instead, the user reads the numbers off the random number table, an item handed over in advance. Someone who does not have the table cannot answer even when coordinates are specified, so this is classified as possession-based authentication. Knowledge-based authentication refers to verifying identity with information held in the person's head, such as a memorized password or the answer to a secret question.
正解 In this method, the coordinate positions on the random number table specified by the system change every time. In the example figure, B1, C2, D3, and E4 are specified, and joining the numbers at those positions — 24, 64, 41, 31 — gives 24644131 as this time's password. Next time, however, different coordinates (for example A2, B4, C5) are specified, so the digit string to be entered also becomes a different one. In other words, the password effectively works as a one-time password. Therefore, even if the password is eavesdropped on the communication path, that digit string does not work for the next authentication, so it is effective in preventing impersonation (a replay attack) that uses the eavesdropped value. This is the reason why option ウ is correct.
The numbers on the random number table differ for each user, and the table itself is the proof of identity (the possession factor). If you hand it over to another person, that person can give the correct numbers for whatever coordinates are requested, and can therefore impersonate you directly. The random number table is secret information that must not be handed to anyone else, so this statement is the opposite.