📖 Story 📚 Glossary 🗺️ Concepts 💡 Examples 🃏 Flashcards ✅ Quiz 🎯 Tricks
Chapter 3 · Non-Repudiation

The Contract Dispute

Alice sends Bob a job offer. Weeks later, Bob claims the salary was different. Can Alice prove exactly what was sent — and that she sent it?

The Denied Email

Alice, HR Director at TechVentures, emailed Bob a formal employment offer: "You're hired, Bob. Starting salary: $75,000." Two weeks later, Bob accepted — but then told legal he had received an offer for $95,000. "Check the email," he insisted. "That's what it said."

Alice was certain of what she had sent. But Bob claimed the message had been altered in transit — or that Alice was misremembering. Without a mechanism to prove the exact content and origin of the message, neither side could prevail.

"This," said the company's security consultant, "is exactly why we need non-repudiation."

💡 Non-Repudiation Defined Non-repudiation ensures that a party cannot deny having performed an action — sending a message, signing a document, executing a transaction. It provides two proofs: proof of integrity (data wasn't changed) and proof of origin (data came from a specific sender).

The Hash: A Digital Fingerprint

The consultant explained: "Before Alice sent the email, if she had run a hash function on its content, that would have created a unique fingerprint of the exact message — down to every character, space, and punctuation mark."

"Like a fingerprint?" Bob's lawyer asked.

"Exactly. A hash — also called a message digest — is a fixed-length string calculated from the data. Change even a single character in the original message, and the hash becomes completely different. It's mathematically impossible to produce the same hash from different content."

The consultant showed an example: "Consider an encyclopedia of 8.1 megabytes. Hash it. Now change one letter somewhere in those 8 million characters. The new hash is completely different — even though the file size barely changed. The hash tells you immediately: something changed."

⚠️ Important Limitation Hashing alone proves that data hasn't changed — but it does not prove who sent it. Anyone could hash a document. You need the next step for that.

The Digital Signature: Combining Integrity and Identity

"To prove Alice sent the exact message," the consultant continued, "we use a digital signature. Here's how it works in practice."

"Alice's email software would have hashed the message content first. Then it would have encrypted that hash using Alice's private key — a cryptographic key that only Alice possesses. The result, the encrypted hash, is Alice's digital signature. It gets attached to the email alongside the plaintext message."

"When Bob receives it, he uses Alice's public key — available to anyone — to decrypt the signature. This gives him the original hash. He then hashes the message he received himself and compares the two hashes."

The lawyer leaned forward: "So if the hashes match..."

"The message is exactly what Alice sent," the consultant confirmed. "And because only Alice's private key could have created that signature, we know it came from Alice. That's non-repudiation: proof of integrity AND proof of origin. Alice cannot deny sending it. Bob cannot claim it said something different."

🔐 Digital Signature Process

  • Step 1: Sender hashes the plaintext message → creates a message digest
  • Step 2: Sender encrypts the hash with their private key → creates the signature
  • Step 3: Sender transmits plaintext + digital signature
  • Step 4: Receiver decrypts signature with sender's public key → recovers original hash
  • Step 5: Receiver hashes the received plaintext → creates a new hash
  • Step 6: Compare hashes — if they match, integrity + origin are verified

The Evidence is Undeniable

TechVentures updated its email policy to require digital signatures on all employment communications. Three months later, a similar dispute arose — this time with a different candidate. The security team retrieved the original signed email and ran the verification in under 30 seconds. The hashes matched perfectly. The signed offer said $75,000.

The candidate withdrew the claim. Alice smiled. "Non-repudiation," she said. "You can't take it back."

✅ The Core Lesson Non-repudiation = Hashing (integrity) + Digital Signature (origin). The private key signs, the public key verifies. Anyone can verify — no one can forge the sender's signature because no one else has their private key.

📚 Continue Learning

📚 Glossary 🗺️ Process Diagram 💡 Examples 🃏 Flashcards ✅ Quiz