Can non-repudiation be ensured without public-key cryptography? Message authentication is ensured by using HMAC, which can be thought of as a symmetric-key construction. 

Source authentication in multicast communications can be guaranteed using TESLA, which is again based on symmetric-key principles (although it basically works because of asymmetries in time).

However, neither HMAC nor TESLA ensure non-repudiation.

Is this a structural limitation of symmetric-key cryptography? Or is there some construct that ensures non-repudiation without using public/private keys?
Is this a structural limitation of symmetric-key cryptography? Or is there some construct that ensures non-repudiation without using public/private keys?


Non-repudiation implies that nobody other than the private key holder* could have produced the signature, which rules out symmetric constructions such as HMAC. 

With a symmetric MAC (from a construction like HMAC), anyone who has the ability to verify a MAC also has the ability to construct one, so such constructions cannot be used to provide non-repudiation. 

So in that sense yes, it is a limitation of symmetric-key cryptography.

While Hash-based signatures do exist, those are still an asymmetric cryptosystem with public/private keys, despite the fact that they use traditional hash functions.

Note

It is arguable whether or not signatures provide non-repudiation, which is a legal concept. It is arguable that cryptography itself is limited in the capacity to provide non-repudiation.