Aspects of computer security: Non-repudiability

This is the fifth and last post in the series about computer security, and the final topic is

6. Non-repudiability —- Is there an undeniable connection between users and the data they created?

The issue here is whether the recipient can hold the sender accountable for the information sent — that is, the sender can not repudiate the data.

Non-repudiability is important for business and legal transactions. If you place an order for merchandise, the merchant must be sure that you can’t later claim not to have placed the order (and, thus, refuse to honour the payment). If a lawyer responds to a message from the court, both sides require non-repudiation: the lawyer must know that the court can’t deny what it sent, and the court must know that the lawyer can’t deny the response.

Happily, our common mechanisms to ensure privacy and integrity will also work to ensure non-repudiability. We can use digital signatures if privacy isn’t needed, and full encryption if we want to make the communication private as well.

In current practice, we usually use an asymmetric mechanism to handle online purchases. When you place an order online, your browser uses TLS or SSL to establish encrypted communication with the company’s web server. That process usually verifies the identity of the company, but does not verify your identity. So it establishes non-repudiability only in one direction: the company can’t deny that it acknowledged the order. To establish non-repudiablity in the other direction, the company’s web site has you athenticate — sign in — before you can place the order. Once you’ve signed in through encrypted communication, you can’t repudiate the order, either, and privacy and integrity of your payment is ensured by the encryption.

Of course, all discussion of encryption and digital signatures in this series assumes that the encryption techniques and algorithms used are current and sufficiently strong, and are used properly. That’s usually the case, but there are weak and compromised algorithms that are still sometimes used on the Internet. Your best defense against that is to make sure you’re using a current web browser, and that you’re keeping the browser and the operating system (Windows, MacOS, Linux) updated regularly. Firefox 2.0 no longer supports older, flawed versions of SSL, and Internet Explorer 7 has those old versions disabled by default (but IE 6 will still use the obsolete SSL 2.0 unless you turn it off yourself). Stay up to date.