Subject: Re: Non-Repudiation

From: [email-masked]
Date: Wed, 4 Aug 1999 19:31:17 -0400

Isn't the basic distinction between an ordinary digitalSignature keyUsage
and a keyUsage with nonRepudiation that the certificate without nonRepudiation
is NOT expected to be used for any legal documents?  This does not imply that a
given signature using a certificate with nonRepudiation is a legal document,
merely that such a signature using a certificate without this bit is less likely
to be one (perhaps even that such a signature must not be considered as one).
Perhaps the nonRepudiation bit could be relabeled "permittedOnLegalDocuments" or
something to that effect, or RFC 2459's replacement could state that that is its
intended meaning.
     A certificate subject might possibly wish to bind his or her self not to
execute a contract using that certificate, and an organization might very well
wish to state that the subject cannot execute a contract on behalf of the
organization with which he or she is affiliated.  Leaving out the nonRepudiation
bit (or whatever it winds up being called) would go some way toward establishing
such a policy.  Admittedly, this boolean flag is pretty coarse for such a
purpose, and the policies field is better.
     Of course, nonRepudiation is not a very good name, since most of the
defenses allowing a signature to be repudiated (prominently including the
defense that someone else actually was using the key, which is very similar to
claiming that a hand-written signature has been forged) cannot be evaluated when
the certificate is issued, but that doesn't mean that the bit is worthless.  In
any case, while very few of the participants in this group are lawyers, we
probably include a large fraction of the potential expert witnesses in cases on
digital signatures.

          Tom Gindin

---

From: Tony Bartoletti <[email-masked]>
Date: Wed, 04 Aug 1999 17:10:53 -0700

>probably include a large fraction of the potential expert witnesses in cases on

Preface (humor):  I am reminded somehow of the physicist who described the
attempts to produce fusion by magnetic confinement of hydrogen ions as
"trying to bind Jello with rubber bands".

The NR-bit was intended (I believe) so that (for instance) the dutiful
vendor of contract-signing software would code "Sorry, I can't sign this
contract with this key, its (cert's) NR-bit is 0."  And likewise,
vendors of (say) routine data-packet authentication software would code
"Sorry, I can't sign these packets with this key, its NR-bit is 1."

The precaution, especially in the latter case, was to preclude such
(unlikely?) scenarios as the following:  I prepare some electronic
documents as submission for a bank loan, leave them on a floppy disk,
and then call a coworker from home and say "Jee, I forgot to send a
document to my bank, its on a floppy on my desk. Could you please
send it to [email-masked] for me?"  Later, the coworker discovers
that they have "co-signed" my loan, by virtue of using "authenticated"
email.

(NR=Jello, NR-bit=RubberBand).

___tony___

Tony Bartoletti                                             LL
IOWA Center                                              LL LL
Lawrence Livermore National Laboratory                LL LL LL
PO Box 808, L - 089                                   LL LL LL
Livermore, CA 94551-9900                              LL LL LLLLLLLL
phone: 925-422-3881   fax: 925-423-8081               LL LLLLLLLL
email: [email-masked]                                   LLLLLLLL