[Security Engineering and Cryptography] PKI can be used to support security requirements in the change management process. Which of the following capabilities does PKI provide for messages?

Public Key Infrastructure (PKI) provides several security services through the use of asymmetric cryptography. For messages, the most relevant capability in a change management context is non-repudiation. This is achieved via digital signatures. A user signs a message (e.g., a change request or approval) with their private key. Anyone with the corresponding public key can verify the signature, which provides strong evidence that the message originated from the key holder and has not been altered. This prevents the sender from plausibly denying their involvement, which is a critical requirement for maintaining an auditable and accountable change management process.

B. Confidentiality: While PKI can provide confidentiality by encrypting messages with a recipient's public key, non-repudiation is the service that specifically addresses the proof of origin and integrity required for accountability in change management.
C. Delivery receipts: Delivery receipts are a function of the messaging protocol (e.g., SMTP) and are not a cryptographic service provided by PKI. PKI cannot guarantee that a message was delivered or read.
D. Attestation: Attestation is the act of affirming something to be true. While a digital certificate is an attestation of identity by a Certificate Authority (CA), non-repudiation is the specific security service that applies to the signed message itself. ---

1. National Institute of Standards and Technology (NIST) Special Publication 800-32

"Introduction to Public Key Technology and the Federal PKI Infrastructure".

Section 2.2

"Security Services

" Page 6: "Non-repudiation provides proof of the origin of data. A public key-based digital signature can provide non-repudiation... The recipient can show the digital signature to a third party (such as a judge) as proof that the originator sent the message." This directly links PKI's digital signatures to the service of non-repudiation.

2. Internet Engineering Task Force (IETF) RFC 4949

"Internet Security Glossary

Version 2".

Section "non-repudiation

" Page 201: Defines non-repudiation as a "security service that provides protection against false denial of involvement in a communication." It further explains that this is typically achieved with digital signatures.

3. Pfleeger

C. P.

Pfleeger

S. L.

& Margulies

J. (2015). Security in Computing (5th ed.). Pearson Education.

Chapter 5

Section 5.4 "Public Key Encryption

" subsection "Digital Signatures

" Page 269: "A digital signature has the essential properties of a written signature... It is unforgeable... It is authentic... It is not repudiable. The signer cannot later claim the signature is not valid." This academic text confirms non-repudiation as a key property of digital signatures

a core component of PKI.