Question
A software development company wants to ensure that users can confirm the software is legitimate when installing it. Which of the following is the best way for the company to achieve this security objective?
- A. Code signing Correct
- B. Non-repudiation
- C. Key escrow
- D. Private keys
Explanation
Code signing attaches a digital signature from the publisher's certificate to the software, so the installer can verify who published it and that it has not been altered since it was signed. Non-repudiation is a property that signing provides, not the mechanism itself. Key escrow is a key-recovery arrangement, and private keys alone are an ingredient of signing rather than a way for users to confirm legitimacy.
