ITPEC FE Subject A October 2025 Question 28
When X receives a message with a digital signature that uses public key cryptography from Y, which of the following is the key that X uses to verify that the message truly came from Y?
Explanation
Y's public key — a signature made with the sender's private key is verified with the sender's public key.
- •Y hashes the message and signs the digest with Y's private key, which only Y holds.
- •X verifies the signature with Y's public key and compares the result with the digest X computes from the received message.
If they match, the signature could only have been made with Y's private key, so the message came from Y and was not altered.
Answer (d)
Why not others:
- •(a) — X's private key decrypts data encrypted for X; it says nothing about who sent the message.
- •(b) — X's public key is what others use to encrypt data for X, which is confidentiality, not sender authentication.
- •(c) — Y's private key creates the signature and never leaves Y, so X does not have it.
Key rule: Signing uses the sender's private key and verifying uses the sender's public key; encrypting for confidentiality uses the receiver's keys the other way round.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.