Physical Address
304 North Cardinal St.
Dorchester Center, MA 02124
BS ISO IEC 13888 โ Non-repudiation Mechanisms Series
Information technology โ Security techniques โ Non-repudiation (2009/2010)
๐ BS ISO/IEC 13888 is the British Standards Institution (BSI) adoption of ISO/IEC 13888, a series under the general title Information technology โ Security techniques โ Non-repudiation, developed by ISO/IEC JTC 1/SC 27, with UK participation through IST/33 (IT security techniques). Non-repudiation uses the generation, storage, verification, and arbitration of evidence to prevent communication parties from denying actions they have performed (e.g., origin, delivery, submission, transport) โ the core mechanism for building “trusted electronic acts” in electronic contracts, payments, e-government, and forensic evidence.
๐ก Typical non-repudiation services include: non-repudiation of origin (NRO), non-repudiation of receipt (NRR), and non-repudiation of submission/delivery. Each service is realized through specific evidence forms.
1. Structure and Scope of the Series ๐
The BS ISO/IEC 13888 series is divided by underlying technology into three parts:
| Part | Standard No. | Technology Basis | Typical Evidence |
|---|---|---|---|
| Part 1 | BS ISO/IEC 13888-1:2009 | General model and requirements | Non-repudiation service framework, evidence requirements |
| Part 2 | BS ISO/IEC 13888-2:2010 | Symmetric techniques | Trusted third party (TTP) based symmetric-cipher evidence |
| Part 3 | BS ISO/IEC 13888-3:2009 | Asymmetric techniques | Digital signature and other asymmetric mechanisms |
โ ๏ธ Part 2 is the 2010 second edition incorporating the December 2012 corrigendum โ use the corrected text. Part 1 (2009, third edition) and Part 3 (2009, second edition) supersede their respective earlier editions.
2. General Model and Requirements (Part 1) ๐ง
Part 1 specifies the general model for non-repudiation services, covering:
- Types of non-repudiation services (origin, receipt, submission, delivery) and their scenarios;
- Evidence generation, transfer, storage, verification, and arbitration, plus evidence integrity and verifiability requirements;
- The roles of the trusted third party (TTP), such as certification authorities (CA) and time-stamping authorities.
The part provides a unified conceptual framework for the requirements in Parts 2 and 3.
3. Symmetric Techniques (Part 2) ๐ฅ
Part 2 specifies symmetric-technique-based non-repudiation mechanisms, characterized by reliance on a trusted third party (TTP) for evidence generation and arbitration:
- The parties share keys with the TTP, which generates non-repudiation tokens as evidence;
- It specifies the evidence request, token generation, token transfer, and verification exchanges;
- It addresses the TTP’s handling of aborts, errors, and dispute arbitration.
โ
Applicability: symmetric non-repudiation suits environments with an existing trusted intermediary (e.g., payment networks, industry clearing houses), where TTP participation lets both parties obtain arbitrable evidence without a public-key infrastructure (PKI).
4. Asymmetric Techniques (Part 3) ๐ ๏ธ
Part 3 specifies asymmetric-technique-based non-repudiation mechanisms, using digital signatures and other public-key cryptography so evidence can be verified independently by any party holding the public key:
- It specifies evidence generation (signing), verification (signature checking), and arbitration flows;
- It explains the integration of certificates, public-key infrastructure (PKI), and time-stamping services;
- It defines protocol exchanges and exception handling between originator, recipient, and TTP.
๐จ Key management note: the long-term validity of asymmetric evidence depends on private-key secrecy, certificate validity, and time-stamp trustworthiness. When archiving evidence, retain the certificate chain and time-stamps so it remains verifiable after key expiry.
5. Engineering Practice Essentials ๐
- ๐ Electronic contracts and transactions: generate non-repudiation evidence for offers, acceptances, and payment instructions to prevent later repudiation.
- ๐ง E-government and forensic evidence: combine time-stamps and digital signatures to form archivable, verifiable chains of evidence.
- ๐ Mechanism selection: choose symmetric mechanisms for sectors with a trusted intermediary; choose asymmetric mechanisms (PKI/digital signature) for open internet environments.
- ๐ Evidence archiving: retain evidence together with its certificate chain and time-stamps to meet long-term verifiability.
6. Frequently Asked Questions โ
โ Q: What is the relationship between non-repudiation and digital signatures?
A: A digital signature is a primary evidence form in asymmetric non-repudiation; non-repudiation is the objective, and the signature is a common technical means to achieve it.
A: A digital signature is a primary evidence form in asymmetric non-repudiation; non-repudiation is the objective, and the signature is a common technical means to achieve it.
โ Q: Why does symmetric non-repudiation need a TTP?
A: Both parties hold the symmetric key and could generate the evidence, making the actor indistinguishable; only a TTP signing tokens as a trusted third party yields arbitrable evidence.
A: Both parties hold the symmetric key and could generate the evidence, making the actor indistinguishable; only a TTP signing tokens as a trusted third party yields arbitrable evidence.
โ Q: How long must evidence be retained?
A: It depends on the legal and business requirements of the application. Retain for the dispute-arbitration period or the long-term period required by regulation, and keep the evidence chain, certificates, and time-stamps valid together.
A: It depends on the legal and business requirements of the application. Retain for the dispute-arbitration period or the long-term period required by regulation, and keep the evidence chain, certificates, and time-stamps valid together.
โ Q: Why is Part 1 standalone?
A: Part 1 gives the general concepts, service types, and evidence requirements for non-repudiation services, which are the foundation for understanding and applying the specific mechanisms in Parts 2 and 3.
A: Part 1 gives the general concepts, service types, and evidence requirements for non-repudiation services, which are the foundation for understanding and applying the specific mechanisms in Parts 2 and 3.