Subject: Re: Non-Repudiation

From: "Aram Perez" <[email-masked]>
Date: Thu, 05 Aug 1999 09:32:16 -0700

Alfred Arsenault wrote:

> "Flanigan, Bill" wrote:
>> 
>> Dave,
>> 
>>         This one-bit failure thing gets scary when you, say, escrow a
>> dataEnciperment key pair without the nonRepudiation bit set, but with the
>> digitalSignature bit set.
>
> AWA:  First of all, don't do that.  Yes, I know, some people will
> because the architecture of their systems is such that they don't
> support separate keys for digitalSignature and dataEncipherment, and
> they want to be able to recover their encrypted mail after losing their
> keys, but don't even get me started on the lack of wisdom in such a
> system design!

If it is such a bad idea (and I totally agree with you), why does the PKIX
allow it? Why can't PKIX state you can have one or the other but not both?

[snip]
>
>  - The intent of the NonRepudiation bit was, as Dave Kemp has pointed
> out, to show that the CA is willing to say that this certificate is
> intended/permitted to be used in signing things for which their is hope
> of providing the service of nonrepudiation, as defined in 7498-2 and
> paraphrased by Steve Kent.  The intent of this bit is to explicitly
> distinguish such certs/keys from those only intended/permitted to be
> used in providing the service of authentication via the signing of
> short-term entities.

I personally would not trust a CA that certifies a public key based on some
"*hope* of providing the service of nonrepudiation". And if it is a
"service" of non-repudiation, then this information should be placed a
service extension not in a key usage bit.

>   - what the CA does before signing a certificate with the
> NonRepudiation bit set is a matter left to the CA's CP and/or CPS.  So
> is the division of liability between any given CA and user.  If you as
> the user don't like the CA's rejection of liability, don't do business
> with that CA.  (I try not to.)

I'd like to pose a question to any CA on this list: how many of you have set
the NR bit? Do you accept any liability for the NR bit?

>   - to have a true non-repudiation system, even with the NR bit turned
> on, requires a whole variety of things, and there's little to no legal
> precedent, so we don't really know what all is required.  Setting this
> one bit is clearly not sufficient, but it may be necessary.

I disagree that it may be necessary. What will be necessary is a legal
framework between the signer and relying party.

>
>  My bottom line is that I think that the NR bit should be left in,
> because at a minimum it serves the purpose of explicitly stating by
> being turned off that the CA provides NO WARRANTY whatsoever that the
> relying party can expect the service of non-repudiation to be provided.

I think dropping the NR bit would provide the same NO WARRANTY.

Regards,
Aram Perez