Which is a core REST security design principle?

Separation of privilege is a core REST security design principle because it limits the impact of a security breach by ensuring that a single compromise does not grant access to all system resources. This principle advocates for granting only the necessary permissions for a specific task or resource. Password hashing is a security technique for protecting credentials, but it's a specific implementation detail, not a broad design principle for REST. Confidential algorithms are not a general security principle; security should not rely on the secrecy of an algorithm (Kerckhoffs's Principle). OAuth is an authorization framework, a specific protocol used for secure access delegation, not a fundamental design principle.