Questions tagged [non-repudiation]

Non-repudiation is the ability to prevent an identified individual from repudiating a specific action or communication associated with that individual.

Filter by
Sorted by
Tagged with
2
votes
1answer
93 views

Sign a document as created with an authorized software build

I'm creating some software that essentially enforces a specific process for creating specific documents, which protects them from being challenged later. Afterwards, the file is signed with the user'...
1
vote
1answer
40 views

2fa attestation object for non-repudiation

I am reading on digital signatures: A valid digital signature gives a recipient reason to believe that the message was created by a known sender (authentication), that the sender cannot deny ...
0
votes
1answer
233 views

Why is it recommended to use GCP service accounts vs user accounts?

I've recently started some work on Google Cloud Platform (GCP) and while developing the auth strategy for my company, I've repeatedly come across the recommendation to use service accounts for ...
2
votes
4answers
291 views

Are there any reasons to add payload signature to a rest API with mutual TLS?

We have a B2B Rest API with Client Certificate authentication. Are there any reasons to add also a payload signature check to this API? I'm seeing many service providers which add a digital signature ...
4
votes
2answers
627 views

Difference between non-repudiation and plausible deniability

I've read in some books the 'goals of information security', which includes non-repudiation. My understanding of non-repudiation is that if Alice sends a message to Bob, Bob is not only convinced ...
0
votes
1answer
731 views

If non-repudiation is impossible why do digital signature exist

Since non-repudiation is impossible to achieve purely by software why do digital signature exists? Let me clarify a bit (this part is from eschaefe book pg 64): 1. When B connects to website A he ...
2
votes
1answer
284 views

How to implement a digital signature for 21 CFR Part 11 for non repudiation

I would like to know what is the best way to implement a digital signature to achive Non-Repudation to acomplish 21-CFR-Part11-SubpartC-11.100.part-c. Anybody has implemented this for 21 CFR 11? Non ...
2
votes
1answer
316 views

Can I guarantee non-repudiation with this authentication protocol?

I have read that a symmetric key cannot guarantee non-repudiation, but in Mark Stamp's book "Information Security: Principles and practice", he gives this strong mutual authentication protocol: This ...
38
votes
2answers
3k views

How to prove that a file was not created in advance

Sometimes we need to prove that a file was not created in advance - a good example is warrant canaries. The person releasing them may have been forced to sign the file with a future timestamp. For ...
2
votes
2answers
267 views

Can CA certificate be spoofed on the browser level?

Can a certificate be spoofed at the browser level? Meaning I go click the LOCK image in my url bar and it shows a valid certificate from VeriSign but somehow the attacker spoofed that information. I'm ...
0
votes
1answer
909 views

Difference between interception, spoofing, falsification and repudiation [closed]

In very layman's terms AFAIK security threats are classified into four broad categories namely Interception or Snooping or Sniffing Spoofing Falsification and Repudiation I could get few related ...
1
vote
3answers
949 views

How can HelloSign be secure without any authentication? [duplicate]

[Note: This is not a duplicate of Are documents truly "signed" by DocuSign?. That page does not have an answer to the specific question I am asking in the final paragraph, below. This page, ...
3
votes
1answer
321 views

How does choosing where a password is stored affect non-repudiation? (or private key storage)

Password managers, and numerous tools have been created to store end-user secrets over the years. This proliferation has resulted in a hazy mix of opportunities to improve security. In short, I ...
3
votes
3answers
129 views

Is there a way to prove authorship in a shared repository?

Say, we have a number of people working on some kind of collaborative effort (such as a research paper or a software project) that is committed into a shared repository. However, a certain subset of ...
65
votes
9answers
21k views

Proving creation time/date of a screenshot

I have to produce a screenshot of a web page, and want to make sure others will know without any doubt that this screenshot has been produced today. That is, I would like to embed today's date in the ...
2
votes
1answer
105 views

what is worth a digital signature based on email address only? [closed]

I have noticed that most digital signature providers do not try to certify anything but an e-mail address, while it is quite easy to create an email address without disclosing any personal information....
1
vote
2answers
5k views

Does SSL/TLS provide non-repudiation service?

I understand that SSL/TLS provides confidentiality and integrity. But does it provide non-repudiation? I read in one book it does not. But I wonder why? What does it mean? If it means Alice can ...
3
votes
3answers
247 views

Authenticity of PDF document printed from Word

My MS Word Add-In generates PDF preview of DOCX file on client PC and uploads both files to server. I cannot generate PDF on server. Is there any way to make sure that the PDF is the printed version ...
2
votes
3answers
318 views

How can Alice and Bob prove that they share a file?

Carl asks Alice and Bob if they have a file f such that for a secure cryptographic hash function h, h(f) = K. Both claim to have f, but they can't show the file. Carl doesn't believe them. He can ...
2
votes
2answers
2k views

HMAC and non-repudiation

This was a question on an exam: Two persons are using a one way communication channel and the HMAC functionality (concretely HMAC-SHA1). Choose the correct statement below: 1) We can prove who the ...
7
votes
2answers
492 views

How do I release a self made program without it being tracked back to me?

For clarification, I am looking for the best way to release this program anonymously, not how to remain anonymous and such in general life (that is a different -already answered- question). I've ...
1
vote
0answers
64 views

Is it fair to say that lack of client-authentication in TLS implies no requirement of non-repudiation?

In an https context, if a server does not send a CertificateRequest message, is there any other way it can require non-repudiation from the client?
3
votes
2answers
539 views

Does Non Repudiation offer proof of receipt ?

I understand that non repudiation intends to provide a mechanism that reliably proves that the sender of a message cannot deny sending the message. But does it also provide similar mechanisms to ...
3
votes
2answers
510 views

Does SMIME differ from TLS, PGP, DMARC signature, or a Portal Encrypted email message in terms of legal non-repudiation?

I'm interested in protecting email messages from NSA-style snooping, but don't want to incur additional legal risk in doing so. In other words, does SMIME encryption and/or signing cause a given ...
1
vote
3answers
508 views

Non-Repudiation that can Never be Proven

I understand that non-repudiation is based upon public key cryptography and the principle of only the sender knowing their own private key. However, what is a condition, if any, of non-repudiation ...
5
votes
2answers
739 views

TLS with non-repudiation; what happened with 'TLS Sign'?

TLS Sign was proposed as an IETF Draft in June 2007. I have not found further information, besides that the draft expired in November 2007. Can someone tell me what happened with this extension or ...
3
votes
1answer
438 views

How online document signing services guarantee non-repudiation?

There is a number of services online like RightSignature or SignHub that will let you sign online legally binding documents. I understand how documents can be signed digitally and this can guarantee ...
1
vote
1answer
1k views

Secure API access over SSL using oauth token

On the project that i'm currently working, we authenticate the clients by username and password. In this system each user has a key which is calculated from his password. However, we want to provide ...
8
votes
3answers
5k views

Is “non-repudiation” automatically proven, given the other three tenets of info security?

Just to say it, the four tenets are: Confidentiality - The message the recipient gets can be proven not to have been read by anyone else since it was encoded. Integrity - The message the recipient ...
6
votes
2answers
2k views

What security standards and regulations are in place for bank ATM?

Are there any international or US mandated standards and regulations that apply to communications between automatic teller machines and bank's central office? Are banks or ATM operators subjected to ...
1
vote
1answer
159 views

Ciphertext for email vs Ciphertext for database

Let's say Bob wants to send a message to Alice. This communication requires to achieve confidentiality, integrity, proof of origin, non-repudiation. Therefore we can use this cipher-text: ciphertext =...
10
votes
2answers
16k views

When using symmetric key encryption, do we need to sign?

Say we're using a shared key between two parties, that has been distributed using public key encryption, is it still necessary to sign any data that's encrypted using the shared key? Or is it enough ...
41
votes
5answers
58k views

What is the difference between authenticity and non-repudiation?

I'm new to infosec and doing some reading. Not surprisingly one starting point was wikipedia. In this article, authenticity and non-repudiation are listed as 2 separate 'Basic concepts'. My ...
5
votes
4answers
1k views

Non-repudiation in Exchange/Outlook without Digital Signatures

Scenario: Acme Corp. needs to collect evidence to support their side of a case in court. Part of this evidence may include e-mail messages. Certain employees who do not have administrative access ...
43
votes
5answers
43k views

How to achieve non-repudiation?

If I have a message that I need to send to another person, how do I achieve non repudiation ? Is digitally signing the message sufficient ?