Which is the most appropriate design for authenticated debugging that lets only the manufacturer's engineers open the debug port of shipped products?

Answer: C. For a challenge containing a per-device identifier and a random number that changes every time, open the port only for that session when a response signed with the manufacturer's private key is verified

A shared password, once read out of one unit or leaked by someone involved, lets the debug ports of all products be opened. In the challenge-response approach, the device holds only the public key for verification, and the private key used for signing is kept inside the manufacturer's HSM or similar. Because the challenge includes the device identifier and a random number that changes every time, a recorded response cannot be reused on another device or in a later session. By specifying in the response how much is opened (which cores and memory) and keeping records, use can be limited to legitimate purposes such as failure analysis.

• A. A shared password works on all products once it leaks from a single unit.
• B. Merely writing it down does not stop attackers.
• C. Correct. A different response is needed for each device and each session.