In this lesson,
we're going to cover non-repudiation.
Now, non-repudiation in cybersecurity is focused
on providing undeniable proof
in the world of digital transactions.
Non-repudiation is a security measure
that ensures individuals
or entities involved in a communication
or transaction cannot deny their participation
or the authenticity of their actions.
I like to think about this as the difference
between sending a standard letter in the mail
and sending one
that requires a signed receipt upon delivery.
The receiver's signature on the receipt tells us
that the recipient can't deny
that they have received that letter.
In fact, non-repudiation has been used for centuries,
even before computers were even developed or thought of.
If we look back a few hundred years or more,
kings and noblemen used to use signet rings
to imprint their unique seal onto a wax on a document
to make sure it was sealed.
This seal acted as a form of non-repudiation.
If a decree or letter bore that king's seal,
it was undeniable evidence that it was authentic
and it came from the king himself.
Now, anyone receiving this sealed document
could be confident of who sent it because only the king
or that noble person had that specific signet ring.
So they couldn't claim that the contents
of the document were not written by that person.
Hopefully, this medieval example does help you
to underscore the importance and timeless nature
of ensuring authenticity and accountability
in all of our communications and transactions
because that is what non-repudiation is all about.
Now, let's move back into the digital world
and we don't use signet rings here
but instead we use something that's more modern.
This is a digital signature.
Now, a digital signature, much like the king's signet ring,
is considered to be unique
to each user who's operating within the digital domain.
A digital signature is created
by first hashing a particular message or communication
that you want to digitally sign
and then it encrypts that hash digest
with the user's private key using asymmetric encryption.
This allows the digital signature to ensure
that a piece of information, whether it's an email
or a transaction, originated from a stated source
and hasn't been altered during its transit.
If someone attempts to refute their involvement
in the digitally signed transaction, the signature serves
as undeniable proof that they actually sent that
and the integrity of that transaction hasn't been changed
since they used their private key to create
that digital signature, and that digital signature
is made up of an encrypted hash digest.
Now, non-repudiation is important for three main reasons.
We use it to confirm the authenticity
of digital transactions.
We use it to ensure the integrity
of critical communications, and we use it
to provide accountability in digital processes.
First, we have confirming the authenticity
of digital transactions.
In the digital world,
impersonation and identity theft is so much easier
to perform than it was in person.
So it really is important that a system has the capability
to guarantee a transaction or communication's authenticity
is there to ensure that your users
can't state they didn't perform a certain action.
So if I sent a digitally signed email
to my stockbroker asking him to sell 100% of my shares,
he can be assured that it was really me who sent it
because I digitally signed it.
But if he receives an email
from me that is not digitally signed,
there is no assurance that I actually sent it.
After all, you could go out right now
and sign up for a free email account
like jasondion@yahoo.com or jasondion@gmail.com
and pretend to be somebody else pretty easily.
But you really can't fake their digital signature
because only they have their private key
that's going to be used inside of that digital signature.
Second, we have ensuring integrity.
With non-repudiation measures in place,
all the parties involved can trust
that the messages haven't been tampered with
because any alteration would break the chain
of undeniable proof.
Since non-repudiation relies on digital signatures
and digital signatures have hash values in them,
these digital signatures are used to ensure
not just non-repudiation, but also integrity.
And third, and finally, we have providing accountability.
When every action has a digital stamp
of authenticity attached to it, we can create a sense
of responsibility and accountability among our users
because they know that their actions can be traced back
to them without denial.
For example, some auto insurance companies now
have the option for people to use an app on their smartphone
that will feed their real-time driving data back
to the insurance company.
If you agree to use that tracking app,
it will tell the insurance company how fast you drive,
how quickly you change lanes, how long you wait to brake
for a stop sign and things like that.
In return for allowing them to collect this data,
you can get a potential discount on your auto insurance
if you drive within their safe driving profiles.
For many drivers, opting into this app will provide them
with accountability and remind them to drive more safely.
And because the app is installed in your smartphone,
the company knows it's you who's driving
and this provides non-repudiation
since you can unlock the phone using your face
or fingerprint to activate this app every time you log in
and start a new drive.
So remember, non-repudiation
is about ensuring undeniable proof
of your participation in a digital interaction.
When you think about non-repudiation,
I want you to think about the fact
that someone cannot say they didn't do something
because you have a method to prove that they did.
The best tool for achieving non-repudiation
really is digital signatures.
So if you hear the word non-repudiation,
immediately, I want you to start thinking
about digital signatures
to achieve a level of trustworthiness.
In the digital landscape where trust is paramount,
non-repudiation does stand out as a beacon of authenticity,
accountability, and assurance
for all of our digital transactions and messages.