Digital trust workflow · Create the signature → verify the signature → preserve evidence of origin
What You'll Learn
- What non-repudiation means in information security and why it matters.
- How digital signatures support origin authentication, integrity, and signer non-repudiation.
- How hashing, private keys, public keys, certificates, and PKI work together.
- Why digital signatures do not provide confidentiality by themselves.
- How to identify digital-signature and non-repudiation scenarios in Security+ SY0-701 questions.
What Is Non-Repudiation?
Non-repudiation is a security service that provides evidence about the origin and integrity of data so that a third party can evaluate whether it originated from a particular entity. In public-key systems, digital signatures can support signer non-repudiation when key control, identity binding, validation, and supporting policies are trustworthy.
Non-repudiation is about creating evidence that helps establish who signed the data and whether the signed data remained intact. It is stronger than simply saying that a message came from a particular email address.
Why Non-Repudiation Matters
In a security investigation, it may not be enough to know that a file was received. An organization may also need evidence showing which entity signed it, whether the content changed after signing, and whether the signing credentials were valid at the relevant time.
Who signed?
A signature can be verified using the public key associated with the signer.
Was it changed?
Verification helps detect whether the signed data has changed.
What evidence exists?
Supporting evidence can help establish that the signer controlled the corresponding private key.
What Is a Digital Signature?
A digital signature is the result of a cryptographic operation that can provide origin authentication, data integrity, and support for signer non-repudiation when correctly implemented. In an asymmetric signature system, the private key creates the signature and the corresponding public key verifies it.
A digital signature is not simply an electronic image of a handwritten signature. It is a cryptographic value mathematically linked to the signed data and the signer's key pair.
Think private key = sign and public key = verify. The public key is not used to create the signer's digital signature.
Private Key vs. Public Key
| Key | Role in Digital Signatures | Security Requirement |
|---|---|---|
| Private key | Creates the digital signature | Must remain secret and under the signer's control. |
| Public key | Verifies the digital signature | Can be distributed, but its association with the signer must be trustworthy. |
How Digital Signatures Work
The exact mathematics vary by signature algorithm, but the Security+ mental model is consistent: the data is processed into a cryptographic digest, the sender uses the private signing key to create the signature, and the receiver uses the corresponding public key and verification process to validate it.
Start with the original document or message.
Create a message digest.
Use the private signing key.
Use the public key to verify.
The receiver can independently process the received data and validate the signature. If the signature is valid and the public key is correctly associated with the signer, the receiver gains assurance about the signed data's origin and integrity.
Why Hashing Is Part of the Process
Hashing creates a fixed-length digest from input data. A small change to the input should produce a different digest, which makes hashing useful for detecting modification. The signature operation then protects the relationship between the signed data and the signer's private key.
Hashing provides the digest; digital signing binds the signed data to the signing key. The two ideas work together but are not the same thing.
Digital Signatures and Confidentiality
One of the most important exam distinctions is that a digital signature does not provide confidentiality by itself. A signature can demonstrate authenticity and integrity, but the signed content may still be readable by anyone who can access it.
Do not confuse signing with encrypting. Encryption protects confidentiality. Digital signatures support authenticity, integrity, and non-repudiation.
| Security Function | Digital Signature | Encryption |
|---|---|---|
| Authenticity | Can support signer authenticity when validation and key association are valid. | Not its primary purpose. |
| Integrity | Can detect changes to signed data. | Encryption alone does not automatically prove a file was unchanged. |
| Non-repudiation support | Can support signer non-repudiation with appropriate infrastructure and policy. | Not its primary purpose. |
| Confidentiality | No, not by itself. | Yes, when appropriate encryption is used. |
Certificates and PKI: How Do You Trust the Public Key?
A digital signature is only useful if the receiver can correctly associate the public key with the claimed signer. This is where Public Key Infrastructure (PKI) and digital certificates become important.
A digital certificate can bind an identity or entity name to a public key. In a PKI, a Certificate Authority (CA) signs certificates to help establish that binding. During verification, the receiver can examine the certificate chain, issuer, validity period, and revocation status as applicable.
Binds an identity or entity to a public key and carries validation information.
A trusted authority that issues or signs certificates within a PKI.
Check the issuer, chain, validity dates, and revocation status as applicable.
A valid signature does not automatically mean the public key belongs to the person or organization named in the scenario. Trusting the key association is part of signature validation.
Protecting the Private Key
The private key is central to digital signatures. Anyone who gains unauthorized control of a signing private key may be able to create signatures that appear to come from the legitimate key holder.
- Restrict access to private keys using strong authentication and authorization.
- Use secure key storage where appropriate, such as a hardware security module (HSM).
- Protect key backups and recovery processes as carefully as the active key.
- Rotate or replace keys according to organizational policy and certificate lifecycle requirements.
- Revoke or otherwise invalidate affected credentials when compromise is suspected or confirmed.
For Security+ scenarios, the phrase private key compromise should immediately raise a trust concern. An attacker controlling the key may be able to generate fraudulent signatures.
Time, Timestamping, and Evidence
Some workflows need more than a valid signature. They may also need evidence about when a document was signed or when a particular state existed. Trusted timestamping services can add time evidence to digital-signature workflows for records, contracts, software release processes, and investigations.
A timestamp supports evidence about time. It does not replace signature verification, certificate validation, or private-key protection.
Real-World Non-Repudiation Scenarios
Legal and business documents: A digitally signed contract can provide cryptographic evidence about the signing identity and document integrity.
Secure email: A signed message can allow recipients to verify the sender and detect changes to the signed content.
Software distribution: A vendor can digitally sign software packages so clients can verify that the package came from the expected publisher and was not altered after signing.
Financial workflows: Digital signatures can support approval records for transactions, instructions, or controlled documents.
Compliance and audit: Signed records, certificate information, timestamps, and logging can strengthen evidence used during reviews or investigations.
Digital Signature vs. Electronic Signature
An electronic signature is a broad concept that can include many ways of expressing intent to sign electronically. A digital signature is specifically a cryptographic mechanism that uses a digital-signature algorithm and key material. A typed name, checkbox, or scanned signature can therefore be an electronic signature without being a digital signature.
| Concept | Core Idea | Cryptographic Key Pair? |
|---|---|---|
| Electronic signature | Electronic indication of signing intent. | Not necessarily. |
| Digital signature | Cryptographic proof supporting authenticity, integrity, and non-repudiation. | Yes, in asymmetric signature systems. |
Security+ Exam Traps
Private key signs; public key verifies. Do not reverse them.
Digital signatures do not provide confidentiality. Use encryption when privacy of the content is required.
Non-repudiation is not just a username being shown. Look for cryptographic signing and evidence tied to the signer.
A valid signature is not the whole trust story. Certificate and key validation can matter.
Hashing alone is not a digital signature. A hash helps detect changes; a signature also ties the signed data to signing key material.
Private-key compromise undermines trust. An attacker who controls the signing key may create fraudulent signatures.
Quick Reference: Non-Repudiation and Digital Signatures
| Concept | What It Means | Exam Clue |
|---|---|---|
| Digital signature | Cryptographic signature generated with a private key. | Authenticity, integrity, non-repudiation support. |
| Private key | Secret signing key. | Sign; protect carefully. |
| Public key | Public verification key. | Verify the signature. |
| Hash | Message digest used to detect changes. | Digest of the signed data. |
| Certificate / PKI | Helps bind an identity to a public key. | Issuer, validity, chain, revocation. |
| Encryption | Protects confidentiality. | Not the same as signing. |
Security+ Scenario Walkthrough
Suppose a software vendor publishes an update. The vendor signs the release with its private key. A customer downloads the package, validates the publisher's certificate and certificate chain, verifies the signature with the corresponding public key, and checks that the certificate is valid and not revoked according to the environment's validation rules. If the file was modified after signing, signature verification should fail.
This scenario contains several Security+ clues: private key points to signing, public key points to verification, hash relates to integrity, certificate/CA relates to trust in the public key, and signature verification failure indicates modification or another validation problem.
Further Reading and Related Guides
Practice Questions
10 scenario-based questions — expand a question to reveal its answer and explanation.
Answer
Authenticity and integrity, with support for non-repudiation when the signing system is trustworthy.
Why this matters
The private key signs; the corresponding public key verifies. Key control and identity binding are important to trust.
Answer
The private key.
Why this matters
An attacker controlling the private signing key may create signatures that appear to originate from the legitimate key holder.
Answer
A digital signature does not provide confidentiality by itself. Encryption is needed when content must remain private.
Why this matters
Signing supports authenticity and integrity; encryption protects confidentiality.
Answer
Integrity.
Why this matters
Signature verification helps detect whether the received content matches the content that was signed.
Answer
Public-key trust and identity binding, such as certificate validation and the PKI chain.
Why this matters
A mathematically valid signature is not enough if the verifier cannot establish that the public key belongs to the claimed signer.
Answer
Non-repudiation supported by a properly implemented digital-signature workflow.
Why this matters
Non-repudiation focuses on evidence supporting attribution of signed data to a specific entity.
Answer
A hash helps detect changes but does not identify or authenticate the signer by itself.
Why this matters
Digital signatures add cryptographic evidence tied to signing key material.
Answer
An attacker controlling the key may generate signatures that appear to come from the legitimate signer.
Why this matters
Private-key compromise can undermine authenticity and non-repudiation evidence.
Answer
A trusted timestamping service.
Why this matters
Timestamping adds evidence about time. It does not replace signature verification or certificate validation.
Answer
No. It can be an electronic signature, but a digital signature specifically uses cryptographic signature technology.
Why this matters
Electronic signature is a broad concept, while digital signature refers to a cryptographic signing and verification mechanism.
Exam Quiz
Lesson 01.4 — Non-Repudiation and Digital Signatures · 15 questions · 10 minutes
Non-Repudiation — Exam Simulation
15 multiple-choice questions covering digital signatures, hashing, PKI, key protection, timestamping, and Security+ scenarios.
Your timer starts when you select Start Quiz.
Question will appear here.
Quiz complete
Review the lesson and try again.
KEEP PRACTICINGLesson 01.4 — Summary
Review the essential concepts before continuing through Security+ Domain 1.0.
The private key creates the signature; the corresponding public key verifies it.
Evidence can support attribution of signed data to a specific entity when the implementation and supporting controls are trustworthy.
Hashing helps detect changes. Certificates and PKI help establish trust in the public key's association with the signer.
Digital signatures do not provide confidentiality on their own. Encryption protects content from unauthorized disclosure.
Private key = sign. Public key = verify. Encryption = confidentiality. A hash by itself does not identify the signer.
Supplementary reading: Security Frameworks: NIST, ISO 27001, and CIS Controls. This is supplementary material, not one of the ten core lessons.
