ITPEC IP October 2025 Question 38
When a digital signature is attached to an e-mail and the e-mail is sent, in comparison to the use of a digital certificate that is issued by a trusted certificate authority, which of the following is the risk on the receiver’s side that is caused by the use of a digital certificate created by the sender themselves?
Explanation
It becomes impossible to check that the e-mail came from the correct counterpart — a certificate the sender made for themselves proves nothing about who owns the key.
The receiver verifies the signature with the public key in the sender's certificate. That shows the e-mail was signed with the matching private key and has not been altered since. Who holds that key is vouched for by the certificate authority: it checks the applicant's identity before signing the certificate, and the receiver trusts the CA. A self-created certificate is signed only by its own subject, so an impersonator can make one under anyone's name; the signature still verifies, but the link to the real sender is gone.
Answer (a)
Why not others:
- •(b) — spying on the e-mail is a matter of confidentiality; a signature does not encrypt the mail with either kind of certificate, encryption does
- •(c) — losing mail in transit is a delivery matter of mail servers and networks, unaffected by certificates
- •(d) — the certificate does not make content more fragile, and the signature still detects any change to the signed content
Key rule: A digital signature binds a message to a key; a certificate from a trusted CA binds that key to a person, so without the CA the signature proves integrity but not identity.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official IP past-paper collection or Report an issue.