Non-Repudiation in Information Security

What is Non-Repudiation?

Non-repudiation is a security service that provides irrefutable evidence that a specific action was performed by a specific entity. It prevents a party from denying their involvement in a communication or transaction.

How Non-Repudiation Works

Digital Signatures — The Primary Mechanism

Python Implementation

Non-Repudiation vs Authentication vs Integrity

Key distinction: MACs provide integrity but NOT non-repudiation because both parties share the secret key (either could have created the MAC). Digital signatures provide non-repudiation because only the private key holder can create the signature.

Applications of Non-Repudiation

Email (S/MIME and PGP)

Blockchain as Non-Repudiation

Blockchain provides inherent non-repudiation through:

• Transaction signing with private keys
• Immutable distributed ledger
• Consensus-based timestamp ordering
• Public verifiability

Legal Considerations

For non-repudiation to hold legally:

1. Key management — Private key must be proven to be under sole control of signer
2. Certificate validity — Certificate must be valid at time of signing
3. Timestamp — Trusted timestamp proves when signature was created
4. Revocation checking — Key must not have been revoked at signing time
5. Algorithm strength — Cryptographic algorithms must be considered secure

Interview Questions

1. What is non-repudiation and how does it differ from authentication?

• Non-repudiation provides proof that cannot be denied by the performing party, even to a third party or in court. Authentication only proves identity to the verifying system. You can authenticate with a shared password, but that doesn't provide non-repudiation since both parties know the password.

1. Why do MACs not provide non-repudiation while digital signatures do?

• MACs use a shared secret key — both sender and receiver can create valid MACs, so neither can prove the other created it. Digital signatures use asymmetric keys — only the private key holder can sign, and anyone with the public key can verify, making denial impossible.

1. What role does a Timestamp Authority play in non-repudiation?

• A TSA provides trusted proof of when a signature was created. This is crucial because it proves the signing key was valid at that time (not yet expired or revoked), establishes the timeline of events, and prevents backdating of signatures.

1. Give an example where non-repudiation is legally required.

• Electronic contracts (eIDAS regulation in EU), financial trading confirmations (MiFID II), healthcare prescriptions (DEA requirements for e-prescribing), tax filings (IRS e-file signatures), and corporate board resolutions.

1. What happens to non-repudiation if a signer claims their private key was stolen?

• This is why key management practices matter. Organizations must demonstrate proper key protection (HSMs, PIN-protected tokens). If key theft is claimed, the timestamp becomes crucial — signatures made before reported theft may still be valid, while those after the compromise report are not.

Summary

Non-repudiation is the strongest form of accountability — it provides mathematically verifiable proof that a specific entity performed a specific action. Through digital signatures, trusted timestamps, and proper certificate management, organizations can create evidence that holds up to legal scrutiny and prevents parties from denying their actions.