Re: RE: Proving non-repudiation in e-Commerce App

Hi Craig

thanks for your indepth explanation. You are right, the term prove is too 
strong. I want to be able to say the customer: "Yes your system implements 
non-repudiation on a best-practice basis. Whenever there are problems then you 
have good chances to take legal action".
What does this actually mean? I want to illuminate each component (as you told) 
the application. For doing that I have to know how one implements a proper 
non-repudiation. For example:

How does the application log have to look like? I guess the log will be an 
important part, where you can trace and backup the transactions. How does a log 
entry look like, to prove that it couldn't be altered by the sysadmin or by a 
hacker?

Every action triggered by the client should somehow be signed using the clients 
private-key and then stroed in a DB or a log file. I think such a solution 
would implement non-repudiation. What do you guys think? Are there other or 
better practices? I'm looking for applied practices.

Thanks
Joe