Non-repudiation

related topics
{law, state, case}
{system, computer, user}
{math, number, function}

Non-repudiation refers to a state of affairs where the purported maker of a statement will not be able to successfully challenge the validity of the statement or contract. The term is often seen in a legal setting wherein the authenticity of a signature is being challenged. In such an instance the authenticity is being "repudiated".

Contents

Non-repudiation in digital security

Regarding digital security, the cryptological meaning and application of non-repudiation shifts to mean:[1]

  • A service that provides proof of the integrity and origin of data.
  • An authentication that with high assurance can be asserted to be genuine.

Proof of data integrity is typically the easiest of these requirements to accomplish. A data hash, such as SHA2, is usually sufficient to establish that the likelihood of data being undetectably changed is extremely low. Even with this safeguard, it is still possible to tamper with data in transit, either through a man-in-the-middle attack or phishing. Due to this flaw, data integrity is best asserted when the recipient already possesses the necessary verification information.

The most common method of asserting the digital origin of data is through digital certificates, a form of public key infrastructure, to which digital signatures belong. They can also be used for encryption. The digital origin only means that the certified/signed data can be, with reasonable certainty, trusted to be from somebody who possesses the private key corresponding to the signing certificate. If the key is not properly safeguarded by the original owner, digital forgery can become a major concern.

Trusted third parties (TTPs)

The ways in which a party may attempt to repudiate a signature present a challenge to the trustworthiness of the signatures themselves. The standard approach to mitigating these risks is to involve a trusted third party.

The two most common TTPs are forensic analysts and notaries. A forensic analyst specializing in handwriting can look at a signature, compare it to a known valid signature, and make a reasonable assessment of the legitimacy of the first signature. A notary provides a witness whose job is to verify the identity of an individual by checking other credentials and affixing their certification that the party signing is who they claim to be. Further, a notary provides the extra benefit of maintaining independent logs of their transactions, complete with the type of credential checked and another signature that can independently be verified by the preceding forensic analyst. For this double security, notaries are the preferred form of verification.

On the digital side, the only TTP is the repository for public key certificates. This provides the recipient with the ability to verify the origin of an item even if no direct exchange of the public information has ever been made. The digital signature, however, is forensically identical in both legitimate and forged uses - if someone possesses the private key they can create a "real" signature. The protection of the private key is the idea behind the United States Department of Defense's Common Access Card (CAC), which never allows the key to leave the card and therefore necessitates the possession of the card in addition to the personal identification number (PIN) code necessary to unlock the card for permission to use it for encryption and digital signatures. No practical solution yet exists to the digital equivalent of the problem that notaries address with physical signatures.

Full article ▸

related documents
Communications Decency Act
Antiterrorism and Effective Death Penalty Act of 1996
County Court
Martin v. Hunter's Lessee
Adrian Lamo
Court of Appeal of England and Wales
Napoleonic code
Gibbons v. Ogden
Civil and political rights
Warren Commission
Affidavit
United States Foreign Intelligence Surveillance Court
Appellate court
Proximate cause
Section 508 Amendment to the Rehabilitation Act of 1973
Antarctic Treaty System
Leading question
Procedural justice
Letter of marque
Railway Labor Act
Alien and Sedition Acts
Ex parte Merryman
Court of First Instance
Inquest (England and Wales)
William Calley
John Allen Muhammad
Dispute resolution
Ninth Amendment to the United States Constitution
Damages
Conservatorship