Signing & Verification Workflows
Master the IT-English vocabulary of digital signing: private/public keys, signatures, verification, non-repudiation and integrity.
0 / 25 completed
1 / 25
To create a digital signature, the signer uses which key?
The signer signs with their private key; anyone can verify with the corresponding public key.
2 / 25
Verification uses the signer's 'public key'. What does a successful verification prove?
Verification confirms integrity (unaltered) and authenticity (signed by the private-key holder).
3 / 25
What does 'non-repudiation' mean?
Non-repudiation means a valid signature binds the signer so they can't later deny signing.
4 / 25
A pipeline 'signs the artifact' before release. Why?
Signing artifacts lets downstream users verify provenance and integrity, blocking tampered builds.
5 / 25
Which sentence correctly uses 'integrity' in signing?
Integrity means the data is unaltered; any modification breaks the signature check.
6 / 25
Alice posted this PR description to the team Slack channel:
"Just signed the new user onboarding flow with JWT. I'm using the alg: HS256 signature scheme and storing the key securely in Vault."This scenario highlights the practical application of JWT signatures. Using
alg: HS256 signifies that Alice is employing a widely accepted and well-understood hashing algorithm for signature verification – it's crucial for demonstrating that the data hasn't been altered. The key point here is verifying *integrity*, not certificate creation, which is a common misunderstanding. Storing the key securely in Vault reinforces best practices for protecting cryptographic keys.7 / 25
David posted this comment on the code review of a new API endpoint:
"I've added verification using a JWT. The key is generated server-side and signed with the `HS384` algorithm. I'm confident this protects against tampering, but I'm not sure if it fully addresses replay attacks."This question tests understanding of JWT verification and common security concerns. While JWTs do provide strong authentication and data integrity protection, they don't inherently prevent replay attacks. A robust solution would require additional measures like implementing rate limiting or using a nonce (a unique, time-sensitive value) in the JWT payload to ensure requests are not repeated.
8 / 25
Sarah posted the following PR description:
"We're implementing a new API endpoint that requires client authentication. We've chosen to use HMAC-SHA256 for signing requests and storing the secret key in AWS KMS. The response headers include the signature for verification."
Which of the following statements best describes Sarah's approach to securing this API endpoint?
Sarah's strategy correctly utilizes HMAC-SHA256 for data integrity and non-repudiation – key goals of signing workflows. The use of AWS KMS to protect the secret key demonstrates responsible key management, mitigating a significant security risk if the key were exposed. Options A and C are incorrect because they underestimate the importance of signature schemes beyond basic integrity checks, while option D accurately identifies a critical vulnerability without fully explaining the corrective measures employed.
9 / 25
Team Lead: "Okay team, let's discuss the recent changes to our user registration flow. Mark, can you elaborate on why you chose HMAC-SHA512 for signing the JWT? We're aiming for a balance between security and performance."This question tests understanding of trade-offs in security design. While HMAC-SHA512 *is* a strong algorithm, Mark's response focuses on practical considerations – library integration and development time savings are often key drivers in real-world decisions. Selecting the 'strongest level' without considering broader impact isn't always optimal; developers need to balance security with other factors like performance and ease of implementation. Option A is too emphatic about strength, B ignores the important context, and D incorrectly links it to AWS KMS.
10 / 25
Mark, a senior developer, comments on a PR update regarding the new user onboarding flow: "I've chosen HMAC-SHA512 for signing the JWT. It's faster than SHA256 and provides equivalent security according to NIST recommendations.". Considering Mark's justification, what is the primary benefit he's highlighting?
Mark's comment focuses on performance – HMAC-SHA512 generates a larger signature than SHA256, which can impact processing speed. While NIST recommendations provide guidance, Mark is making a pragmatic trade-off between security and efficiency. Choosing a faster algorithm isn't inherently *bad*, but it's crucial to understand the potential implications if the key is exposed or if other security measures aren't sufficient to compensate for the reduced cryptographic strength. A naive assumption that SHA512 automatically solves all problems would be incorrect.
11 / 25
Alice posted this PR description to the team Slack channel:
"Just signed the new user onboarding flow with JWT. I'm using the alg: HS256 signature scheme and storing the key securely in Vault."This scenario highlights the practical application of JWT signatures. Using
alg: HS256 signifies that Alice is employing a widely accepted and well-understood hashing algorithm for signature verification – it's crucial for demonstrating that the data hasn't been altered. The key point here is verifying *integrity*, not certificate creation, which is a common misunderstanding. Storing the key securely in Vault reinforces best practices for protecting cryptographic keys.12 / 25
David posted this comment on the code review of a new API endpoint:
"I've added verification using a JWT. The key is generated server-side and signed with the `HS384` algorithm. I'm confident this protects against tampering, but I'm not sure if it fully addresses replay attacks."This question tests understanding of JWT verification and common security concerns. While JWTs do provide strong authentication and data integrity protection, they don't inherently prevent replay attacks. A robust solution would require additional measures like implementing rate limiting or using a nonce (a unique, time-sensitive value) in the JWT payload to ensure requests are not repeated.
13 / 25
Sarah posted the following PR description:
"We're implementing a new API endpoint that requires client authentication. We've chosen to use HMAC-SHA256 for signing requests and storing the secret key in AWS KMS. The response headers include the signature for verification."
Which of the following statements best describes Sarah's approach to securing this API endpoint?
Sarah's strategy correctly utilizes HMAC-SHA256 for data integrity and non-repudiation – key goals of signing workflows. The use of AWS KMS to protect the secret key demonstrates responsible key management, mitigating a significant security risk if the key were exposed. Options A and C are incorrect because they underestimate the importance of signature schemes beyond basic integrity checks, while option D accurately identifies a critical vulnerability without fully explaining the corrective measures employed.
14 / 25
Team Lead: "Okay team, let's discuss the recent changes to our user registration flow. Mark, can you elaborate on why you chose HMAC-SHA512 for signing the JWT? We're aiming for a balance between security and performance."This question tests understanding of trade-offs in security design. While HMAC-SHA512 *is* a strong algorithm, Mark's response focuses on practical considerations – library integration and development time savings are often key drivers in real-world decisions. Selecting the 'strongest level' without considering broader impact isn't always optimal; developers need to balance security with other factors like performance and ease of implementation. Option A is too emphatic about strength, B ignores the important context, and D incorrectly links it to AWS KMS.
15 / 25
Mark, a senior developer, comments on a PR update regarding the new user onboarding flow: "I've chosen HMAC-SHA512 for signing the JWT. It's faster than SHA256 and provides equivalent security according to NIST recommendations.". Considering Mark's justification, what is the primary benefit he's highlighting?
Mark's comment focuses on performance – HMAC-SHA512 generates a larger signature than SHA256, which can impact processing speed. While NIST recommendations provide guidance, Mark is making a pragmatic trade-off between security and efficiency. Choosing a faster algorithm isn't inherently *bad*, but it's crucial to understand the potential implications if the key is exposed or if other security measures aren't sufficient to compensate for the reduced cryptographic strength. A naive assumption that SHA512 automatically solves all problems would be incorrect.
16 / 25
Alice posted this PR description to the team Slack channel:
"Just signed the new user onboarding flow with JWT. I'm using the alg: HS256 signature scheme and storing the key securely in Vault."This scenario highlights the practical application of JWT signatures. Using
alg: HS256 signifies that Alice is employing a widely accepted and well-understood hashing algorithm for signature verification – it's crucial for demonstrating that the data hasn't been altered. The key point here is verifying *integrity*, not certificate creation, which is a common misunderstanding. Storing the key securely in Vault reinforces best practices for protecting cryptographic keys.17 / 25
David posted this comment on the code review of a new API endpoint:
"I've added verification using a JWT. The key is generated server-side and signed with the `HS384` algorithm. I'm confident this protects against tampering, but I'm not sure if it fully addresses replay attacks."This question tests understanding of JWT verification and common security concerns. While JWTs do provide strong authentication and data integrity protection, they don't inherently prevent replay attacks. A robust solution would require additional measures like implementing rate limiting or using a nonce (a unique, time-sensitive value) in the JWT payload to ensure requests are not repeated.
18 / 25
Sarah posted the following PR description:
"We're implementing a new API endpoint that requires client authentication. We've chosen to use HMAC-SHA256 for signing requests and storing the secret key in AWS KMS. The response headers include the signature for verification."
Which of the following statements best describes Sarah's approach to securing this API endpoint?
Sarah's strategy correctly utilizes HMAC-SHA256 for data integrity and non-repudiation – key goals of signing workflows. The use of AWS KMS to protect the secret key demonstrates responsible key management, mitigating a significant security risk if the key were exposed. Options A and C are incorrect because they underestimate the importance of signature schemes beyond basic integrity checks, while option D accurately identifies a critical vulnerability without fully explaining the corrective measures employed.
19 / 25
Team Lead: "Okay team, let's discuss the recent changes to our user registration flow. Mark, can you elaborate on why you chose HMAC-SHA512 for signing the JWT? We're aiming for a balance between security and performance."This question tests understanding of trade-offs in security design. While HMAC-SHA512 *is* a strong algorithm, Mark's response focuses on practical considerations – library integration and development time savings are often key drivers in real-world decisions. Selecting the 'strongest level' without considering broader impact isn't always optimal; developers need to balance security with other factors like performance and ease of implementation. Option A is too emphatic about strength, B ignores the important context, and D incorrectly links it to AWS KMS.
20 / 25
Mark, a senior developer, comments on a PR update regarding the new user onboarding flow: "I've chosen HMAC-SHA512 for signing the JWT. It's faster than SHA256 and provides equivalent security according to NIST recommendations.". Considering Mark's justification, what is the primary benefit he's highlighting?
Mark's comment focuses on performance – HMAC-SHA512 generates a larger signature than SHA256, which can impact processing speed. While NIST recommendations provide guidance, Mark is making a pragmatic trade-off between security and efficiency. Choosing a faster algorithm isn't inherently *bad*, but it's crucial to understand the potential implications if the key is exposed or if other security measures aren't sufficient to compensate for the reduced cryptographic strength. A naive assumption that SHA512 automatically solves all problems would be incorrect.
21 / 25
Alice posted this PR description to the team Slack channel:
"Just signed the new user onboarding flow with JWT. I'm using the alg: HS256 signature scheme and storing the key securely in Vault."This scenario highlights the practical application of JWT signatures. Using
alg: HS256 signifies that Alice is employing a widely accepted and well-understood hashing algorithm for signature verification – it's crucial for demonstrating that the data hasn't been altered. The key point here is verifying *integrity*, not certificate creation, which is a common misunderstanding. Storing the key securely in Vault reinforces best practices for protecting cryptographic keys.22 / 25
David posted this comment on the code review of a new API endpoint:
"I've added verification using a JWT. The key is generated server-side and signed with the `HS384` algorithm. I'm confident this protects against tampering, but I'm not sure if it fully addresses replay attacks."This question tests understanding of JWT verification and common security concerns. While JWTs do provide strong authentication and data integrity protection, they don't inherently prevent replay attacks. A robust solution would require additional measures like implementing rate limiting or using a nonce (a unique, time-sensitive value) in the JWT payload to ensure requests are not repeated.
23 / 25
Sarah posted the following PR description:
"We're implementing a new API endpoint that requires client authentication. We've chosen to use HMAC-SHA256 for signing requests and storing the secret key in AWS KMS. The response headers include the signature for verification."
Which of the following statements best describes Sarah's approach to securing this API endpoint?
Sarah's strategy correctly utilizes HMAC-SHA256 for data integrity and non-repudiation – key goals of signing workflows. The use of AWS KMS to protect the secret key demonstrates responsible key management, mitigating a significant security risk if the key were exposed. Options A and C are incorrect because they underestimate the importance of signature schemes beyond basic integrity checks, while option D accurately identifies a critical vulnerability without fully explaining the corrective measures employed.
24 / 25
Team Lead: "Okay team, let's discuss the recent changes to our user registration flow. Mark, can you elaborate on why you chose HMAC-SHA512 for signing the JWT? We're aiming for a balance between security and performance."This question tests understanding of trade-offs in security design. While HMAC-SHA512 *is* a strong algorithm, Mark's response focuses on practical considerations – library integration and development time savings are often key drivers in real-world decisions. Selecting the 'strongest level' without considering broader impact isn't always optimal; developers need to balance security with other factors like performance and ease of implementation. Option A is too emphatic about strength, B ignores the important context, and D incorrectly links it to AWS KMS.
25 / 25
Mark, a senior developer, comments on a PR update regarding the new user onboarding flow: "I've chosen HMAC-SHA512 for signing the JWT. It's faster than SHA256 and provides equivalent security according to NIST recommendations.". Considering Mark's justification, what is the primary benefit he's highlighting?
Mark's comment focuses on performance – HMAC-SHA512 generates a larger signature than SHA256, which can impact processing speed. While NIST recommendations provide guidance, Mark is making a pragmatic trade-off between security and efficiency. Choosing a faster algorithm isn't inherently *bad*, but it's crucial to understand the potential implications if the key is exposed or if other security measures aren't sufficient to compensate for the reduced cryptographic strength. A naive assumption that SHA512 automatically solves all problems would be incorrect.
Frequently Asked Questions
What does the "Signing & Verification Workflows" exercise cover?
Master the IT-English vocabulary of digital signing: private/public keys, signatures, verification, non-repudiation and integrity.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall.
How many questions are in "Signing & Verification Workflows"?
This exercise has 25 questions. Each one gives instant feedback with an explanation, so you can see exactly why an answer is right or wrong.
Do I need to create an account to save my progress?
No account is required. The progress bar and score are tracked in your browser for the current session -- the exercise is designed to be a quick, repeatable drill rather than something you resume later.
What happens if I get an answer wrong?
You'll see the correct answer highlighted immediately, along with a short explanation of why it's correct. Wrong answers aren't penalized beyond your score, and you can keep going through every question.
How is this exercise different from reading an article?
Articles explain vocabulary and concepts through prose, while exercises like this one are interactive drills -- multiple-choice questions -- that test and reinforce your recall of specific terms and phrasing.
Can I retry this exercise?
Yes -- use the "Try again" button on the results screen to reset your score and go through all the questions again from the start.
Where can I find more Cryptography & PKI exercises?
Browse the full Cryptography & PKI hub for related drills, or check the site-wide exercises index for other IT English topics.
Is this exercise suitable for beginners?
This exercise assumes basic familiarity with IT terminology. If a term feels unfamiliar, check the site Glossary for a plain-English definition before attempting the questions.
How often is new content like this published?
New exercises are added regularly across all categories, alongside new vocabulary sets and articles. Check back on the exercises hub to see what's new.