What is non-repudiation?
To repudiate something is to deny you did it. Non-repudiation is evidence strong enough that such a denial isn't believable: proof that a specific person or system sent a message, approved a payment or published a file, and that the content hasn't changed since. It needs two kinds of proof together. Origin shows who performed the action, and integrity shows that what they signed or sent is exactly what you are looking at now.
How digital signatures provide non-repudiation
The main technical tool is the digital signature. The signer's software hashes the document or message, then signs that hash with the signer's private key. Anyone with the matching public key can verify the signature by hashing the content themselves and checking it against the signed value. If one character changes, verification fails.
The deciding detail is who holds which key. Only the signer has the private key, so a valid signature points to them and nobody else. A certificate issued by a trusted certificate authority binds the public key to a named person or organization, which lets a third party, such as an auditor or a court, connect the signature to an identity.
You see this wherever an action has to stick: S/MIME signed email, signed contracts and approval workflows, and code signing, where a vendor signs an update so customers can verify it and the vendor can't later deny publishing it.
What does not provide non-repudiation
- A hash alone proves a file matches a reference value, but anyone can compute a hash, so it says nothing about who made the file.
- An HMAC or other shared-key method proves the message came from someone holding the key. Both parties hold it, so either could have produced the message, and an outsider can't tell which.
- Symmetric encryption has the same problem, because two parties share one key.
- Encrypting with the recipient's public key gives confidentiality only. Anyone can do it, so it proves nothing about the sender.
Example: a disputed approval
A finance manager approves a $48,000 vendor payment in a workflow system, then says she never did. If the system recorded only user=mchen action=approve in an application log, she can argue that someone used her password or that an administrator edited the log. If the approval was signed with a key stored on her PIN-protected smart card, the signature verifies against her certificate, the signed record includes the payment details, and the claim that someone else did it becomes much harder to sustain.
Key protection decides how strong the proof is
Non-repudiation is a matter of degree. A private key kept in a file on a shared laptop invites the defense that someone else used it. A key that never leaves a smart card, a TPM or a hardware security module (HSM) is much harder to disown. Logs add supporting evidence when every person has a unique account, clocks are synchronized with NTP, and records are forwarded to a central log server or SIEM where the user can't edit them. Shared accounts undermine all of this, because the record points to a group instead of a person. Legal weight also depends on law and policy, so treat a signature as strong evidence rather than automatic proof.
Non-repudiation vs. integrity vs. authentication
Integrity means data hasn't changed. Authentication proves an identity at a point in time, such as at login. Non-repudiation combines origin and integrity in a form a third party can check later. A hash gives integrity, a login gives authentication, and only a signature made with a well-protected private key gives non-repudiation.
Non-repudiation on the CompTIA Security+ exam
Non-repudiation is one of the core concepts in SY0-801 objective 1.1, and digital signatures, the control that provides it, belong to the cryptography material in objective 1.3. Scenario wording such as the sender denies sending it, prove who approved the change, or the signer must not be able to dispute it later points to non-repudiation, and the control is a digital signature. The usual distractors are hashing, HMAC and encryption. Hashing and HMAC prove integrity but not which party acted, and encryption protects confidentiality. Accounting is also tempting: logs record who did what, but non-repudiation is the stronger property that makes the evidence hold up against a denial.