This question's explanation and your answers so far.
次のような認証方式の特徴に関する記述として，適切なものはどれか。 ・利用者は認証用のマトリクス表における位置，順序情報だけを記憶する。 ・マトリクス表には認証の都度ランダムに数字が割り当てられる。 ・利用者は記憶した位置に表示されている数値を順にパスワードとして入力する。 ・正しい位置に表示されている数値の入力が確認できた場合に認証が成功する。 〔マトリクス表を利用した認証の例〕 今回の認証（パスワードは 5025） マトリクス表（左）
| 5 | 1 | 0 | 3 |
|---|---|---|---|
| 9 | 6 | 6 | 7 |
| 1 | 8 | 9 | 4 |
| 0 | 7 | 5 | 8 |
マトリクス表（右）
| 6 | 5 | 0 | 5 |
|---|---|---|---|
| 8 | 8 | 3 | 4 |
| 0 | 9 | 2 | 8 |
| 4 | 5 | 4 | 2 |
→（次回の認証） 次回の認証（パスワードは 3059） マトリクス表（左）
| 3 | 2 | 5 | 0 |
|---|---|---|---|
| 3 | 3 | 7 | 9 |
| 0 | 3 | 3 | 7 |
| 0 | 3 | 6 | 8 |
マトリクス表（右）
| 6 | 0 | 8 | 9 |
|---|---|---|---|
| 2 | 6 | 8 | 1 |
| 1 | 8 | 7 | 3 |
| 1 | 0 | 6 | 5 |
注記 網掛けの部分は，記憶した位置を示し，矢印は記憶した順序を示す。
The “position and order information” is the only fixed secret in this method (equivalent to the actual password), and once leaked it is permanently compromised. Like a password, it should be changed periodically and reset when leaked, so it cannot be said that “it does not need to be changed periodically.” What changes each time is the displayed numbers, not the memorized positions and order; this choice confuses the two.
The position and order information is the very secret of this authentication. If it is told to someone else, that person can read the numbers at the correct positions each time they see the table and impersonate the user at will. Therefore telling others is not safe; rather, it is information that must never be disclosed to anyone.
正解 Matrix authentication is a kind of one-time password. What the user memorizes is only the “position and order” in the table, while the numbers displayed at those positions are randomly assigned at each authentication. In the example figure as well, the memorized positions (shaded cells) are the same this time and next time, yet the password actually entered changes every time: 5025 this time and 3059 next time. Therefore, even if the password of one session is eavesdropped (peeked at or intercepted), different numbers line up at the same positions next time, so reusing that stolen string of digits does not enable impersonation. Hence choice ウ, stating that “it is effective in preventing impersonation that uses an eavesdropped password,” is appropriate.
Biometric authentication verifies identity using the person’s physical characteristics (being), such as fingerprint, iris, or vein. Matrix authentication is authentication based on “knowledge”—the memorized position and order—and is not biometric authentication. This choice confuses the classification of the three authentication factors.