Examkin

Question

Difficulty: MediumCIA Triad and Non-Repudiation

A hospital network requires attending physicians to electronically sign controlled substance prescriptions. The security engineering team mandates the use of asymmetric key digital signatures on hardware security tokens rather than hash-based message authentication codes (HMACs) utilizing a shared key between the hospital system and the pharmacy portal. Which of the following primary security concepts explains why asymmetric digital signatures are required for this deployment?

  1. Non-repudiation, because the private key is uniquely held by the individual physician, preventing them from denying that they issued the prescription.Answer
  2. B
    Integrity, because symmetric HMAC algorithms cannot detect unauthorized alterations made to the prescription payload during transit.
  3. C
    Confidentiality, because asymmetric signing encrypts the prescription payload to prevent unauthorized eavesdropping by intermediate nodes.
  4. D
    Authorization, because hardware tokens grant role-based access permissions to prescribe restricted medical substances.

Answer

Non-repudiation, because the private key is uniquely held by the individual physician, preventing them from denying that they issued the prescription.
Asymmetric digital signatures provide non-repudiation because the signing key (private key) is uniquely held by a single individual. Unlike symmetric HMAC mechanisms where multiple endpoints share the same key and either could generate a valid message authentication code, asymmetric signatures cryptographically bind the action to one specific key holder.

Step-by-Step Solution

1
Analyze the difference between symmetric HMAC and asymmetric digital signatures regarding key ownership.
HMAC relies on a secret key shared between parties, whereas asymmetric signing utilizes a private key known only to the signer.
When a shared secret is used, either party possessing the key could generate the authentication tag, preventing single-party proof of origin.
2
Identify the specific security principle that prevents an originator from disowning an action.
Non-repudiation ensures that an individual cannot deny the authenticity of their signature or transaction.
Because the private key resides exclusively on the physician's hardware token, a valid signature serves as undeniable proof of authorship.

Key Concept

Non-repudiation via Asymmetric Digital Signatures
Estimated Time:1m 30s
Rate this question

Topics

CIA Triad and Non-Repudiation

More questions from this topic