Subject: [Junk] Re: Possible solution?, was Re: Non-Repudiation

From: [email-masked] (Peter Gutmann)
Date: Sun, 8 Aug 1999 07:11:37 +1200 (NZST)

Paul Hoffman / IMC <[email-masked]> writes:

>At 08:57 AM 8/6/1999 -0700, Ed Gerck wrote:
>>"Certificates that ascertain the non-repudiation bit MUST be issued by
>>the subject."
>
>A certificate is an inanimate object. It cannot "ascertain" anything. It
>can't "know" anything.

Given the amount of cruft which various standards groups are busy stuffing into
certificates, it wouldn't surprise me if some of the components eventually
reached sentience.

Peter.

---

From: Ed Gerck <[email-masked]>
Date: Sat, 07 Aug 1999 15:55:32 -0700

> certificates, it wouldn't surprise me if some of the components eventually

Me neither -- but thanks for the subject warning ;-)

However, I point out that the word "ascertain" was used in order to try to
reflect exactly what Paul mentioned -- so, I welcome his comment.

That is, the word "ascertain" was used to convey (some would say overload)
the notion that non-repudiation is not infused and transported in the
certificate itself (as PKIX currently defines) but must be queried from
elsewhere when the certificate ascertains the NR bit -- ie, for which NR
service a challenge-response mechanism is needed (not necessarily
cryptographic).  Here, the NR certificate is merely defining that a NR
service is available in a suitable query -- but, does not provide it.

A look in the URL [http://www.m-w.com/cgi-bin/thesaurus] will show that
"ascertain" has the synonym "find out" and the related words "ask", "inquire",
"interrogate" and "query"; any of which will provide the context.

Based on a private comment (for other possible and valid NR uses based on
a CA contract) and the possible confusion with overloading too much meaning
into a word (other msgs and, essentially, what I read from Paul's comment), I
would suggest the following alternatives:

1. A certificate that sets the nonRepudiation bit also implictly defines where
the non-repudiation service is provided, which MUST be:
  1.a. by the issuer if the certificate is self-signed, or otherwise,
  1.b. as regulated in the CPS.

Cheers,

Ed Gerck