Overview - ISO/IEC 13888-2:2010 (Non‑repudiation using symmetric techniques)
ISO/IEC 13888-2:2010 specifies non‑repudiation mechanisms based on symmetric cryptography. It describes generic structures and communication-related mechanisms to create, collect and verify evidence for disputes about whether a message or action occurred. The standard focuses on non‑repudiation of origin (NRO) and non‑repudiation of delivery (NRD) using secure envelopes, message authentication codes (MACs) and tokens generated/verified by a trusted third party (TTP). Non‑repudiation is provided only within a clearly defined security policy and legal context.
Key technical topics and requirements
- Mechanisms using symmetric techniques: tokens and secure envelopes built with secret keys and MAC algorithms rather than asymmetric signatures.
- Secure envelope (SENV): SENV(y) = (y, MAC_X(y)) - data y protected by a MAC computed with entity X’s secret key.
- Generic non‑repudiation token (GNRT): GNRT = (text, SENV(y)) where the TTP creates and verifies tokens using its secret key.
- Data fields for evidence: token contents include policy identifier (Pol), service type (f), identifiers for originator and recipient (A, B), evidence generator identifiers (C, D), time fields (T, TG), optional protected data Q and an imprint Imp(m) (message hash or the message itself).
- Trusted third party (TTP): an online TTP is typically required to prevent fraudulent repudiation/accusation. The TTP must maintain keys, generate tokens, verify evidence and access reliable time sources.
- Preconditions and key management:
- Each participant must share secret keys with the TTP (and with any Delivery Authority or Time‑Stamping Authority).
- A common hash/imprint function (Imp) and a MAC function must be agreed and available to participants.
- Time stamping support may be used (TSA), and non‑repudiation policies are defined externally (see ISO/IEC 10181‑4).
- Security dependency: strength depends on chosen cryptographic algorithms, parameters and secure key management (see ISO/IEC 11770).
Practical applications and target users
Who benefits:
- Security architects and system designers building evidence-based messaging, e‑commerce, banking, or transaction systems where proof of origin/delivery is required.
- TTP/TSA implementers designing token issuance, verification and time‑stamping services.
- Legal/compliance teams specifying non‑repudiation policies for contractual or regulatory evidence requirements.
- Developers of secure messaging, workflow and payment systems that require dispute resolution evidence without relying solely on asymmetric PKI.
Typical use cases:
- Contract signing workflows that need verifiable origin and delivery logs.
- Financial message exchange where trusted logs and timestamps are required.
- Enterprise systems that prefer symmetric key infrastructures or hybrid models with TTP mediation.
Related standards
Keywords: ISO/IEC 13888‑2:2010, non‑repudiation, symmetric techniques, trusted third party, TTP, secure envelope, MAC, non‑repudiation of origin, non‑repudiation of delivery, time‑stamping, security policy.