Web of Trust Model for Public Key Encryption
Jane is working as a security professional at CyberSol Inc. She was tasked with ensuring the authentication and integrity of messages being transmitted in the corporate network. To encrypt the messages, she implemented a security model in which every user in the network maintains a ring of public keys. In this model, a user needs to encrypt a message using the receiver’s public key, and only the receiver can decrypt the message using their private key. What is the security model implemented by Jane to secure corporate messages?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests recognition of the Web of Trust model by its defining trait — users keeping a 'ring of public keys' and encrypting with the recipient's public key — with the trap being to select an encrypted transport protocol like TLS or SSL instead of a trust-distribution model.
Jane implemented the Web of Trust (WOT) model, a decentralized public-key trust framework where users maintain rings of public keys and validate one another's keys, as used in PGP. This page explains why WOT fits the scenario while SSL, TLS, and zero trust do not.
Option C (TLS) is the tempting wrong pick because learners associate message confidentiality with an encryption protocol; however, TLS is a channel-protection protocol relying on certificate authorities, not a user-maintained ring of public keys.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The described model is the Web of Trust (WOT), the decentralized trust mechanism underpinning PGP and GnuPG, where each user holds a keyring of others' public keys and messages are encrypted with the recipient's public key and decrypted only with their private key. The phrase 'ring of public keys' is the CEH textbook's signature wording for WOT, and the scenario emphasizes peer-based key exchange rather than certificate-authority validation. In WOT, trust is transitive: if you trust people who have signed a key, you extend trust to that key, forming a web rather than a hierarchy. Jane's setup — every user maintaining such a ring — matches this exactly, so D is correct.Why the Other Options Are Wrong
A zero trust network is an access-architecture concept ('never trust, always verify') governing least-privilege access controls, not a public-key encryption trust model. SSL and TLS (options B and C) are transport-layer cryptographic protocols that secure data in transit and depend on a hierarchical PKI of trusted certificate authorities to authenticate public keys — not on users validating each other's keys or maintaining keyrings. SSL is also obsolete and superseded by TLS, making both unsuitable answers to a question about a trust model.Community Comment Notes
As insaniunt explained, in WOT 'users validate the authenticity of each other's public keys, creating a decentralized trust network,' commonly used in PGP — aligning with the analysis above. LordXander confirmed the item appears in the CEH v12 question bank as item 3405 with answer D. The vote distribution was unanimous (100% D), and no dissenting rationale was offered.Exam Strategy
On CEH questions, watch for the key phrase 'ring of public keys' or decentralized peer validation — these signal the Web of Trust model, not a protocol like TLS. If an option names a trust framework (WOT, PKI, PPKI, CA hierarchy) while others name transport protocols, pick the trust framework.
Frequently Asked Questions
Why is TLS not the answer if it also encrypts messages with public keys?
TLS protects data in transit using a certificate-authority hierarchy to validate server keys; it does not involve users maintaining personal rings of public keys, which is the defining feature of WOT.
How does the Web of Trust differ from a PKI/certificate authority model?
In WOT, trust is decentralized and transitive — users sign and validate each other's keys directly. PKI uses a central trusted CA that vouches for public keys via certificates.