I am going through a short course on security. One of the videos is talking about non-repudiation in regards to cryptography and sending messages between Alice and Bob. This video talks about how digital signatures can be used to verify the sender of a message, which I understand (Bob decrypts the message with his private key, and then has access to the certificate which contains Alice's identity and a hash that can be verified with Alice's public key). It also talks about how Alice can be assured that Bob has received the message and that, in general, the message has been received by the correct party.

It does not explain how this is possible though. I have seen some mention online that one method might be that Bob then sends a digital signature back to verify he has received the message. Is this indeed a method of doing this? Are there other methods to do this? If this method is right, how can Alice be sure that Bob isn't just randomly sending digital signature out, and has in fact seen the correct message?

  • You cannot trust the recipient. Delivery receipt should be handled only by the server. To verify public keys, use security numbers verification like in Signal.
    – defalt
    Commented Apr 30, 2021 at 13:09
  • How would the server have certainty in knowing that the recipient has received the message? Wouldn't the server also have to not trust the recipient? I looked into Signal and am I correct in saying that it is essentially a system that stores a signature of a user's public key to compare to?
    – James
    Commented Apr 30, 2021 at 15:12
  • Because server delivers it. Server doesn't need an exclusive confirmation.
    – defalt
    Commented Apr 30, 2021 at 18:13
  • But Alice also delivered it, wouldn't the server run the same risk that the message was not received as consequence of something that happened to it during transmission (as the server is basically acting as an intermediary from what I can tell)?
    – James
    Commented May 1, 2021 at 6:26
  • Errors in the transmission are handled by TCP.
    – defalt
    Commented May 1, 2021 at 8:51

4 Answers 4


PKI ensure that if the message reaches its destination it has not been altered (if signed with sender private key) and/or has not be compromissed (if crypted with recipient public key).

If the sender wants to make sure that the recipient has actually received the message, a higher level protocol must be used. For example the recipient could send a signature of the original (optionaly decrypted) message using their private key. So if the round trip:

A -> message signed with A private key -> B
A <- signature of the original message with B private key <- B

completes, then A can be sure that B has received the correct message.

If you do not set up that round trip, even with modern system where the sender can be sure that the message reaches the recipient system, you have no protection against the message being destroyed between its arrival on a machine and the moment when the human being named B could read it.

This would be more or less an implementation of what was the QSL in the early days of radio frequency message (mainly using Morse code). BTW that QSL was still in use in the 80's to ensure that a message had been received and understood (*): until the sender had not received a QSL to message number xxx they periodically try to send it again or try a phone call to know whether the recipient system was off or out of use (at least at French Met Office).

(*) as QSL to message ... had to be manually sent, it meant that somebody could read the message number and declared having understanded the full message.

  • So I could send a message which includes the signature signed by my private key all encrypted with the receiver's public key, and then once the receiver has decrypted my message and verified the signature they could send a signature back (which includes a hash of my original message) to prove to me that they had received it and that they are who they say they are? I presume this is very slow and would only be used for conversations that need to be absolutely secure?
    – James
    Commented Apr 30, 2021 at 15:20

It also talks about how Alice can be assured . . . that, in general, the message has been received by the correct party.

The message here is the information, not the encrypted blob. Alice could have encrypted the message and posted it on a billboard at Times Square, and nobody but Bob would receive the message, because only Bob have the private key to transform the encrypted blob in the message. That's what the message has been received by the correct party means. Alice does not have any way to really be assured that Bob and only Bob received the encrypted blob, and it's not really possible to design around this and use the internet. Only if Alice handed out the blob in person she could be sure of that, but in this case maybe no encryption would be needed.

Having a protocol to send back a message to Alice would end up on the Two Generals Problem: Bob sends a message back to Alice but isn't sure Alice received the message, so Alice would have to send a message back, and so on.

Alice could ask Bob to acknowledge the reception (by calling him, by asking in the message to send her a SMS, or to put a green vase on the wall), but that isn't part of PKI.


The sender is assured by implication, not through an active assurance process.

Because the PKI/certificate/signing process works, then the sender "knows" that what was sent was what was received. The receiver has the same assurance.

Because the system works, the signature can be trusted that the message was sent by Alice. If it was not the correct message, the signature would fail.

  • 1
    What part of the PKI/certificate/signature process leads to the sender "knowing" what was sent was received and not i.e. lost along the way, corrupted or intercepted? I understand that the recipient would know if the message was corrupted or modified in transit, but how is the sender assured by implication as you say?
    – James
    Commented Apr 30, 2021 at 15:17
  • There is nothing in the process to confirm if it was lost or intercepted. Those are different issues not dealt with by signatures, and isn't in your question.
    – schroeder
    Commented Apr 30, 2021 at 20:57
  • Well my question was asking how this video could claim that digital signatures ensure non-repudiation, with emphasis on how digital signatures could ensure that the sender is assured that the correct recipient has received the correct message (though in my original question I did not put emphasis on the "correct message" part, just "the message"). You mention that the sender would "know" what was sent was received, but how does the sender "know" this?
    – James
    Commented May 1, 2021 at 6:20
  • @James As answered, digital signatures cannot ensure delivery status of the message. It's like a stamp on the postcard. Once it reaches its destination no matter how, the recepient can verify it's not fake.
    – defalt
    Commented May 1, 2021 at 7:31

Digital signature cannot. Digital signature can only provide integrity protection and non-repudiation. Delivery receipts can only be assured by the server when the client polls for new messages and fetches them. Sender cannot trust the recipient for delivery confirmation. The recepient can block delivery receipt to pretend that the message was never received.

However for read receipts, sender has to rely on the recepient because the server cannot confirm to the sender that the recepient has read the message. So recepient can block read receipts. Some messengers already allow users to disable it.

How can Alice be sure that Bob has seen the correct message?

Incorrect or tampered messages aren't supposed to be processed by the client. Alice won't come to know if the message that has been tampered with has been read by Bob. Client should either throw exception to let the recipient know about the status or should request resend from the sender. This is on client's implementation.

  • So it isn't really a consideration of digital signatures to ensure non-repudiation in which the video defines it as: the recipient is sure the sender sent message, the sender is sure recipient received message? As a side question which isn't fully related to my original question, is this definition of non-repudiation considered by any other category of cryptography?
    – James
    Commented May 1, 2021 at 6:32
  • Non-repudiation ensures that the message is authored by someone you know. It has nothing to do with how it is sent and received.
    – defalt
    Commented May 1, 2021 at 7:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .