ITPEC FE Morning April 2018 Question 40
In an e-commerce transaction that uses public key cryptography, which of the following is the role of a certificate agency (CA)?
Explanation
Issuing digital certificates for the parties' public keys — the CA vouches that each public key really belongs to its owner.
In public key cryptography anyone can publish a key under any name. A certificate authority checks the applicant's identity and signs a digital certificate that binds the name to the public key. A trading partner verifies the CA's signature on the certificate and can then trust the key for encryption or for checking signatures.
Answer (b)
Why not others:
- •(a) — the parties encrypt their own messages with the recipient's public key; the CA does not encrypt traffic
- •(c) — password management has nothing to do with certificates; a CA deals in keys and identities
- •(d) — in public key cryptography the private key is never shared; each party keeps its own secret, and a shared secret key belongs to common key cryptography
Key rule: A CA certifies which public key belongs to whom; private keys stay with their owners and the CA never holds them.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.