Non-repudiation

Non-repudiation is the assurance that someone cannot later credibly deny having sent a message or performed an action. It is not a separate technology but a property that follows from a single condition: the proof must depend on a secret that only one party could have used. That is why it belongs to asymmetric cryptography. A digital signature is created with a private key held by one holder alone, so a valid signature can only have come from them, and verification with the matching public key is open to anyone.

The confusable is the whole point. A MAC or HMAC also proves integrity and authenticity, but both parties share the same symmetric key, so either could have produced the tag and neither can be held to it: integrity yes, non-repudiation no. Two further limits are worth holding. The property is only as strong as the binding between a public key and a real identity, which is what a PKI certificate provides, so a signature verified against an unvetted key proves little. And keys held by an organisation rather than a person authenticate a domain, not an individual, which is why a DKIM signature is not designed to deliver it. Supporting evidence such as audit logs and timestamps strengthens a claim without supplying the property on its own.

Exam relevance: non-repudiation is the trigger word, and a digital signature is the mechanism that provides it. If a question offers hashing, a MAC, HMAC or symmetric encryption alongside a signature and asks which prevents a sender denying an action, the shared-secret options are all distractors.