Principles of Information Security: Digital Signatures and Non‑Repudiation

Digital Signatures and Non‑Repudiation

Digital Signatures & Non-Repudiation: Exam-Ready Study Guide

What This Is

Digital signatures are cryptographic tools that prove a message, document, or transaction came from a specific sender (authentication) and hasn’t been altered (integrity). Non-repudiation ensures the sender cannot later deny sending it—like a legally binding digital fingerprint. This is critical for contracts, financial transactions, software updates, and legal documents. For example, in 2020, the SolarWinds supply-chain attack exploited weak code-signing practices, allowing attackers to distribute malware disguised as legitimate software updates. Without digital signatures, organizations couldn’t verify the authenticity of their own software, leading to massive breaches across government and private sectors.

Key Terms & Concepts

• Digital Signature: A mathematical scheme that binds a sender’s identity to a message using asymmetric cryptography (e.g., RSA, ECDSA). Validated with the sender’s public key.
• Standards: PKCS #7 (Cryptographic Message Syntax), X.509 (certificate format), FIPS 186-5 (NIST’s Digital Signature Standard).

• Tools: OpenSSL, GPG, Microsoft Authenticode, Adobe Sign.

• Non-Repudiation: A security service that prevents a party from denying an action (e.g., sending an email, signing a contract). Achieved via digital signatures + trusted third parties (TTPs) like Certificate Authorities (CAs).

• Example: A CEO digitally signs a merger agreement; later, they cannot claim they didn’t sign it.

• Asymmetric Cryptography (Public-Key Cryptography): Uses a key pair—a private key (kept secret) and a public key (shared). Digital signatures use the sender’s private key to sign and the recipient’s public key to verify.

• Algorithms: RSA, DSA, ECDSA (Elliptic Curve Digital Signature Algorithm).

• Hash Function: A one-way function that converts data into a fixed-size "digest" (e.g., SHA-256). Used in digital signatures to ensure message integrity.

• Example: If a single bit of a contract changes, the hash output changes completely.

• Standards: SHA-2 (SHA-256, SHA-384), SHA-3 (NIST standard).

• Certificate Authority (CA): A trusted third party that issues digital certificates (e.g., X.509) binding a public key to an identity (e.g., a person, server, or organization).

• Examples: DigiCert, Let’s Encrypt, GlobalSign.

• Hierarchy: Root CA → Intermediate CA → End-Entity Certificate.

• Public Key Infrastructure (PKI): A framework for managing digital certificates and public-key encryption. Includes CAs, Registration Authorities (RAs), and Certificate Revocation Lists (CRLs) or Online Certificate Status Protocol (OCSP).

• Use Case: HTTPS (TLS/SSL certificates), code signing, email encryption (S/MIME).

• Timestamping: A service that proves a digital signature existed at a specific time (e.g., for legal compliance). Uses Trusted Timestamp Authorities (TSAs).

• Standard: RFC 3161 (Internet X.509 Public Key Infrastructure Time-Stamp Protocol).

• Key Escrow: A system where a third party holds copies of private keys (e.g., for recovery or law enforcement). Controversial due to privacy risks (e.g., government surveillance).

• Example: Clipper Chip (1990s U.S. government proposal, later abandoned).

• Man-in-the-Middle (MITM) Attack: An attacker intercepts and alters communications between two parties. Digital signatures mitigate this by ensuring authenticity and integrity.

• Example: Attacker swaps a legitimate software update with malware; a digital signature would detect the tampering.

• Repudiation Attack: When a sender denies performing an action (e.g., sending a transaction). Non-repudiation prevents this via digital signatures + audit logs.

• Real-World Case: In 2016, a Bitcoin exchange claimed a hacker stole funds, but non-repudiation mechanisms proved the exchange’s own employees were responsible.

• OWASP Top 10 (A02:2021 – Cryptographic Failures): Weak or missing digital signatures can lead to tampering (e.g., malicious code injection) or spoofing (e.g., fake software updates).

• Mitigation: Enforce strong algorithms (e.g., RSA-2048+, ECDSA-256) and short-lived certificates.

• MITRE ATT&CK (T1553 – Subvert Trust Controls): Adversaries bypass digital signatures by stealing private keys (e.g., via phishing) or compromising CAs (e.g., Stuxnet used stolen certificates to sign malware).

• Defense: Hardware Security Modules (HSMs) for key storage, certificate pinning.

Step-by-Step / Process Flow

How Digital Signatures Work (Technical Process)

1. Key Generation
2. The sender generates a key pair (private + public key) using an algorithm like RSA or ECDSA.

3. Tool: openssl genpkey -algorithm RSA -out private_key.pem -pkeyopt rsa_keygen_bits:2048

4. Hashing the Message

5. The sender runs the message (e.g., a contract, software binary) through a hash function (e.g., SHA-256) to create a message digest.

6. Example: sha256sum contract.pdf → a1b2c3...

7. Signing the Hash

8. The sender encrypts the hash with their private key, creating the digital signature.

9. Tool: openssl dgst -sha256 -sign private_key.pem -out signature.bin contract.pdf

10. Sending the Signed Message

11. The sender transmits:

    
    
    • The original message (e.g., contract.pdf).
    • The digital signature (e.g., signature.bin).
    • Their public key (or a digital certificate containing it).

12. Verification by Recipient

13. The recipient:
    1. Hashes the received message (using the same algorithm).
    2. Decrypts the signature with the sender’s public key to retrieve the original hash.
    3. Compares the two hashes. If they match, the signature is valid (proving authenticity + integrity).

14. Tool: openssl dgst -sha256 -verify public_key.pem -signature signature.bin contract.pdf

15. Non-Repudiation Enforcement

16. If the signature is valid, the sender cannot deny sending the message (assuming their private key wasn’t compromised).
17. Legal Weight: Many jurisdictions (e.g., eIDAS in the EU, ESIGN Act in the U.S.) recognize digital signatures as legally binding.

Common Mistakes

Certification Exam Tips

1. CISSP Trap: Management vs. Technical
2. Question: "Which of the following is the primary purpose of a digital signature?"
   • Wrong Answers: "To encrypt data" (confuses with encryption) or "To ensure confidentiality" (irrelevant).
   • Correct Answer: "To provide non-repudiation and integrity."

3. Why? CISSP tests conceptual understanding, not implementation details.

4. Security+ Trick: Algorithm Strength

5. Question: "Which algorithm is least suitable for digital signatures today?"

   
   
   • Options: RSA-2048, ECDSA-256, DSA-1024, SHA-256.
   • Correct Answer: DSA-1024 (weak key size; NIST deprecated DSA in 2016).

6. CEH Focus: Attack Vectors

7. Question: "An attacker steals a private key from a developer’s laptop. Which MITRE ATT&CK technique does this represent?"

   
   
   • Options: T1003 (Credential Dumping), T1552 (Unsecured Credentials), T1553 (Subvert Trust Controls).
   • Correct Answer: T1552 (Unsecured Credentials) → Stealing keys falls under this.
   • Follow-Up: If the attacker uses the key to sign malware, it becomes T1553 (Subvert Trust Controls).

8. PKI Hierarchy Questions

9. Question: "In a PKI, which entity issues end-entity certificates?"
   • Options: Root CA, Intermediate CA, Registration Authority (RA).
   • Correct Answer: Intermediate CA (Root CAs issue intermediate CA certs; RAs only verify identities).

Quick Check Questions

1. A company’s CFO digitally signs a wire transfer request. Later, the CFO claims they never sent it. Which security service would prevent this denial?
2. A) Confidentiality
3. B) Non-repudiation
4. C) Availability
5. D) Integrity

6. Answer: B) Non-repudiation – Ensures the sender cannot deny the action.

7. During a security audit, you find that a web server uses SHA-1 for digital signatures. What is the primary risk?

8. A) The server is vulnerable to collision attacks (SHA-1 is broken).
9. B) The server cannot encrypt traffic.
10. C) The server’s private key is exposed.
11. D) The server is using symmetric encryption.

12. Answer: A) Collision attacks – SHA-1 is cryptographically weak and should not be used for signatures.

13. An attacker intercepts a digitally signed email, modifies it, and forwards it to the recipient. What will the recipient see when verifying the signature?

14. A) The signature will appear valid.
15. B) The signature will fail verification (hash mismatch).
16. C) The email will be automatically encrypted.
17. D) The sender’s public key will be revoked.
18. Answer: B) The signature will fail – Digital signatures detect tampering via hash comparison.

Last-Minute Cram Sheet

1. Digital Signature = Private Key (Sign) + Public Key (Verify).
2. Non-repudiation = Digital Signature + Trusted Third Party (CA).
3. Hash Functions for Signatures: SHA-256 (✅), SHA-1 (❌), MD5 (❌).
4. PKI Components: CA (issues certs), RA (verifies identities), CRL/OCSP (revocation checks).
5. Key Algorithms: RSA (2048+ bits), ECDSA (256+ bits), DSA (deprecated).
6. HSMs (Hardware Security Modules) protect private keys from theft.
7. Timestamping (RFC 3161) proves a signature existed at a specific time.
8. MITRE ATT&CK T1553: Adversaries subvert trust controls (e.g., stolen code-signing certs).
9. ⚠️ Exam Trap: Digital signatures ≠ encryption (they don’t hide data).
10. ⚠️ Exam Trap: Electronic signatures (e.g., scanned signatures) ≠ digital signatures.