3 ms·
Most (interactive) protocols have non-non-repudiation, because it's easier and faster to implement. If you wanted to tie messages to either the sender, or the r
by formerly_proven 5y ago
Most (interactive) protocols have non-non-repudiation, because it's easier and faster to implement. If you wanted to tie messages to either the sender, or the receiver, you'd need to sign them, which is way more expensive than a MAC or authenticated encryption.
- lmm 5y agoYou usually want to authenticate the sender, both to make it harder for attackers to learn anything by sending you chosen ciphertexts and because users actually want to know who they're talking to. And if you're doing that, then that authentication will be non-repudiable unless you go out of your way to make it repudiable.
- deleted 5y ago[deleted]
- tialaramex 5y agoUnless your users are the protagonist of the Hollywood movie "Memento" they already know whether they sent a message, so, you can simply arrange that both parties have the keys needed to encrypt any authentic message. The user knows they didn't send it, so the apparent sender must have. But nobody else can reach the same conclusion. That is, if you show me a message purporting to be from Steve to Jenny in a well-designed modern protocol and give me access to Jenny's cryptographic materials, I can't be sure whether it is really a message Steve sent, or merely a message Jenny forged pretending to be from Steve.