nerdexam
CompTIA

SY0-301 · Question #852

Which of the following does Jane, a software developer, need to do after compiling the source code of a program to attest the authorship of the binary?

The correct answer is B. Use Jane's private key to sign the binary. A developer uses their private key to digitally sign a binary, enabling anyone with the corresponding public key to verify authorship and integrity.

General security concepts

Question

Which of the following does Jane, a software developer, need to do after compiling the source code of a program to attest the authorship of the binary?

Options

  • APlace Jane's name in the binary metadata
  • BUse Jane's private key to sign the binary
  • CUse Jane's public key to sign the binary
  • DAppend the source code to the binary

How the community answered

(22 responses)
  • A
    5% (1)
  • B
    95% (21)

Why each option

A developer uses their private key to digitally sign a binary, enabling anyone with the corresponding public key to verify authorship and integrity.

APlace Jane's name in the binary metadata

Placing a name in binary metadata is trivially forgeable and provides no cryptographic proof that the binary was produced by that specific developer.

BUse Jane's private key to sign the binaryCorrect

In asymmetric cryptography, a digital signature is created by encrypting a hash of the binary with the signer's private key, which only the developer holds. Any party can then use the developer's public key to decrypt and verify the signature, confirming both the identity of the author and that the binary has not been altered since signing - this is the foundation of code signing.

CUse Jane's public key to sign the binary

The public key is used to verify a signature, not to create one; signing with the public key would produce output that no party could verify using the corresponding private key.

DAppend the source code to the binary

Appending source code to a binary does not provide any cryptographic attestation of authorship and introduces no mechanism to detect tampering.

Concept tested: Code signing with private key for authorship attestation

Source: https://learn.microsoft.com/en-us/windows/win32/seccrypto/cryptography-tools

Topics

#code signing#digital signatures#private key#non-repudiation

Community Discussion

No community discussion yet for this question.

Full SY0-301 Practice