A message can be encrypted and digitally signed, which provides:
A.
Confidentiality, Authentication, Non-repudiation, and Integrity.
B.
Confidentiality and Authentication
C.
Confidentiality and Non-repudiation
D.
Confidentiality and Integrity.
Explanation:
Confidentiality ensures that a message can only be read by the intended recipient. Encrypting a message
provides confidentiality.
A digital signature provides Authentication, Non-repudiation, and Integrity.
The purpose of digital signatures is to detect unauthorized modifications of data, and to authenticate the identity
of the signatories and non-repudiation. These functions are accomplished by generating a block of data that is
usually smaller than the size of the original data. This smaller block of data is bound to the original data and to
the identity of the sender. This binding verifies the integrity of data and provides non-repudiation. To quote the
National Institute Standards and Technology (NIST) Digital Signature Standard (DSS): Digital signatures are
used to detect unauthorized modifications to data and to authenticate the identity of the signatory. In addition,
the recipient of signed data can use a digital signature in proving to a third party that the signature was in fact
generated by the signatory.
Different steps and algorithms provide different types of security services:
A message can be encrypted, which provides confidentiality.
A message can be hashed, which provides integrity
A message can be digitally signed, which provides authentication, nonrepudiation, and integrity.
A message can be encrypted and digitally signed, which provides confidentiality, authentication,
nonrepudiation, and integrity
Incorrect Answers:
B: A digital signature provides Authentication, Non-repudiation, and Integrity; not just Authentication.
C: A digital signature provides Authentication, Non-repudiation, and Integrity; not just Non-repudiation.
D: A digital signature provides Authentication, Non-repudiation, and Integrity; not just Integrity.Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, 2013, pp. 829-830
Krutz, Ronald L. and Russel Dean Vines, The CISSP Prep Guide: Mastering the Ten Domains of Computer
Security, John Wiley & Sons, New York, 2001, p. 151