Non-repudiation

Non-repudiation is a technical property built on asymmetric cryptography and, crucially, on the surrounding trust and evidence infrastructure. A digital signature is produced by hashing the message (with a collision-resistant function such as SHA-256) and signing that hash with the signer's private key under a signature scheme such as RSA-PSS, ECDSA or EdDSA; a verifier recomputes the hash and checks it against the signature using the signer's public key. Because only the holder of the private key could have produced a signature that verifies, and because any change to the message breaks the hash match, the scheme binds a specific identity to specific content and simultaneously proves integrity. This is distinct from a Message Authentication Code (HMAC): a MAC uses a shared symmetric key, so either party could have generated it and neither can prove to a third party which one did - a MAC gives authentication but not non-repudiation.

The cryptography alone is not sufficient in law or in disputes. Non-repudiation depends on binding the key to a real-world identity, usually through a public-key infrastructure (PKI) where a certificate authority vouches for the mapping in an X.509 certificate, and on trusted timestamping (RFC 3161) so that a signature can be shown to have existed before the certificate was revoked or expired. It also depends on the signer's exclusive control of the private key; if the key is stored insecurely or shared, the "you cannot deny it" claim collapses, which is why key protection in hardware (smart cards, HSMs, secure elements) matters. Long-term validation formats such as PAdES, XAdES and CAdES embed revocation data and timestamps precisely so a signature remains verifiable years later.

In the EU the legal weight is set by the eIDAS Regulation (EU) No 910/2014. Article 25(1) forbids denying an electronic signature legal effect merely because it is electronic, while Article 25(2) gives a qualified electronic signature (QES) - one created with a qualified signature-creation device and based on a qualified certificate - legal effect equivalent to a handwritten signature, recognised across all Member States. In Denmark, qualified signatures are issued by qualified trust service providers, with the public NemLog-in signing service a common route. eIDAS was substantially amended in 2024 (eIDAS 2.0), introducing the European Digital Identity Wallet, though Article 25's core signature provisions remain.

A frequent misconception is that any electronic signature, such as a scanned image or a typed name, provides non-repudiation; without cryptographic binding and identity assurance it provides almost none. Another is conflating non-repudiation of origin (proof of who signed) with non-repudiation of receipt or delivery (proof that a party received a message), which needs a separate mechanism such as a signed acknowledgement or a trusted delivery service. Non-repudiation builds on authentication and integrity but goes further: authentication convinces the relying party at the time, whereas non-repudiation must convince a neutral third party, such as a court, after the fact.