CISM Certified Information Security Manager – Question0472

Which of the following, using public key cryptography, ensures authentication, confidentiality and nonrepudiation of a message?

A.
Encrypting first by receiver's private key and second by sender's public key
B. Encrypting first by sender's private key and second by receiver's public key
C. Encrypting first by sender's private key and second decrypting by sender's public key
D. Encrypting first by sender's public key and second by receiver's private key

Correct Answer: B

Explanation:

Explanation:
Encrypting by the sender’s private key ensures authentication. By being able to decrypt with the sender’s public key, the receiver would know that the message is sent by the sender only and the sender cannot deny/repudiate the message. By encrypting with the sender’s public key secondly, only the sender will be able to decrypt the message and confidentiality is assured. The receiver’s private key is private to the receiver and the sender cannot have it for encryption. Similarly, the receiver will not have the private key of the sender to decrypt the second-level encryption. In the case of encrypting first by the sender’s private key and. second, decrypting by the sender’s public key, confidentiality is not ensured since the message can be decrypted by anyone using the sender’s public key. The receiver’s private key would not be available to the sender for second-level encryption. Similarly, the sender’s private key would not be available to the receiver for decrypting the message.