The company ABC recently contracts a new accountant. The accountant will be working with the financial statements. Those financial statements need to…

A hash algorithm generates a unique, fixed-length string of characters, known as a hash value or digest, from a given input file. If even a single bit of the file is altered, the resulting hash value will be completely different. The CFO can calculate the hash of the approved financial statement and send this hash value to the accountant through a separate, secure channel (out-of-band). The accountant can then calculate the hash of the received document using the same algorithm. If the two hash values match, it cryptographically proves that the document's integrity has been maintained and it was not modified in transit.

B. The CFO can use an excel file with a password

This primarily provides confidentiality (encryption) and access control, not integrity verification. An attacker who obtains the password could modify the file and re-protect it.

C. The financial statements can be sent twice, one by email and the other delivered in USB and the accountant can compare both to be sure is the same document

This method is unreliable. A sophisticated attacker could intercept and modify both copies identically, making a comparison useless for verifying integrity against a determined adversary.

D. The document can be sent to the accountant using an exclusive USB for that document

This is a physical transport method, not an integrity check. The USB could be intercepted and its contents altered without the recipient having a method to verify the original state.

1. National Institute of Standards and Technology (NIST). (2012). Recommendation for Applications Using Approved Hash Algorithms (NIST Special Publication 800-107 Revision 1). U.S. Department of Commerce. In Section 3

"Applications of Approved Hash Functions

" the document states

"The use of a hash function is a principal component for generating and verifying digital signatures

and for the generation of other cryptographic keys... Other applications that employ hash functions include... the detection of unauthorized data modification." (Page 4).

2. Stallings

W. (2017). Cryptography and Network Security: Principles and Practice (7th ed.). Pearson. In Chapter 11

"Cryptographic Hash Functions

" the text describes a key requirement for a hash function is that it can be used for message authentication (integrity). It details the process: "To authenticate a message

the sender computes a hash value... and sends both the message and the hash value... The receiver performs the same hash calculation on the received message and compares this value with the one received." (Section 11.2

Page 341).

3. Saltzer

J. H.

& Kaashoek

M. F. (2009). Principles of Computer System Design: An Introduction. Morgan Kaufmann. In Chapter 9

"Security and Protection

" the use of cryptographic hashes for integrity is explained: "A common way to check the integrity of a large object... is to compute a cryptographic hash of the object... If the hash matches

the verifier can be sure that the object has not been modified." (Section 9.4.3

Page 419).