What it means
Non-repudiation concerns evidence that supports the origin, submission, delivery, or integrity of an action or message when someone later disputes it. A digital signature can support this by binding signed data to a signing key and allowing alteration to be detected. The surrounding process still matters: how the key was associated with an identity, who controlled it, whether it was compromised, and how evidence was retained. A username in an application log is useful attribution evidence but does not automatically establish non-repudiation, human intent, or a legal conclusion.
AN ILLUSTRATIVE SCENARIO
A supplier disputes an approved order
A manufacturer needs evidence about a purchase order exchanged with a supplier. Its process retains the exact signed document, signature-validation result, relevant certificate information, receipt record, and approval context. A later reviewer checks that the signature covers the disputed version and evaluates the signer's identity and key status. If several people shared the signing credential, the signature may support that the key was used while offering much weaker evidence about which person approved the order.
Put it to work
- Define the event a later reviewer must be able to establish and the applicable assurance requirements. Specify whose identity, what exact content, and which point in the transaction need evidence.
- Use an established signing and verification process where appropriate, with controlled key custody and identity binding. Preserve the signed content and validation context rather than retaining only a screenshot of approval.
- Protect evidence over the necessary retention period and plan for certificate expiry, key compromise, and later validation. Keep duties and credentials distinct enough to support meaningful attribution.
How to check your work
Verify a test signature, then change the document and confirm validation fails. Review how the signing identity was established, who could use its key, and whether an independent reviewer can validate the retained evidence later.
Connect the ideas
- Audit trail
An append-oriented history of security-relevant actions that can be shown to a later reviewer.
- Integrity
The property that data and processes remain complete and unaltered except by authorized action.
- Identity
The record an organization uses for a person, device, or workload that can be authenticated.