0

Security newbie here.

I've read in some books the 'goals of information security', which includes non-repudiation.

My understanding of non-repudiation is that if Alice sends a message to Bob, Bob is not only convinced that the message came from Alice but he can also prove to Carol that the message indeed came from Alice (assuming Carol doesn't trust Bob)

Recently, while watching a talk of Moxie Marlinspike, I learnt that non-repudiation is not necessarily a good thing (you might want to deny authorship of a message to the world), and hence he spent time to develop this new protocol (Axolotl) which has a thing called 'plausible deniablilty' which I assume is that if Alice sends a message to Bob, Bob can be certain that it came from Alice, but Bob cannot prove to Carol that it did actually come from Alice.

Now, to a beginner, those two ideas are kind of contradictory and hence the confusion and this question (and the following sub-questions).

  • Have the goals of information security changed?
  • Are there specific usecases where either of the two (non-repudiation and plausible deniability) is useful to have? (An example would help a lot)

Thanks!

0

As in any other aspect of life, one might have different information security goals in different situations. There are situations in which you want non-repudiation and there are situations in which you would want plausible deniability. Likewise, there are situations in which you would want non-repudiation on some aspects but plausible deniability on others.

For example, let's say you've made a deal with someone and want to sign a contract with them. Such a contract would not be of much value if one of the sides of the contract could later deny signing it. Each of the sides to a contract wants non-repudiation on the other side's signature.

On the other hand, consider the case where you are a whistle-blower informing the authorities of some grave crime being committed by your employer and you're worried your employer may discover your leak. In this scenario you would want plausible deniability.

  • That makes sense. Thank you for clarifying it for me. I had assumed that it would depend on the usecase, but just wasn't sure and couldn't find supporting resources. – Abhishek Nagekar Aug 28 '17 at 15:43

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.