ITPEC IP October 2024 Question 39
A private key and a public key were generated as a key pair and a digital certificate for the public key was issued. Which of the following is an appropriate action that should be taken when the private key is leaked?
Explanation
Ask the certification authority to revoke the certificate — a leaked private key means the certificate can no longer be trusted.
A digital certificate vouches that a public key belongs to its owner. Whoever holds the leaked private key can forge that owner's signatures or decrypt data meant for them. Revoking the certificate puts it on the CA's revocation list (CRL), so others stop trusting it; then a new key pair is generated and a new certificate issued.
Answer (b)
Why not others:
- •(a) — a new certificate for the same key pair still certifies the leaked key
- •(c) — expiry of the validity period is not the issue; the certificate is compromised now, and until revoked it stays valid for others
- •(d) — the public key in the certificate pairs with the leaked private key, so the certificate itself is compromised
Key rule: On private key compromise, revoke the certificate at once, then create a new key pair and certificate.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official IP past-paper collection or Report an issue.