Non-repudiation

Non-repudiation answers a question about people rather than data. Confidentiality, integrity, and availability all describe the state of information. Non-repudiation asks whether, when someone later says “that was not me”, you can prove otherwise to a standard that survives the challenge.

That bar is higher than an audit log. A log records that the system believes user X did something, which invites the obvious answers: your log is wrong, someone tampered with it, my account was used by somebody else. Non-repudiation closes those escape routes by binding the action to something only that one person controls, usually a digital signature made with a private key.

Four things have to hold together: identity (a certificate naming the key holder), integrity (a hash fixing exactly what was signed), sole control (only that person can use the key), and trusted time (a timestamp fixing when). Sole control is the one that fails in practice. A shared service account, a vendor-operated key, or a key stolen by malware means more than one party could have signed, and the denial becomes credible again.

This is also why a shared-secret MAC cannot provide it. Both parties hold the same key, so either could have produced the tag. Non-repudiation needs asymmetry: a secret held by exactly one accountable party.