Subject: Re: Non-Repudiation, was Re: Common misconceptions, was Re: KISSfor PKIX. (Was: RE:ASN.1vs XML (used to be RE: I-D ACTION :draft-ietf-pkix-scvp-00.txt))

From: "Aram Perez" <[email-masked]>
Date: Wed, 04 Aug 1999 13:27:25 -0700

Tony Bartoletti wrote:

[snip]
> 
> Radically paraphrasing (I believe it was Steven Kent,) all that the
> "non-repudiation bit" signifies is that, as far as the CA is concerned,
> they assent to the use of a so-certified-key's signature in support of
> a potential non-repudiation claim.

First, you have the term "non-repudiation" which means, by definition, that
a party cannot repudiate. There are many places in the "literature" (whether
it is technical or marketing) that imply that digital signatures
provide/enforce non-repudiation. This is the perception of the "casual
observer". Second, how or why should the CA be concerned? The CA does not
have control over the whole security of the "certificate-using SYSTEM". And
if it is concerned, does it bear any liability? Can the relying party sue
the CA if the NR bit is set in a certificate issued by that CA?

>
> How far does that get anyone?  Not far. It is a bit like you want to
> climb Mt. Everest, and to "support you" in this endeavor, I announce
> that I will not stand in your way.

If it doesn't get anyone very far, why give a false sense of support?

Regards,
Aram Perez