What Is Non-Repudiation?
Non-repudiation is the assurance that an actor cannot credibly deny an action they took or a message they sent. It answers a question the CIA triad does not directly cover: not “is this data secret and correct?” but “can we prove who did this, in a way they cannot later disown?” It is essential wherever accountability matters — payments, contracts, audit trails.
How is non-repudiation achieved?#
It rests on two guarantees working together: proof of origin and proof of integrity.
- Digital signatures bind an action to the holder of a private key. Because only they could produce it, and PKI ties the key to an identity, they cannot deny signing.
- Tamper-evident logging records who did what and when, in a form that would reveal after-the- fact editing (append-only stores, hash chaining).
| Mechanism | Provides |
|---|---|
| Digital signature | Proof a specific key holder authored something |
| Secure audit log | Proof an action occurred, resistant to editing |
| Timestamping | Proof of when it happened |
Why isn’t the CIA triad enough?#
Because confidentiality and integrity can both hold while accountability is missing. A shared admin account might keep data secret and correct, yet no one can prove which person issued a destructive command — there is no non-repudiation. This is exactly why least privilege favors individual identities over shared logins.
Non-repudiation extends the classic triad toward accountability. More at the Security Fundamentals hub.
Frequently asked questions#
What is non-repudiation in security?
Non-repudiation is the assurance that someone cannot credibly deny having performed an action or sent a message. It combines proof of origin with proof of integrity, so the actor cannot later claim "it wasn’t me" or "that’s not what I sent." Digital signatures and tamper-evident logs are the usual mechanisms.
How do digital signatures provide non-repudiation?
Because only the holder of a private key can produce a signature that the matching public key verifies, a valid signature ties the action to that key holder. Combined with public key infrastructure that binds the key to an identity, the signer cannot plausibly deny signing — the cryptography is the evidence.