(An organization wants to digitally sign its software to guarantee the integrity of its source code. Which key should the customer use to decrypt the…

The process of verifying a digital signature involves using the signer's public key. The organization first creates a hash (digest) of the software and then encrypts this digest with its own private key; this encrypted digest is the digital signature. The customer, upon receiving the software, uses the organization's publicly available key to decrypt the signature. This reveals the original digest, which the customer compares to a new digest they compute from the received software. If they match, the software's integrity and origin are verified.

A. The customer’s private key is secret to the customer and is used for signing their own communications, not for verification.

C. The organization’s private key is used to create the signature and is kept secret; it is never shared with customers.

D. The customer’s public key would be used by others to verify the customer's signature, not the organization's.

- Paar, C., & Pelzl, J. (2010). Understanding Cryptography: A Textbook for Students and Practitioners. Springer. Chapter 10.1, "The Digital Signature Scheme RSA," details the verification process where the verifier uses the sender's public key.

- Katz, J., & Lindell, Y. (2014). Introduction to Modern Cryptography (2nd ed.). CRC Press. Section 12.2, "Digital Signatures," defines the verification algorithm Vrfy as taking the public key, a message, and a signature as input.