問83
頻出度★★☆
PCのブラウザでURLが “https://” で始まるサイトを閲覧したときの通信の暗号化に関する記述のうち, 適切なものはどれか。
平成27年度 春期 ITパスポート試験 問83
テクノロジ系ネットワーク › 通信プロトコル
This question's explanation and your answers so far.
解説
問 83
Incorrectア
“Only the communication from the PC to the Web server is encrypted” is wrong. It is true that protecting sent data such as passwords and credit card numbers is a typical purpose of HTTPS, but TLS encrypts on a per-connection basis, so it is not a mechanism that selects only the sending direction for encryption. The response from the server is also encrypted with the same session key.
Incorrectイ
“Only the communication from the Web server to the PC is encrypted” is also wrong. There is no scheme that encrypts only the response data while sending the request data in plaintext. If there were, the ID and password entered by the user would travel in the clear, and there would be no point in using HTTPS.
- ウ
正解 Communication with a URL that begins with “https://” is carried out by HTTPS, which wraps HTTP inside TLS (SSL). During the handshake, TLS checks the server certificate and shares a symmetric key (session key), and from then on it uses that key to encrypt all data exchanged over the whole established connection. The encryption is not a one-way setting such as “only the sending direction” or “only the receiving direction”; it applies to every piece of data that flows over the established TLS connection. Therefore both the request sent from the PC to the Web server (the contents of input forms, cookies, and so on) and the response returned from the Web server to the PC (the HTML and the data in the page) are encrypted. Hence ウ, which states that the bidirectional communication between the Web server and the PC is encrypted, is the appropriate answer.
Incorrectエ
“Which direction of communication is encrypted depends on the Web server's settings” is wrong. In the TLS specification there is no setting that switches encryption on or off per direction. What the server side can configure is whether to use HTTPS, which encryption methods (cipher suites) and protocol versions to allow, and which certificate to use; there is no option to encrypt only one direction.
ここがポイント
- HTTPS = HTTP + TLS (SSL). It confirms the other party with a server certificate and shares a symmetric key, then encrypts the data on the established connection, which prevents eavesdropping and tampering.
- TLS encryption works per connection and takes effect in both directions. Both the request (PC → server) and the response (server → PC) are encrypted, and there is no setting that enables or disables it per direction.
用語