問100
頻出度★★★
電子メールにディジタル署名を付与して送信するとき，信頼できる認証局から発行された電子証明書を使用することに比べて，送信者が自分で作成した電子証明書を使用した場合の受信側のリスクとして，適切なものはどれか。
令和2年度 ITパスポート試験 問100
This question's explanation and your answers so far.
解説
問 100
- ア
正解 To verify a digital signature, you must confirm whether the public key that corresponds to the private key used for the signature “really belongs to that sender,” and it is the digital certificate that provides this assurance. With a certificate issued by a trusted certificate authority (CA), the CA acts as a third party that reviews and guarantees the holder’s identity, so the receiver can trust the other party. However, a self-signed certificate created by the sender has no third party to guarantee identity. Anyone can freely create a certificate claiming “I am so-and-so,” so even if the signature itself is correct, the receiver cannot confirm whether it was really sent by the correct party. Therefore the appropriate risk is choice ア.
Incorrectイ
Preventing eavesdropping (being secretly read) is the role of encrypting the communication content, and has nothing to do with the type of digital signature or digital certificate. Whether the certificate is self-made or issued by a CA does not change the risk of being read in transit, so this choice is wrong.
Incorrectウ
Whether an email is lost in transit is a matter of the communication route and delivery reliability, and is unrelated to the issuer of the certificate used for the signature. Even if you make your own certificate, the risk of loss does not increase, so this choice is wrong.
Incorrectエ
Garbled characters occur due to encoding problems such as character-code mismatches, and have nothing to do with the type of digital certificate. Using a self-signed certificate does not make garbling more likely, so this choice is wrong.
ここがポイント
- A digital signature guarantees “identity (authentication)” and “tamper detection (integrity),” which is different from encryption (confidentiality) that prevents eavesdropping.
- A digital certificate guarantees the correspondence between a public key and its owner; when issued by a trusted certificate authority (CA) a third party guarantees the identity, but a self-signed certificate has no third party to guarantee it, so the receiver cannot detect impersonation.
用語