ITPEC IP October 2022 Question 41
In e-commerce transactions, which of the following is the most appropriate request to be made to the other party in order to prevent denial of the fact of order placement and details thereof?
Explanation
Letting the other party add a digital signature to the order data — a signature made with the orderer's private key is evidence that only the orderer could have produced that exact order.
The orderer computes a hash of the order data and encrypts it with its own private key. The receiver verifies the signature with the orderer's public key: if it checks, the order came from the holder of that private key and has not been altered since. Nobody else holds the private key, so the orderer cannot later deny having placed the order or claim different details. This property is non-repudiation.
Answer (c)
Why not others:
- •(a) — an OS login password protects the other party's own computer; it leaves nothing in the order data that shows who sent it
- •(b) — virus measures in the other party's intranet protect against malware, not against the other party itself denying an order
- •(d) — encryption keeps the order secret in transit (confidentiality); anyone holding the encryption key can produce the ciphertext, so it does not prove afterwards who created the order or what it said
Key rule: Encryption gives confidentiality; a digital signature gives integrity, authentication of the sender and non-repudiation, because only the signer holds the private key.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official IP past-paper collection or Report an issue.