問62
頻出度★★★
電子証明書を発行するときに生成した秘密鍵と公開鍵の鍵ペアのうち, 秘密鍵が漏えいした場合の対処として, 適切なものはどれか。
平成30年度 秋期 ITパスポート試験 問62
This question's explanation and your answers so far.
解説
問 62
Incorrectア
Even if you reissue the digital certificate using the same key pair to which the leaked private key belongs, the already-leaked private key remains valid and can still be abused by a third party, so the danger is not removed and this is no real response. To reissue, you must always generate a new key pair and revoke the old certificate.
- イ
正解 The private key is the most important key, which only its owner should keep secret; if it is leaked, a third party can impersonate the legitimate user to create signatures or decrypt ciphertext. Therefore, the digital certificate corresponding to that private key can no longer be trusted and must be invalidated immediately. A certificate is invalidated by applying to the issuing certificate authority (CA) for its revocation. The CA registers the revoked certificate in the CRL (Certificate Revocation List), and verifiers can refer to this list to judge that the certificate is invalid. Thus, choice イ, applying to the certificate authority to revoke the digital certificate, is the correct action.
Incorrectウ
Waiting until the certificate is reissued upon expiry to switch to a new key pair means that during the long period from discovery of the leak until expiry, the leaked private key would keep being abused. A leak should be handled by revoking immediately; waiting for expiry is inappropriate.
Incorrectエ
The private key is precisely the most important key that can create signatures and perform decryption; the very fact that 'only the private key was leaked' is what makes it the most dangerous, allowing impersonation and decryption of ciphertext. Continuing to use it as is would be the worst response and is wrong.
ここがポイント
- If a private key is leaked, the correct response is to immediately apply to the issuing certificate authority (CA) to revoke and invalidate the corresponding digital certificate, and to announce the invalidation through the CRL (Certificate Revocation List).
- A private key leak cannot be remedied by reissuing with the same key or waiting for expiry; revoking the certificate (invalidating it) is the top priority.
用語