Overview - ISO/IEC 13888-2:2010 (Non‑repudiation using symmetric techniques)

ISO/IEC 13888-2:2010 specifies non‑repudiation mechanisms based on symmetric cryptography. It describes generic structures and communication-related mechanisms to create, collect and verify evidence for disputes about whether a message or action occurred. The standard focuses on non‑repudiation of origin (NRO) and non‑repudiation of delivery (NRD) using secure envelopes, message authentication codes (MACs) and tokens generated/verified by a trusted third party (TTP). Non‑repudiation is provided only within a clearly defined security policy and legal context.

Key technical topics and requirements

Mechanisms using symmetric techniques: tokens and secure envelopes built with secret keys and MAC algorithms rather than asymmetric signatures.
Secure envelope (SENV): SENV(y) = (y, MAC_X(y)) - data y protected by a MAC computed with entity X’s secret key.
Generic non‑repudiation token (GNRT): GNRT = (text, SENV(y)) where the TTP creates and verifies tokens using its secret key.
Data fields for evidence: token contents include policy identifier (Pol), service type (f), identifiers for originator and recipient (A, B), evidence generator identifiers (C, D), time fields (T, TG), optional protected data Q and an imprint Imp(m) (message hash or the message itself).
Trusted third party (TTP): an online TTP is typically required to prevent fraudulent repudiation/accusation. The TTP must maintain keys, generate tokens, verify evidence and access reliable time sources.
Preconditions and key management:
- Each participant must share secret keys with the TTP (and with any Delivery Authority or Time‑Stamping Authority).
- A common hash/imprint function (Imp) and a MAC function must be agreed and available to participants.
- Time stamping support may be used (TSA), and non‑repudiation policies are defined externally (see ISO/IEC 10181‑4).
Security dependency: strength depends on chosen cryptographic algorithms, parameters and secure key management (see ISO/IEC 11770).

Practical applications and target users

Who benefits:

Security architects and system designers building evidence-based messaging, e‑commerce, banking, or transaction systems where proof of origin/delivery is required.
TTP/TSA implementers designing token issuance, verification and time‑stamping services.
Legal/compliance teams specifying non‑repudiation policies for contractual or regulatory evidence requirements.
Developers of secure messaging, workflow and payment systems that require dispute resolution evidence without relying solely on asymmetric PKI.

Typical use cases:

Contract signing workflows that need verifiable origin and delivery logs.
Financial message exchange where trusted logs and timestamps are required.
Enterprise systems that prefer symmetric key infrastructures or hybrid models with TTP mediation.

Related standards

ISO/IEC 13888‑1 (Non‑repudiation - General)
ISO/IEC 13888‑3 (Mechanisms using asymmetric techniques)
ISO/IEC 10181‑4 (Non‑repudiation policies)
ISO/IEC 9798‑1, ISO/IEC 9797‑1 (authentication, MAC)
ISO/IEC 10118 (hash functions), ISO/IEC 11770 (key management), ISO/IEC 18014 (time‑stamping)

Keywords: ISO/IEC 13888‑2:2010, non‑repudiation, symmetric techniques, trusted third party, TTP, secure envelope, MAC, non‑repudiation of origin, non‑repudiation of delivery, time‑stamping, security policy.

Overview - ISO/IEC 13888-2:2010 (Non‑repudiation using symmetric techniques)

Key technical topics and requirements

Mechanisms using symmetric techniques: tokens and secure envelopes built with secret keys and MAC algorithms rather than asymmetric signatures.
Secure envelope (SENV): SENV(y) = (y, MAC_X(y)) - data y protected by a MAC computed with entity X’s secret key.
Generic non‑repudiation token (GNRT): GNRT = (text, SENV(y)) where the TTP creates and verifies tokens using its secret key.
Data fields for evidence: token contents include policy identifier (Pol), service type (f), identifiers for originator and recipient (A, B), evidence generator identifiers (C, D), time fields (T, TG), optional protected data Q and an imprint Imp(m) (message hash or the message itself).
Trusted third party (TTP): an online TTP is typically required to prevent fraudulent repudiation/accusation. The TTP must maintain keys, generate tokens, verify evidence and access reliable time sources.
Preconditions and key management:
- Each participant must share secret keys with the TTP (and with any Delivery Authority or Time‑Stamping Authority).
- A common hash/imprint function (Imp) and a MAC function must be agreed and available to participants.
- Time stamping support may be used (TSA), and non‑repudiation policies are defined externally (see ISO/IEC 10181‑4).
Security dependency: strength depends on chosen cryptographic algorithms, parameters and secure key management (see ISO/IEC 11770).

Practical applications and target users

Who benefits:

Security architects and system designers building evidence-based messaging, e‑commerce, banking, or transaction systems where proof of origin/delivery is required.
TTP/TSA implementers designing token issuance, verification and time‑stamping services.
Legal/compliance teams specifying non‑repudiation policies for contractual or regulatory evidence requirements.
Developers of secure messaging, workflow and payment systems that require dispute resolution evidence without relying solely on asymmetric PKI.

Typical use cases:

Contract signing workflows that need verifiable origin and delivery logs.
Financial message exchange where trusted logs and timestamps are required.
Enterprise systems that prefer symmetric key infrastructures or hybrid models with TTP mediation.

Related standards

ISO/IEC 13888‑1 (Non‑repudiation - General)
ISO/IEC 13888‑3 (Mechanisms using asymmetric techniques)
ISO/IEC 10181‑4 (Non‑repudiation policies)
ISO/IEC 9798‑1, ISO/IEC 9797‑1 (authentication, MAC)
ISO/IEC 10118 (hash functions), ISO/IEC 11770 (key management), ISO/IEC 18014 (time‑stamping)

ISO/IEC 13888-2:2010 PDF

Technical details

Abstract

Overview - ISO/IEC 13888-2:2010 (Non‑repudiation using symmetric techniques)

Key technical topics and requirements

Practical applications and target users

Related standards

Related standards

Abstract

Overview - ISO/IEC 13888-2:2010 (Non‑repudiation using symmetric techniques)

Key technical topics and requirements

Practical applications and target users

Related standards

Related standards

Information technology. Open systems interconnection. Security frameworks for open systems. Non-repudiation f…

Information technology — Security techniques — Key management — Part 3: Mechanisms using asymmetric techniques

IT security techniques — Non-repudiation — Part 1: General

Information technology — Security techniques — Non-repudiation — Part 3: Mechanisms using asymmetric techniqu…

Information technology — Security techniques — Entity authentication — Part 1: General

Information technology — Security techniques — Message Authentication Codes (MACs) — Part 1: Mechanisms using…

Information technology — Security techniques — Hash-functions — Part 2: Hash-functions using an n-bit block c…

Information technology — Security techniques — Time-stamping services — Part 3: Mechanisms producing linked t…