Re: RE: Proving non-repudiation in e-Commerce App

[bitshield () gmail com]

Hi Craig

thanks for your indepth explanation. You are right, the term prove is too strong. I want to be able to say the 
customer: "Yes your system implements non-repudiation on a best-practice basis. Whenever there are problems then you 
have good chances to take legal action".
What does this actually mean? I want to illuminate each component (as you told) the application. For doing that I have 
to know how one implements a proper non-repudiation. For example:

How does the application log have to look like? I guess the log will be an important part, where you can trace and 
backup the transactions. How does a log entry look like, to prove that it couldn't be altered by the sysadmin or by a 
hacker?

Every action triggered by the client should somehow be signed using the clients private-key and then stroed in a DB or 
a log file. I think such a solution would implement non-repudiation. What do you guys think? Are there other or better 
practices? I'm looking for applied practices.

Thanks
Joe