A company wants a signer cannot credibly deny signing a contract. Which mechanism best supports this?

• A. Diffie-Hellman
• B. Public-key cryptography with digital signatures (RSA/ECDSA)
• C. Public key infrastructure (PKI) certificate
• D. Hash chaining

Answer: (A)

Non-repudiation of origin is achieved through digital signatures. When the signer applies a private key to a hash of the contract, they generate a signature that only their private key could produce. Anyone with the signer’s public key can verify that the signature matches the document and, crucially, that the signer held the corresponding private key at signing time. This binding of the signer to the signed data makes it credible that the signer cannot later deny having signed.

Public-key cryptography with digital signatures (RSA or ECDSA) is the mechanism that provides this property. To trust who the signer is, the public key is typically tied to an identity via a PKI certificate, which is issued by a trusted authority and ensures that the public key belongs to the claimed individual or entity. The certificate helps others verify the signer’s identity when validating the signature.

Diffie-Hellman is a key-exchange protocol used to establish a shared secret for encrypted communication; on its own it does not bind a signature to a document or provide non-repudiation. Hash chaining maintains integrity and an auditable sequence, but without a signature proving authorship, it does not prevent a signer from later denying involvement.