Examkin

Question

Difficulty: MediumCryptographic Concepts and Algorithms

A software development firm is deploying an automated continuous integration pipeline to release signed application updates to enterprise clients. To meet regulatory compliance, the pipeline must ensure that the authenticity of the code publisher can be independently verified by third parties and that the publishing organization cannot repudiate the origin of the software package. Which of the following cryptographic mechanisms best fulfills these requirements?

  1. Applying a digital signature using the organization's private keyAnswer
  2. B
    Generating a Hash-based Message Authentication Code (HMAC) with a shared secret key
  3. C
    Encrypting the application binaries using AES-256 in Galois/Counter Mode (GCM)
  4. D
    Calculating an unkeyed SHA-256 cryptographic hash digest of the binary file

Answer

Applying a digital signature using the organization's private key best fulfills the requirement because asymmetric key pair signing uniquely identifies the origin and prevents non-repudiation.
A digital signature uses an asymmetric key pair where the creator signs data with their private key, and recipients verify it using the corresponding public key. Because only the owner possesses the private key, public verification guarantees both origin authenticity and non-repudiation.

Step-by-Step Solution

1
Identify the required cryptographic properties from the scenario requirements.
The scenario specifically demands origin authenticity, third-party verifiability, and non-repudiation.
Regulatory compliance mandates that the origin of compiled code cannot be denied by the author and must be verifiable by end users.
2
Evaluate symmetric vs. asymmetric mechanisms against non-repudiation constraints.
Symmetric techniques (such as shared keys or symmetric encryption) allow any keyholder to generate valid codes/hashes, failing non-repudiation.
Non-repudiation requires a unique asymmetric private key owned strictly by the publishing entity.
3
Select the appropriate cryptographic mechanism.
Digital signatures generate a hash of the binary encrypted with the publisher's private key, which anyone can verify using the matching public key.
This guarantees integrity, origin authentication, and non-repudiation simultaneously.

Key Concept

Digital Signatures and Non-Repudiation
Rate this question

Topics

Cryptographic Concepts and Algorithms

More questions from this topic