ITPEC FE Subject B April 2024 Question 18

PKI key usage — understanding which key (public/private) is used for SSL certificates, email encryption, and digital signatures.

Action 1 (A): To obtain an SSL certificate, the web server submits its public key (inside a CSR) to the third-party CA. The CA signs the certificate with the CA's own private key. The server's private key never leaves the server.

Action 2 (B): To allow external parties to send encrypted emails to employees, the staff directory publishes each employee's public key. Senders encrypt with the recipient's public key → only the recipient can decrypt with their private key.

Action 3 (C): To digitally sign outgoing emails, employees must install their own private key on their email clients. The recipient verifies the signature using the sender's public key.

The correct combination is (f): A = web server's public key, B = employees' public key, C = employee's private key.

Why not others:
- (a) Sends the server's private key to the CA — private keys must never leave the server
- (b) Publishes employees' private keys — private keys must never be shared publicly
- (c) Same private-key-leak problem for both A and B
- (d) Publishes employees' public key (correct for B), but uses customers' private key for C — employees need their own private key to sign, not the customers'
- (e) Publishes employees' public key (correct for B), but uses customers' public key for C — signing requires a private key, not a public one

Key rule: encrypt with the recipient's public key, sign with the sender's private key, and never transmit a private key to another party.

AI-generated — may contain errors