English
Menu

Applied Cryptography

Which of the following correctly describes the mechanism of Certificate Transparency (CT)?

  1. AA mechanism that encrypts the contents of certificates so that third parties cannot see which domain name a certificate is for
  2. BA mechanism by which, during a connection, the browser detects certificates mistakenly issued by a certificate authority on the spot and revokes them automatically
  3. CA mechanism that has issued certificates recorded in public append-only logs that anyone can view, so that improper issuance can be found afterwards
Show answer and explanation

Answer: C. A mechanism that has issued certificates recorded in public append-only logs that anyone can view, so that improper issuance can be found afterwards

In the past there were incidents in which certificate authorities were compromised or made procedural errors and issued certificates to someone other than the rightful owner. In CT, certificates issued by a certificate authority are registered in public append-only logs, made tamper-evident with Merkle trees, and the proof returned by a log (the SCT) is included in the certificate or elsewhere. Major browsers such as Chrome and Safari (as of 2025) have a policy of not accepting certificates without SCTs, and domain owners can monitor the logs to check that no certificate they do not recognize has been issued. CT does not prevent improper issuance itself; it makes issuance visible so that problems are found early.

  • A. On the contrary, CT makes certificates public, and the domain names recorded in the logs can be seen by anyone.
  • B. CT records issuance and makes it visible. Revoking a wrongly issued certificate is done by the certificate authority after it has been found.
  • C. Correct. It is a mechanism for finding improper issuance rather than preventing it.
Practice this topic Back to topic

Books on Applied Cryptography Ad

As an Amazon Associate I earn from qualifying purchases.

More Applied Cryptography questions

  1. Which of the following correctly describes a change from TLS 1.2 in TLS 1.3 (RFC 8446)?
  2. Which of the following is the correct combination of what the TLS 1.3 cipher suite TLS_AES_128_GCM_SHA256 specifies?
  3. Which of the following is a correct caution about 0-RTT in TLS 1.3 (sending "early data" together with the first message, using a pre-shared key obtained in an earlier connection)?
  4. Which of the following correctly describes mutual TLS (mTLS)?
  5. Searching for the key of an n-bit symmetric-key cipher with Grover's algorithm on a quantum computer is said to take about 2^(n/2) computations. Using this simple guideline, which of the following is closest to the security of AES-128 against quantum computers?

Comparisons in this topic