What is Non-repudiation in information assurance?

Answer 1

Non-repudiation is the inability to deny sending a message, and is usually accomplished via digital signatures or a trusted third party (TTP).

If the signature is known to belong to the sender, then we can assume that any message sent using that signature was sent with the knowledge of the sender. Therefore, the sender can not later say, "I never sent a resignation letter" when we have a digitally signed message saying otherwise. This method is common with asymmetric (public key) cryptography.

When using a TTP, the sender will send a message (signed or not) to a third party which the sender and receiver have previously agreed upon, the TTP then forwards the message to the final recipient(s). This method of transmission is generally used with symmetric (private key) cryptography. Because the TTP has received the message, they essentially act as witnesses, so the sender can not deny having sent a message.

The caveat with non-repudiation is that we assume the keys have not been compromised - but that's another discussion. The mechanics of how these forms of cryptography work can be found elsewhere on this site, or at sites dedicated to IA, cybersecurity, and cryptography.

Answer 2

Non-repudiation in information assurance refers to the ability to prove that a specific individual took a particular action, such as sending a message or conducting a transaction, and that they cannot deny having done so. It provides assurance that the sender cannot later deny their involvement in the communication or transaction. Non-repudiation mechanisms like digital signatures and audit trails help ensure accountability and trust in electronic transactions.