IPA IP 2024 Question 77
A question IPA Japan published in 令和6年度 ITパスポート試験 公開問題 問77, translated into English. ITPEC is based on the same exams.
In order to avoid using a program file of unknown origin, a user wants to investigate its publisher. Which of the following is the appropriate information to be checked in this case?
Explanation
The digital signature of the program file — a code signature tells who published the program and that it has not been altered since.
The publisher signs the program with its private key and attaches its digital certificate, issued by a certificate authority. The certificate binds the publisher’s name to the public key. When the user checks the signature with that public key and it verifies, the program was signed by the publisher named in the certificate, and its content is the same as when it was signed. An unsigned program, or one whose signature fails, has no proof of where it came from.
Answer (c)
Why not others:
- •(a) — access rights say who may read, write or execute the file on this computer; they are set locally and say nothing about who made it
- •(b) — the owner recorded by the file system is the account that created or saved the file on this computer, typically the user who downloaded it, not the publisher
- •(d) — a hash value detects alteration when it is compared with a published value, but the hash itself contains no information about who published the file
Key rule: A digital signature with its certificate proves the origin and the integrity of a file; a hash value alone proves only integrity.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.