Table of Contents
Nonrepudiation
Nonrepudiation is the self-confidence that someone cannot deny the validity of something. The Nonrepudiation is a general legal concept in information security and refers to a service that provides evidence of the data’s origin and its integrity. In other words, Nonrepudiation makes it very difficult to successfully deny who / where a message is coming from and the authenticity and integrity of that message.
Digital signatures (in combination with other measures) can offer a Nonrepudiation for online transactions. It is essential to ensure that a party or communication cannot deny your signature’s authenticity in a document or send it. First. In this context, Nonrepudiation refers to the ability to ensure that a party or communication must accept the authenticity of their signature on a document or the sending of a message.
Nonrepudiation refers to a situation where the writer of a statement cannot successfully deny its authorship or the validity of an associated contract. The term is often seen in a standard-setting when the authenticity of a signature questioned. In such a case, the authenticity is “rejected.”
For example: Mallory buys a cell phone for $ 100, writes out a paper check as payment, and signs the check with a pen. He later discovers he can’t pay it and claims the check is a fake. Unfortunately, the company guarantees that only Mallory could have signed the check, so Mallory’s bank has to pay the check. This is not a rejection; Mallory can’t refuse the check.
In Security
In general, Nonrepudiation means that actions or changes attributed to a specific person. For example, a secure area can use a key card access system. In this case, Nonrepudiation would violated if the access cards were shared or if the lost and stolen cards not reported immediately. Similarly, the owner of a computer account should not allow others to use it, for example, by providing their password, and there should be a policy to enforce this. This prevents the account holder from rejecting actions taken by the account.
In digital security
In digital security, Nonrepudiation means:
- A service that proves the integrity and origin of the data.
- Authentication can be called authentic with great confidence.
The data integrity test is usually the easiest of these requirements to meet. A data hash like SHA2 generally ensures that the data not undetected. Even with this protection, data can manipulated during transport, either through a man-in-the-middle attack or through phishing. For this reason, data integrity best confirmed when the recipient already has the necessary verification information. Standard methods of providing Nonrepudiation related to digital communications or storage are Message Authentication Codes (MAC). Which are useful when communicating parties have agreed to use a shared secret they both own and digital signatures, a more powerful tool that Provides Nonrepudiation – publicly verifiable rejection.
Note that the goal is not to achieve confidentiality: in either case (MAC or digital signature), you add a label to the visible plain text message. If confidentiality also required, an encryption scheme can combine with the digital signature or some authenticate encryption form. Verifying the digital origin means that the certified/signed data is likely from someone who has the private key corresponding to the signing certificate. If the original owner does not adequately protect the key used to sign a message digitally, digital forgery can result.
Trusted Third Party (TTP)
To reduce the risk of people rejecting their signatures, the standard approach involves a trusted third party.
The two most common TTPs are forensic analysts and notaries. A forensic handwriting analyst can compare a signature to a known valid signature and assess its legitimacy. A notary is a witness who verifies a person’s identity by verifying other credentials. And affixing their attestation that the person signing is who they say they are. Having a notary public has the added benefit of keeping independent records of your transactions. Including the types of verified credentials and another signature that can verified by the forensic analyst. This double security makes notaries the preferred form of verification.
For digital information, the most common TTP used is a certification authority that issues public key certificates. Anyone can use a public key certificate to verify digital signatures without a shared secret between the signer and the verifier. The role of the certification authority is to indicate with the authority to whom the certificate belongs. This means that this person or entity has the appropriate private key.
However, a digital signature is forensically identical for both legitimate and fake uses. Someone who owns the private key can create a valid digital signature. Protecting private keys is the idea behind some smart cards, like the Department of Defense’s Common Access Card (CAC), where the key never slips off the card. This means that to use the card for encryption and digital signatures. However, A person will need the personal identification number (PIN) required to unlock it.
Disclaimer
We, the Technology Timesnow, does not aim to promote nonrepudiation in any way. All information provided in this article about the nonrepudiation has the goal of educating our readers.
