Editing Non-repudiation (section)

==Trusted third parties (TTPs)==
To mitigate the risk of people repudiating their own signatures, the standard approach is to involve a [[trusted third party]].<ref>{{Cite book|last1=Zhou|first1=Jianying|last2=Gollmann|first2=Dieter|title=Advances in Cryptology — ASIACRYPT '96 |chapter=Observations on non-repudiation |date=1996|editor-last=Kim|editor-first=Kwangjo|editor2-last=Matsumoto|editor2-first=Tsutomu|chapter-url=https://link.springer.com/chapter/10.1007/BFb0034842|series=Lecture Notes in Computer Science|volume=1163|language=en|location=Berlin, Heidelberg|publisher=Springer|pages=133–144|doi=10.1007/BFb0034842|isbn=978-3-540-70707-3}}</ref>

The two most common TTPs are [[forensic analyst]]s and [[notary|notaries]]. A forensic analyst specializing in handwriting can compare some signature to a known valid signature and assess its legitimacy. A notary is a witness who verifies an individual's identity by checking other credentials and affixing their certification that the person signing is who they claim to be. A notary provides the extra benefit of maintaining independent logs of their transactions, complete with the types of credentials checked, and another signature that can be verified by the forensic analyst. {{citation needed|reason=most US states do NOT require such a journal, NO US states require keeping a copy of the document or even inspecting it (and some make this illegal), and NO US state requires observation of a specific document/specific proof of identity [I am a Notary]|date=July 2018}}

For digital information, the most commonly employed TTP is a [[certificate authority]], which issues [[public key certificate]]s. A public key certificate can be used by anyone to verify [[digital signature]]s without a shared secret between the signer and the verifier. The role of the certificate authority is to authoritatively state to whom the certificate belongs, meaning that this person or entity possesses the corresponding private key. However, a digital signature is forensically identical in both legitimate and forged uses. Someone who possesses the private key can create a valid digital signature. Protecting the private key is the idea behind some [[smart card]]s such as the [[United States Department of Defense]]'s [[Common Access Card]] (CAC), which never lets the key leave the card. That means that to use the card for encryption and digital signatures, a person needs the [[personal identification number]] (PIN) code necessary to unlock it.<ref>{{Cite web |title=PIN Policies |url=https://docs.hidglobal.com/activid-activclient-v7.4.1/activid-activclient/customize-deploy-ac/pin-policies.htm |access-date=2025-05-19 |website=docs.hidglobal.com}}</ref><ref>{{Cite web |last=Defense Human Resources Activity |title=Managing Your Common Access Card (CAC) |url=https://www.cac.mil/Common-Access-Card/Managing-Your-CAC/ |url-status=live}}</ref>