Non-Repudiation

Part A — Multiple Choice

Q1

What does hashing ALONE prove about a message?

A. Who sent the message B. That the message was encrypted C. That the message has not been altered D. Both who sent it and that it wasn't altered

✅ Correct: C. Hashing only proves integrity — data hasn't changed. It does NOT identify the sender. For origin proof, you need a digital signature.

Q2

Alice wants to send Bob a digitally signed message. Which key does Alice use to CREATE the digital signature?

A. Bob's public key B. Alice's public key C. Alice's private key D. A shared symmetric key

✅ Correct: C — Alice's private key. The sender always signs with their OWN private key. Only Alice has her private key, so only she can create a valid signature that her public key can verify.

Q3

Bob receives a digitally signed email from Alice. Which key does Bob use to VERIFY the signature?

A. Bob's private key B. Alice's private key C. Alice's public key D. Bob's public key

✅ Correct: C — Alice's public key. The receiver verifies using the SENDER's public key. Alice's public key can decrypt the signature that was encrypted with Alice's private key.

Q4

Which mechanism provides BOTH proof of data integrity AND proof of who sent the data?

A. Symmetric encryption B. Hashing C. Access control list D. Digital signature

✅ Correct: D — Digital signature. It contains a hash (integrity) encrypted with the sender's private key (origin). Both are verified in one operation.

Q5

What does non-repudiation prevent a sender from doing?

A. Sending encrypted messages B. Denying they sent or signed a message/document C. Receiving messages from untrusted parties D. Using public key cryptography

✅ Correct: B. Non-repudiation means you cannot deny having performed an action. The digital signature provides mathematical proof that you sent the message.

Part B — Matching

Match each technique to what it proves.

TECHNIQUE

Hashing only

Digital Signature

Public Key

Private Key

PROVES

Data integrity only

Integrity + Origin

Used to verify a signature

Used to create a signature

Part C — Analysis

Q6 — Analyze

An organization emails contracts to partners. They use encryption to protect the content, but no digital signatures. A partner later disputes the terms of a contract. What security gap allowed this dispute and what would have prevented it?

A. Encryption is insufficient — they should have used hashing instead B. No non-repudiation mechanism existed — digital signatures would provide proof of origin and integrity C. The partner's system lacked antivirus software D. They should have used a VPN instead of email

✅ Correct: B. Encryption protects confidentiality but proves nothing about message content or sender after the fact. Digital signatures would have created a verifiable, non-repudiable record of exactly what was sent and by whom.

Part D — Evaluation

Q7 — Evaluate

Should an organization rely solely on hashing for non-repudiation of financial transactions? Justify your position.

A. Yes — hashing is sufficient because it proves the transaction data was not altered B. No — hashing only proves integrity, not who initiated the transaction; digital signatures are required for full non-repudiation C. Yes — hashing combined with timestamps is equivalent to a digital signature D. No — neither hashing nor digital signatures are legally recognized for financial transactions

✅ Correct: B. Hashing verifies that transaction data is unchanged, but cannot prove who initiated the transaction. An attacker could hash a forged transaction — the hash would be valid for that forged data. Digital signatures bind the transaction to a specific private key holder, providing the "who" component essential for financial non-repudiation.

Non-Repudiation Quiz

Part A — Multiple Choice

Part B — Matching

Part C — Analysis

Part D — Evaluation