IPA IP 2023 Question 84
A question IPA Japan published in 令和5年度 ITパスポート試験 公開問題 問84, translated into English. ITPEC is based on the same exams.
Which of the following is an appropriate description concerning an e-mail to which the sender’s digital signature that uses a message digest is attached?
Explanation
The recipient can detect tampering, though it cannot be prevented — a digital signature proves integrity and origin; it does not hide or lock the message.
The sender computes a message digest (hash value) of the body and encrypts it with the sender's own private key: that is the digital signature. The recipient decrypts the signature with the sender's public key and compares the result with a digest computed from the received body. If anyone changed the body on the way, the two digests differ, so the change is detected. Nothing in this stops an attacker from altering the e-mail; it only makes the alteration visible.
Answer (d)
Why not others:
- •(a) — the signature is made with the sender's private key, not by a mail server; it says who wrote the message and that it is intact, not which servers relayed it
- •(b) — the signature is verified with the sender's public key (in the sender's certificate), not with the sending mail server's server certificate
- •(c) — signing does not encrypt the body; confidentiality needs separate encryption, for example with the recipient's public key
Key rule: Digital signature = integrity + authentication of the sender (and non-repudiation), checked with the sender's public key; it gives no confidentiality.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.