Authenticity and non-repudiation are two core concepts in information security regarding the legitimacy and integrity of data transmission. Because we transmit data every day, it's important to verify the sender's origin (authentication) and ensure that during transmission, the data was not intercepted or altered in any way (integrity). When you have both authenticity and integrity, the legitimacy of the data cannot be denied, and therefore, all parties can be confident in their data security (non-repudiation).
Through safe data security practices, organizations can better manage their cybersecurity risk and protect their sensitive data against cyber attacks. This article will discuss the difference between authenticity and non-repudiation and why it is necessary to have both.
What is Authenticity in Information Security?
Authenticity validates the source or origin of data and other file transfers through proof of identity. This is important because it ensures that the message (email, payment transaction, digital file, etc.) was not corrupted or intercepted during transmission. Through authentication processes, users can verify their identities by providing specific credentials, which include:
- Login information (username and password)
- Biometric data
- Electronic or digital signatures
- Authentication tokens
- Smart cards
Because authentication methods like passwords and tokens can be hacked or lost, it has become common practice to require more than one authentication factor with either two-factor authentication (2FA) or multi-factor authentication (MFA) to eliminate password vulnerability. Having multiple factors to verify identity can limit the scope of cyber threats like malware, phishing, or brute-force attacks. Implementing additional security mechanisms on top of MFA, such as security awareness training, is crucial as modern hackers have found ways to bypass MFA.
Hashing
A common method to secure data and maintain authenticity is hashing. Hashing algorithms can code any data value set to a new randomized value. Only the parties with the hash function can decode the hashed file. If the hash values that were sent differ from the ones that were received, then the bottom-line assumption is that the file was tampered with.
MAC and HMAC
Once the message or file is sent out, a message authentication code (MAC) or hashed message authentication code (HMAC) can also be attached to protect the message integrity from cybercriminals. Both the MAC and the HMAC can be used to ensure both authenticity AND integrity in addition to hashing.
- MAC - A small value or short piece of information used to authenticate data
- HMAC - A type of MAC obtained by using a cryptographic hash function combined with a cryptographic key
However, even with MAC or HMAC attached and authenticity and integrity determined, we cannot prove non-repudiation yet. This is because using the same shared secret keys (symmetric keys or private keys) for both the sending and receiving parties during basic hashing or encryption processes still maintains some risk. If either party shares or loses their decryption key, there is enough reasonable doubt to reject the source of the data and, therefore, non-repudiation.
What is Non-Repudiation in Information Security?
Non-repudiation is a procedural, legal concept that proves the legitimacy of a message or data transfer by providing undeniable evidence of both authenticity and integrity. To establish complete data integrity and that the data was not altered or forged in any way, there are a couple of methods to do so, including asymmetric cryptography and digital certificates.
In asymmetric encryption, also known as public-key cryptography, instead of having the same set of encryption keys, there are two different keys. The sender uses a public key that belongs to the recipient to encrypt the outgoing data. The key can generate encrypted ciphertext that only the private key can decrypt.
Because the private key is inaccessible to outside parties, both the sender and recipient can be confident that the message is safe and unalterable. This method of key exchange (asymmetric) is far more secure than key transferring (symmetric).
The last step to non-repudiation is attaching an identity to the key pairs. For example, digital signatures can be used to validate the authenticity of a message while tying it to a specific user or organization. In addition, digital signatures can provide timestamps to authenticate the message further.
However, now that identities have been introduced, it's important to implement a public key infrastructure (PKI) to manage your encryption system and audit logs. Since anyone can technically access public keys, a PKI can issue digital certificates called Certification Authority (CA) to confirm the owners of each public and private key. The recipient that holds the private key can rest assured that even a man-in-the-middle-attack would be near impossible.
Authenticity vs. Non-Repudiation: Which is Best for Data Security?
Although authenticity and non-repudiation are closely related, authenticity verifies the sender's identity and source of the message, while non-repudiation confirms the validity and legitimacy of the message.
Both concepts are two of the five pillars of information assurance (IA):
- Availability
- Authenticity
- Integrity
- Confidentiality
- Non-repudiation
Only when all five pillars are taken into account can an individual or organization claim a successful cybersecurity framework. As the world transitions into a digital landscape, processes like cloud computing must practice proper computer security to protect against increasing data breach risks. Cryptographic and other crypto-mathematical processes can further protect computer systems or networks (both unsecured and secured) to maintain stronger data and message integrity.
Limitations
Because non-repudiation only determines the validity of the inbound message (not altered or modified), it's important to maintain authenticity to protect against tampering. However, even with asymmetric encryption and digital signatures, there is still the real-world possibility that the signer was involuntarily coerced or manipulated into giving up the private key or their signature.
One such solution would be to gather indisputable identification confirmation, such as biometric data. Biometric data is undeniably unique to each individual, and as biometric scanning technology continues to evolve, it may be able to remove some of the real-world limitations of secure data and message transfers.
An example of this idea was implemented by the United States Department of Defense (DoD). They created a digital smart card called the DoD Common Access Card (CAC), which included identifying information such as:
- Fingerprints
- Picture or photo ID
- Personal identification verification (PIV) certificate
- PKI certificates
- Digital signatures
- Security clearances
The CAC allowed strictly physical access to authorized locations and the ability to read encrypted emails sent over confidential, secure servers. This multi-layered security protocol used the concepts of authentication and non-repudiation to construct an impenetrable cyber defense strategy.
