According to the "Handbook of Applied Cryptography" by Alfred J. Menezes, Paul C. van Oorschot, and Scott A. Vanstone (CRC Press, 1997; p.4):
Cryptography is the study of mathematical techniques related to aspects of information security such as confidentiality, data integrity, entity authentication, and data origin authentication.
My questions are: Why doesn't non-repudiation appear in that definition? Is it less important? Isn't non-repudiation one of the aspects of information security?
That is clearly a simplified definition, as cryptography encompasses a large number of ideas. It is likely for the same reason that they do not mention zero-knowledge proofs or proof-of-work systems, despite those very often falling squarely in the relm of cryptography.
Mikero's comment about the passage you quoted is exactly right: The list of properties is introduced with "such as".. this suggests that the list is not intended to be exhaustive.
On page 3 of the book you quoted, the "Handbook of Applied Cryptography" by Alfred J. Menezes, Paul C. van Oorschot, and Scott A. Vanstone (CRC Press, 1997), Table 1.1 lists non-repudiation as a security objective.
Directly under the text you mentioned, it says that non-repudiation is a key objective, so here is the answer to your question. The passage is show below (p.4):
Cryptographic goals
Of all the information security objectives listed in Table 1.1, the following four form a framework upon which the others will be derived: (1) privacy or confidentiality (§1.5,§1.8);(2) data integrity (§1.9); (3) authentication (§1.7); and (4) non-repudiation (§1.6).
- Confidentiality is a service used to keep the content of information from all but those authorized to have it. Secrecy is a term synonymous with confidentiality and privacy. There are numerous approaches to providing confidentiality, ranging from physical protection to mathematical algorithms which render data unintelligible.
- Data integrity is a service which addresses the unauthorized alteration of data. To assure data integrity, one must have the ability to detect data manipulation by unauthorized parties. Data manipulation includes such things as insertion, deletion, and substitution.
- Authentication is a service related to identification. This function applies to both entities and information itself. Two parties entering into a communication should identify each other. Information delivered over a channel should be authenticated as to origin,date of origin, data content, time sent, etc. For these reasons this aspect of cryptography is usually subdivided into two major classes:entity authentication and data origin authentication. Data origin authentication implicitly provides data integrity(for if a message is modified, the source has changed).
- Non-repudiation is a service which prevents an entity from denying previous commitments or actions. When disputes arise due to an entity denying that certain actions were taken, a means to resolve the situation is necessary. For example, one entity may authorize the purchase of property by another entity and later deny such authorization was granted. A procedure involving a trusted third party is needed to resolve the dispute
