A manufacturer wants to ensure that approved software is delivered securely and can be verified prior to installation on its IoT devices. Which of…

Public Key Infrastructure (PKI) is a framework that uses public-key cryptography to manage digital certificates and identities. For secure software delivery, a manufacturer uses its private key to create a digital signature for the software package. This signature is then bundled with the software. The IoT device, which has the manufacturer's public key pre-installed in a trusted root store, can use this key to verify the signature. This process confirms both the software's authenticity (it genuinely came from the manufacturer) and its integrity (it has not been altered since being signed), directly meeting the requirement for verification prior to installation.

A. Advanced Encryption Standard (AES): AES is a symmetric encryption algorithm. It provides confidentiality (secrecy) but does not inherently provide a mechanism to verify the authenticity or integrity of the software's origin.

C. Generic Routing Encapsulation (GRE): GRE is a network tunneling protocol used to encapsulate packets. It does not provide any native encryption or mechanisms for verifying the authenticity of the software payload it carries.

D. Internet Protocol Security (IPsec): IPsec secures communication at the network layer between two endpoints (e.g., a server and a device). It does not verify the integrity or authenticity of the software file itself, only the data packets in transit.

---

1. National Institute of Standards and Technology (NIST) Special Publication 800-193

Platform Firmware Resiliency Guidelines.

Reference: Section 3.2

"Protection

" states: "To detect unauthorized changes

the platform MUST be able to verify the integrity and authenticity of all protected code... This verification is typically done using cryptographically-sound techniques

such as digital signatures." This directly supports using a signature-based approach

which is a core component of PKI.

2. MIT OpenCourseWare

6.857 Computer and Network Security

Fall 2017.

Reference: Lecture 9 Notes

"Public-Key Cryptography: RSA

" explains the digital signature process: "To sign message m

Alice computes s = m^d mod n... Anyone can verify the signature by checking that s^e mod n = m." This foundational principle is what PKI uses to ensure software authenticity and integrity.

3. National Institute of Standards and Technology (NIST) Interagency Report 8259A

IoT Device Cybersecurity Capability Core Baseline.

Reference: Section 4.3

"Device Software and Firmware Integrity (SFI)

" specifies the capability: "The IoT device has a mechanism to verify the integrity of software/firmware... using a secure and trusted process." The document's notes elaborate that this is often achieved via "cryptographically signed software/firmware." PKI is the framework that enables and manages this signing process at scale.