Web of Trust Model for Public Key Encryption

312-50v12 By islever Editorial Last updated

Cryptography

Short answer

D Jane implemented the Web of Trust (WOT) model, where users maintain keyrings of public keys and encrypt messages with the receiver's public key for private-key-only decryption.

Question

Jane is working as a security professional at CyberSol Inc. She was tasked with ensuring the authentication and integrity of messages being transmitted in the corporate network. To encrypt the messages, she implemented a security model in which every user in the network maintains a ring of public keys. In this model, a user needs to encrypt a message using the receiver’s public key, and only the receiver can decrypt the message using their private key. What is the security model implemented by Jane to secure corporate messages?
  1. Zero trust network
  2. Secure Socket Layer (SSL)
  3. Transport Layer Security (TLS)
  4. Web of trust (WOT) Correct Answer

Key Takeaways

The question tests recognition of the Web of Trust model by its defining trait — users keeping a 'ring of public keys' and encrypting with the recipient's public key — with the trap being to select an encrypted transport protocol like TLS or SSL instead of a trust-distribution model.

Jane implemented the Web of Trust (WOT) model, a decentralized public-key trust framework where users maintain rings of public keys and validate one another's keys, as used in PGP. This page explains why WOT fits the scenario while SSL, TLS, and zero trust do not.

Common mistake: Option C (TLS) is the tempting wrong pick because learners associate message confidentiality with an encryption protocol; however, TLS is a channel-protection protocol relying on certificate authorities, not a user-maintained ring of public keys.

Expert Analysis

Why the Answer Is Correct

The described model is the Web of Trust (WOT), the decentralized trust mechanism underpinning PGP and GnuPG, where each user holds a keyring of others' public keys and messages are encrypted with the recipient's public key and decrypted only with their private key. The phrase 'ring of public keys' is the CEH textbook's signature wording for WOT, and the scenario emphasizes peer-based key exchange rather than certificate-authority validation. In WOT, trust is transitive: if you trust people who have signed a key, you extend trust to that key, forming a web rather than a hierarchy. Jane's setup — every user maintaining such a ring — matches this exactly, so D is correct.

Why the Other Options Are Wrong

A zero trust network is an access-architecture concept ('never trust, always verify') governing least-privilege access controls, not a public-key encryption trust model. SSL and TLS (options B and C) are transport-layer cryptographic protocols that secure data in transit and depend on a hierarchical PKI of trusted certificate authorities to authenticate public keys — not on users validating each other's keys or maintaining keyrings. SSL is also obsolete and superseded by TLS, making both unsuitable answers to a question about a trust model.

Community Comment Notes

As insaniunt explained, in WOT 'users validate the authenticity of each other's public keys, creating a decentralized trust network,' commonly used in PGP — aligning with the analysis above. LordXander confirmed the item appears in the CEH v12 question bank as item 3405 with answer D. The vote distribution was unanimous (100% D), and no dissenting rationale was offered.

Exam Strategy

On CEH questions, watch for the key phrase 'ring of public keys' or decentralized peer validation — these signal the Web of Trust model, not a protocol like TLS. If an option names a trust framework (WOT, PKI, PPKI, CA hierarchy) while others name transport protocols, pick the trust framework.

Frequently Asked Questions

Why is TLS not the answer if it also encrypts messages with public keys?

TLS protects data in transit using a certificate-authority hierarchy to validate server keys; it does not involve users maintaining personal rings of public keys, which is the defining feature of WOT.

How does the Web of Trust differ from a PKI/certificate authority model?

In WOT, trust is decentralized and transitive — users sign and validate each other's keys directly. PKI uses a central trusted CA that vouches for public keys via certificates.

More 312-50v12 FAQ →

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. insaniunt 👍 1 Answered D
    D. Web of trust (WOT) In a Web of Trust (WOT) model, users validate the authenticity of each other's public keys, creating a decentralized trust network. This approach is commonly used in Pretty Good Privacy (PGP) and other public-key cryptography systems.
  2. nosavotor 👍 1
    Team is this CEH method correct
  3. LordXander 👍 2 Answered D
    CEHv12 3405 - D

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Comprehensive Network Scanning Sequence

S-grade

NetBIOS Enumeration on IPv6 Networks

S-grade

Ethical Hacker Liability and Organizational Risk Acceptance

S-grade

Least Likely Social Engineering Method Based on Footprinting Data

S-grade

← Back to 312-50v12 Study Guide