Subject: Re: FW: Is this non-repudiation or NR, and why?

From: Tony Bartoletti <[email-masked]>
Date: Fri, 20 Aug 1999 12:21:15 -0700

All,

There is a central point to this debate.  There appears to be two
distinct positions held, in particular to the meaning "NR-bit NOT SET".

Strength 0f Intent:
Some say this means "I signed it, I intended to sign it, but I do not
intend its use beyond pure authentication of data and sender, and that
specifically *I* am not signalling assent to be legally/contractually
bound by any terms contained in the data."

Strength Of Key-Binding:
Others say it means "I may not have signed it.  The key protections for
this key do not warrant any presumption that its use is restricted to
the individual given as the certified owner."  Its not a "strong-enough"
key for the purposes of NR.

Clearly, these two meanings are WORLDS apart, and cannot both be called
"the meaning of NR-bit NOT SET".

Part of the confusion is that these two meanings are not entirely
unrelated.  It would make no sense to assert "assent to legal binding"
with a key that is weakly-held.  In a sense,

  weakly-held-key < strongly-held-key < strongly-intended-signature

and some want "NR-bit 0" to disavow only "strongly-intended-signature"
while others argue it disavows "strongly-held-key", which then takes
"strongly-intended-signature" down with it.

There are probably good arguments for both positions.  But it is
clear to me that there cannot be ambiguity as to which of these
two positions is being asserted.

Comments?

___tony___

Tony Bartoletti                                             LL
IOWA Center                                              LL LL
Lawrence Livermore National Laboratory                LL LL LL
PO Box 808, L - 089                                   LL LL LL
Livermore, CA 94551-9900                              LL LL LLLLLLLL
phone: 925-422-3881   fax: 925-423-8081               LL LLLLLLLL
email: [email-masked]                                   LLLLLLLL

---

From: Paul Koning <[email-masked]>
Date: Fri, 20 Aug 1999 15:33:52 -0400

>>>>> "Tony" == Tony Bartoletti <[email-masked]> writes:

 Tony> All, There is a central point to this debate.  There appears to
 Tony> be two distinct positions held, in particular to the meaning
 Tony> "NR-bit NOT SET".

 Tony> Strength 0f Intent: Some say this means "I signed it, I
 Tony> intended to sign it, but I do not intend its use beyond pure
 Tony> authentication of data and sender, and that specifically *I* am
 Tony> not signalling assent to be legally/contractually bound by any
 Tony> terms contained in the data."

 Tony> Strength Of Key-Binding: Others say it means "I may not have
 Tony> signed it.  The key protections for this key do not warrant any
 Tony> presumption that its use is restricted to the individual given
 Tony> as the certified owner."  Its not a "strong-enough" key for the
 Tony> purposes of NR.

 Tony> Clearly, these two meanings are WORLDS apart, and cannot both
 Tony> be called "the meaning of NR-bit NOT SET".

Agreed.

In addition, the second interpretation seems to have no value at all.
It says, in effect "don't assume you're talking to the supposed owner
of this key".  In other words, "don't use this message for
authentication purposes either".

If it doesn't do NR and it doesn't do authentication, what does it do?

	paul

---

From: Stephen Kent <[email-masked]>
Date: Fri, 20 Aug 1999 15:58:17 -0400

Tony,

The second issue you raise is not just an NR issue, as it calls into
question other security aspects of the use of the private key.  I don't
consider the NR bit (not being asserted) to be a good way to address this
concern.

Steve

---

From: Tony Bartoletti <[email-masked]>
Date: Fri, 20 Aug 1999 13:33:10 -0700

>If it doesn't do NR and it doesn't do authentication, what does it do?

Paul,

In general, I agree.  But some have posited having a key identify a
"group" or "role", rather than an individual.  Perhaps they envision
"NR=0" to mean, loosely, "not resolvable to an individual."

___tony___

Tony Bartoletti                                             LL
IOWA Center                                              LL LL