問94
頻出度★★★
利用者が, トークンと呼ばれる装置などで生成した毎回異なる情報を用いて, 認証を受ける認証方式を何というか。
平成29年度 春期 ITパスポート試験 問94
This question's explanation and your answers so far.
解説
問 94
Incorrectア
A digital signature is a mechanism that uses public-key cryptography to prove that a document or message was created by the person concerned and has not been tampered with. Its purpose is to guarantee the authenticity and integrity of data, which differs from the question's method in which a token generates a different password each time to authenticate.
Incorrectイ
Password cracking refers to attack techniques such as brute force (exhaustive search) or dictionary attacks that illegally determine another person's password. It is not a legitimate authentication method by which one is authenticated; rather, it is the act of an attacker trying to break authentication, so it is incorrect.
Incorrectウ
A password policy is a set of rules that an organization establishes for the secure operation of passwords, such as the minimum number of characters, the types of characters used, the expiration period, and a ban on reuse. It is an operational standard for authentication, not the authentication method itself in which a token generates different information each time.
- エ
正解 The correct answer is エ, One-Time Password. A one-time password (OTP) is an authentication method in which a dedicated hardware device called a token, or a smartphone app, generates a different single-use password each time, and that password is used to authenticate. The generated password is valid only once, or only for a short time (for example, a few tens of seconds), and becomes invalid after use. This matches exactly the question's description of being authenticated using information that differs each time. Even if a one-time password is eavesdropped on the communication channel, that password cannot be reused; therefore, compared with a fixed-password method that reuses the same password many times, it has the advantage of being more resistant to impersonation and replay attacks.
ここがポイント
- One-time password (OTP): an authentication method that uses a token or similar to generate a different single-use password each time. Even if eavesdropped, it cannot be reused, so it is resistant to replay attacks.
- Distinguishing confusing terms: digital signature (guarantees authenticity and integrity), password cracking (an attack that breaks passwords), and password policy (rules for password operation) are none of them a method that generates different authentication information each time.
用語