CEH Cryptography and Malware Analysis Practice Question
A company wants to secure its email communications using digital signatures. Which cryptographic key does the sender use to sign the email?
⚠ Common exam trap
Watch out — candidates often confuse the roles of keys in encryption vs. signing, often selecting the sender's public key because they associate 'public' with sharing, but signing requires the private key to prove the sender's identity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Sender's private key
Digital signatures use asymmetric cryptography where the sender signs the email with their private key. The recipient then verifies the signature using the sender's public key, ensuring authenticity and non-repudiation. This is defined in standards like S/MIME (RFC 5751) and OpenPGP (RFC 4880).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Sender's public key
Why it's wrong here
The sender's public key is designed for distribution and is used by recipients to verify the digital signature, not to create it. If a sender were to sign with their public key, anyone with access to that public key could forge a signature, completely undermining the non-repudiation and authenticity guarantees that digital signatures provide. This key's function is to confirm the private key's action, not to perform it.
- ✓
Sender's private key
Why this is correct
The sender's private key is the correct cryptographic component used to create a digital signature. This unique, secret key is applied to a hash of the email content, producing a signature that proves the sender's identity and ensures message integrity. Only the legitimate sender possesses this key, thereby providing non-repudiation and guaranteeing authenticity to the recipient.
- ✗
Recipient's private key
Why it's wrong here
The recipient's private key is exclusively used by the recipient to decrypt messages that have been encrypted specifically for them using their corresponding public key. It plays no role in the sender's process of creating a digital signature, as the signature's purpose is to authenticate the sender and ensure message integrity, not to secure the message's confidentiality for the recipient.
- ✗
Recipient's public key
Why it's wrong here
The recipient's public key is primarily utilized by the sender to encrypt the email message, ensuring confidentiality so that only the intended recipient can decrypt and read it. While crucial for secure communication, this key is not involved in the digital signing process, which focuses on authenticating the sender and verifying message integrity, not on encrypting the content itself.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.