問100
頻出度★★★
電子商取引において, 注文した事実やその内容について否認されることを防止するために, 取引の相手に実施を依頼することとして, 最も適切なものはどれか。
平成31年度 春期 ITパスポート試験 問100
This question's explanation and your answers so far.
解説
問 100
Incorrectア
Having the other party set an OS login password on their PC is merely authentication and access control that prevents unauthorized access to that PC. It does not prove who sent the order, nor does it prevent later denial, so it does not serve as a means of non-repudiation.
Incorrectイ
Antivirus measures within the intranet are steps to protect the environment from malware infection; they do nothing to prove who sent the order data or to prevent denial of its content. Their purpose differs from non-repudiation.
- ウ
正解 The correct answer is ウ. The requirement to “prevent the order from being denied” asks for a property that makes it impossible to later claim “I never placed such an order” — namely non-repudiation. A digital signature works by having the sender sign the order data with their private key and the receiver verify it with the corresponding public key. This guarantees that (1) only the person holding the private key could have produced the signature (authenticity / authentication of the sender), and (2) the data was not altered in transit (integrity). Because both hold, the sender cannot later deny the fact or the content of the order, which is exactly non-repudiation. Therefore the measure to ask the trading partner to implement is ウ.
Incorrectエ
Encrypting the order data before sending it aims to ensure confidentiality, so that the content cannot be read even if intercepted. Encryption alone cannot prove who sent it and cannot stop the sender from later denying the order, so it is inappropriate as a means of non-repudiation.
ここがポイント
- The technology that achieves non-repudiation is the digital signature. Signing with the sender's private key and verifying with the public key guarantees authenticity and integrity, blocking any later denial.
- Match the security measure to the property being protected: confidentiality = encryption, authentication / access control = password, environmental safety = antivirus, non-repudiation = digital signature.
用語