Which term describes the capability of an authenticator or other cryptographic module to prove that it is a root of trust and can provide reliable reporting to prove that a device or computer is a trustworthy platform?

Which term describes the capability of an authenticator or other cryptographic module to prove that it is a root of trust and can provide reliable reporting to prove that a device or computer is a trustworthy platform?

• A. Attestation
• B. Permissions
• C. Discretionary Access Control (DAC)
• D. Mandatory Access Control (MAC)

Answer: (A)

Attestation is the ability of a cryptographic module to prove it is a root of trust and to provide a trustworthy report about the device’s state. In practice, a hardware or software component with a secure root of trust collects measurements of the boot process, loaded software, and configuration, then signs these measurements into an attestation report. This report, backed by the module’s private key and a trusted certificate chain, can be verified by another party to confirm that the platform is in an expected, trustworthy state. This mechanism is what enables remote parties to trust that the device hasn’t been tampered with and that it remains in a known good configuration. The other options describe access-control concepts rather than proof of trust. Permissions are about what actions an authenticated user or process is allowed to perform. Discretionary Access Control and Mandatory Access Control are models for enforcing who can access resources, not for proving the integrity or trustworthiness of a device.

Attestation is the ability of a cryptographic module to prove it is a root of trust and to provide a trustworthy report about the device’s state. In practice, a hardware or software component with a secure root of trust collects measurements of the boot process, loaded software, and configuration, then signs these measurements into an attestation report. This report, backed by the module’s private key and a trusted certificate chain, can be verified by another party to confirm that the platform is in an expected, trustworthy state. This mechanism is what enables remote parties to trust that the device hasn’t been tampered with and that it remains in a known good configuration.

The other options describe access-control concepts rather than proof of trust. Permissions are about what actions an authenticated user or process is allowed to perform. Discretionary Access Control and Mandatory Access Control are models for enforcing who can access resources, not for proving the integrity or trustworthiness of a device.