Question 90

Explanation

Non-repudiation means ensuring that the sender cannot later deny having sent the message. Digital signatures provide an undeniable match between sender and digital signature. We can think of a digital signature as a Message Digest encrypted with an asymmetric key: first, the message hash is encrypted using the sender's private key; then, the message (possibly encrypted) previously encrypted message hash; finally, the recipient decrypts the signature with the sender's public key, and transfers the decrypted content to the same cryptographic hash. Non-repudiation is guaranteed because, if the output of the hash matches the decrypted hash, then the recipient knows that the message is not forged, and that no one else but the sender could have created that signature and sent that message (see ISC2 Study Guide, Domain 1).

A Virtual Private Network (VPN) creates a secure tunnel between endpoints, thereby ensuring confidentiality. However, without a digital signature, an attacker could still send a message over a secure channel and then deny having sent it.

Passwords are a mechanism for authentication, and are not typically used for non-repudiation. Some applications ask the sender to enter a password previously sent by the receiver to sign a message.

Finally, encryption is the cryptographic transformation of data in order to conceal its original meaning. This concept is distinct from non-repudiation. Consider the scenario where we may need to guarantee the non-repudiation of a plain (that is, non-encrypted) message.