Disk encryption (ディスク暗号化) encrypts everything written to a storage device such as a hard disk or SSD.
Data is encrypted automatically as it is written and decrypted automatically when the legitimate user works with it, so the user rarely has to do anything. The main aim is to keep anyone from reading the contents of a storage device pulled out of a laptop or external drive that was stolen or left behind. If the encryption key is kept in a tamper-resistant chip inside the machine, removing the storage device alone is not enough to decrypt it.
AnalogyIt is like turning the whole archive room into one big safe. Even if the safe is carried off, anyone who cannot open it cannot read a single document on its shelves.
Exam points
ExamA startup or OS login password (パスワード) is only checked when that PC is in use, and it does nothing once the storage device is removed and connected to another PC. What protects the contents themselves is disk encryption (ディスク暗号化).
File encryption (ファイル暗号化) protects data by choosing files and encrypting them one at a time.
An encrypted file stays encrypted even when it is copied to other media or attached to an email. However, if the key or password for decryption travels over a route that could be snooped on just like the file, the contents are not protected. And any file you forget to select is left unprotected.
AnalogyIt is like keeping only your important papers in a small locked box. Even if someone is handed the whole box, they cannot open it without the key.
Exam points
ExamIf stored data is encrypted (暗号化), its contents are hard to read even if someone obtains it. Backups (バックアップ) and duplicated servers raise availability (可用性, keeping data usable when needed) and do nothing to prevent leaks.
Mix-upDisk encryption (ディスク暗号化) protects what is on the storage device itself, so files copied or sent from it leave unencrypted. To protect files that leave the device as well, file encryption (ファイル暗号化) is the better fit.
A digital signature (デジタル署名) is a signature made with a private key (秘密鍵) that only the sender holds and attached to electronic data, so the receiver can confirm who created it and whether it was altered.
Sender: computes the data's hash value
Sender: creates the signature with the private key
Data and signature are sent together
Receiver: restores the signature with the sender's public key
Receiver: compares it with the hash value it computed
If it matches the hash value computed from the received data, the data came from the sender and was not changed on the way.
4 / 4
The hash value (ハッシュ値) used in the comparison is always the same for the same data, and the original data cannot be worked out from it. Because the hash value is computed from the whole data rather than part of it, rewriting any part makes the values disagree.
AnalogyIt is like sealing a summary of a document with a stamp only you own. The imprint shows whose seal it is, and if the summary no longer matches the document, the rewrite is exposed.
Exam points
ExamAs long as a trusted third party vouches that the public key (公開鍵) really belongs to the sender, a digital signature (デジタル署名) confirms that the sender is genuine and that nothing was rewritten on the way. It does nothing to keep the contents from being read (confidentiality, 機密性).
ExamA digital signature (デジタル署名) can detect that tampering (改ざん) occurred, but it cannot prevent the tampering itself.
ExamBecause a signature can only be made with the signer's private key (秘密鍵), the signer cannot later deny having sent it or what it said. A signature attached to a program lets you confirm who published it.
A signing key (署名鍵) is the key used to create a digital signature: the private key (秘密鍵) that only the signer holds.
Since only the owner holds the signing key, a signature made with it is treated as the owner's own. Conversely, if the signing key leaks to someone else, that person can impersonate the owner and create signatures.
AnalogyIt is like a registered personal seal that only its owner keeps.
How to rememberA signature is something you write with your own hand, so the key behind it is one only you hold: the private key. The word itself points the way.
Exam points
ExamThe signing key (署名鍵), that is, the private key (秘密鍵), must stay unknown to everyone but its owner, including the other party. The shared key (共通鍵) in symmetric-key cryptography is likewise kept secret from everyone except the communicating parties.
ExamData transformed with the signing key (署名鍵) can be restored by anyone holding the matching public key (公開鍵). That is why anyone who receives it can check the signature.
A verification key (検証鍵) is the key used to check whether a received digital signature is valid: the signer's public key (公開鍵).
Because the verification key can be made public, anyone who obtains the signer's verification key can check the signature. Whether that public key really belongs to that person must be confirmed separately, which is why a trusted certificate authority (認証局) issues an electronic certificate (電子証明書) that ties the public key to its owner.
AnalogyIt is like a sample imprint of your seal given to others in advance, used to check whether the stamp on an arriving document is genuine.
Exam points
ExamA public key (公開鍵) is used to check a signature (the signer's public key) and to make ciphertext only the key's owner can read (the receiver's public key); it is not used to create a signature.
ExamWith an electronic certificate (電子証明書) the sender made themselves, the receiver has no way to confirm that the public key (公開鍵) really belongs to the sender.
A timestamp (タイムスタンプ) is proof that electronic data existed at a certain time and has not been rewritten since.
User: sends the data's hash value to the time-stamping authority
Time-stamping authority: binds the time, signs it and returns it
User: keeps the data and the timestamp
Later: checked against the data's hash value
Later, if the hash value computed from the data equals the one inside the timestamp, the data has not changed since that time.
4 / 4
With a timestamp on an electronic contract or similar document, no one can later backdate it or deny that it existed at that time. The reliability of the time itself rests on time authentication (時刻認証), covered next.
AnalogyIt is like a postmark. The post office, not the sender, stamps the date, so it cannot be fudged afterward.
Exam points
ExamA timestamp (タイムスタンプ) proves time and whether data was tampered with; it does not keep a file's contents from others (confidentiality, 機密性). To protect confidentiality, use access control (アクセス制御) or similar measures.
Time authentication (時刻認証) is a trusted third party, the time-stamping authority (時刻認証局), attaching an accurate time to electronic data and certifying it.
As a disinterested third party, the time-stamping authority attaches the time based on an accurate time source. A time that the data's own creator attached counts for nothing as evidence if a dispute arises later.
How to rememberIf the name says “authority”, it is a third-party body. The certificate authority (認証局) vouches for who owns a public key and the time-stamping authority (時刻認証局) vouches for the time, so set them side by side to tell them apart.
Exam points
Mix-upThe time on a timestamp (タイムスタンプ) is set by the time-stamping authority (時刻認証局), not by the clock on the user's own PC. So whether a timestamp can be trusted depends on whether the authority can be trusted.
Key points
Encryption keeps the contents of a stolen storage device or a file taken outside hard to read.
A digital signature confirms that the creator is genuine and that the content has not been rewritten.
A signature is created with the signer's private key (signing key) and checked with the signer's public key (verification key). Whether the verification key really belongs to the signer is confirmed with an electronic certificate issued by a trusted certificate authority.
A timestamp is proof attached by a time-stamping authority, showing that data existed at that time and has not changed since.