SY0-301 · Question #852
Which of the following does Jane, a software developer, need to do after compiling the source code of a program to attest the authorship of the binary?
The correct answer is B. Use Jane's private key to sign the binary. A developer uses their private key to digitally sign a binary, enabling anyone with the corresponding public key to verify authorship and integrity.
Question
Which of the following does Jane, a software developer, need to do after compiling the source code of a program to attest the authorship of the binary?
Options
- APlace Jane's name in the binary metadata
- BUse Jane's private key to sign the binary
- CUse Jane's public key to sign the binary
- DAppend the source code to the binary
How the community answered
(22 responses)- A5% (1)
- B95% (21)
Why each option
A developer uses their private key to digitally sign a binary, enabling anyone with the corresponding public key to verify authorship and integrity.
Placing a name in binary metadata is trivially forgeable and provides no cryptographic proof that the binary was produced by that specific developer.
In asymmetric cryptography, a digital signature is created by encrypting a hash of the binary with the signer's private key, which only the developer holds. Any party can then use the developer's public key to decrypt and verify the signature, confirming both the identity of the author and that the binary has not been altered since signing - this is the foundation of code signing.
The public key is used to verify a signature, not to create one; signing with the public key would produce output that no party could verify using the corresponding private key.
Appending source code to a binary does not provide any cryptographic attestation of authorship and introduces no mechanism to detect tampering.
Concept tested: Code signing with private key for authorship attestation
Source: https://learn.microsoft.com/en-us/windows/win32/seccrypto/cryptography-tools
Topics
Community Discussion
No community discussion yet for this question.