Interview Questions: Digital Signature Certificate (DSC) | PKI

Nowadays, digital signature certificates serve as the safeguard of authentication and integrity over an untrusted network. Here, we will discuss interview questions and answers on digital signature concepts.

Interview Questions: Digital Signature Certificate (DSC) | PKI

Q1. What is a Digital Signature Certificate (DSC)?

Ans: A Digital Signature Certificate (DSC) is an electronic equivalent of a physical signature. It proves your identity like an ID card and proves authentication. It is also used to access information or services on the internet. In other words, DSC is a method to validate the authenticity and integrity of electronic messages or data.

Q2. How does a Digital Signature Certificate (DSC) work?

Ans: This we can understand with the help of the example. Assume Tom wants to send electronic documents to Eric digitally. Tom and Eric have acquired digital signatures. The digital signature has two attributes related to the subscriber: public and private keys.  First, both have shared public keys with each other. Now, Tom encrypts the message with his private key and sends it to Eric. Upon receiving, Eric will use the shared public key of Tom to decrypt the message and ensure the integrity of the message. In this way, Tom can exchange messages securely by using DSC.

Q3. What is an electronic document?

Ans: An electronic document is any data that needs the computer to access, interpret, and process it. It can be an image, a drawing, or any other message which needs a computing system.

Q4. What is the difference between an Electronic Signature and a Digital Signature?

Ans: An electronic signature is similar to your physical signature in digitized form by attaching a sound or symbol to the document. The digital signature is the more secure form that assures confidentiality, integrity, authentication, and non-repudiation.

Q5. What are the different classes of Digital Signature Certificates?

Ans: Different classes of Digital Signature Certificates:

Class 1 Certificate: These certificates are issued to individuals or private subscribers. Certifying Authorities ensure the user’s name (or alias) and E-mail address of the subscriber in consumer databases.

Class 2 Certificate: These certificates are issued for both business personnel and private individuals' use. Certifying Authorities ensure that the information in the application provided by the subscriber is consistent with the information in consumer databases.

Class 3 Certificate: This certificate is issued to individuals as well as organizations. As these are high assurance certificates, Certifying Authorities issue certificates only on the subscriber's physical appearance before them and ensure the information in the application provided by the subscriber is consistent with the information in consumer databases.

Q6. How is Digital Signature Validated and Secured?

Ans: Digital signature is mainly used for assurance of authentication and integrity of received data. If data is encrypted using the public key, data can be decrypted using the private key and vice-versa. In this way, the digital signature is validated and it ensures authentication, confidentiality, integrity, and non-repudiation.

Q7. What is the Certificate Revocation List (CRL)?

Ans: Certificate Revocation List (CRL) is a list of digital certificates issued by the Certifying Authority (CA) and it contains revoked digital signatures before their scheduled expiry date. Certificates available in this list should no longer be trusted.

Q8. What does X.509 refer to as it relates to digital certificates?

Ans:  X.509 is a standard that defines the format of public key certificates. TLS/SSL also uses the same standard for defining certificates.

Q9. How Are Certifying Authorities Susceptible of Attack?

Ans: Although it is very difficult to attack Certifying Authorities, there are still some ways as mentioned below:

• Find out the private keys of CAs by reverse engineering the device.
• If CAs use short-length keys, it is susceptible to attack.

Q10. Can a digital signature be forged?

Ans: It is very difficult to forge a digital signature. Highly complex algorithms are implemented which makes it nearly impossible to forge the signature.

Q11. What is a one-time signature scheme?

Ans: In cryptography, a one-time signature scheme is a method for creating a digital signature. This type of signature can be built from any cryptographically secure one-way function and is generally used to sign a single message.

Q12. What is an Undeniable Signature Scheme?

Ans: Undeniable signature schemes, also called non-self-authenticating signature schemes, where signatures can only be verified with the consent of the signer.

Q13. What are the types of Certificates issued by CAs?

Ans: As per X.509 Certificate Policy PKI published by the Controller of Certifying Authorities, there are five types of certificates:

• Signature Certificate,
• Encryption Certificate
• SSL Server Certificate
• Code Signing Certificate
• Document Signer Certificate

Q14. Explain the role of a Certificate Authority (CA) in PKI.

Ans: A CA is responsible for issuing and verifying digital certificates. It acts as a trusted third party that validates the identity of the certificate holder before issuing a digital certificate.

Role of Certificate Authority (CA) in PKI

Certificate Issuance Certificate Verification Trust Establishment Key Pair Generation Certificate Revocation Management