Subject: Re: Common misconceptions

From: Graham Klyne <[email-masked]>
Date: Tue, 03 Aug 1999 10:52:56 +0100

At 16:48 02/08/99 -0700, Ed Gerck wrote:
>This is exactly the point. In no way ought challenge-response  be used
>as a response that does not depend on the challenge or that is provided
untimely.
>Which is, however, what happens when a S/MIME user receives a signed
>message and "imagines" that the cert has not been revoked so that the msg is
>"certainly" valid -- ie, the user refuses to challenge that cert and obtain a
>response in the form of a CA's  CRL .  Every time we consult a CA in
>order to verify if a cert is included in a  CRL we are performing
>challenge-response on that cert's validity  -- in other words, we are
verifying it
>in a timely manner.
>
>If you accept that reliance must be verifier-centric then you must also
agree that
>the verifier must be able to verify ;-) and, at will.

I have had some difficulty understanding exactly what you were saying, but
I am now thinking that it is pretty much embodied in the first paragraph
above.

To test my understanding, I would like to offer a hypothetical scenario
that allows "verifier centric" reliance without a challenge-response in the
struct sense that you seem to describe.

Suppose a CA is broadcasting CRLs at regular intervals.  The receiver of a
certificate will rely upon that certificate only if they are also in
posession of a fresh CRL that does not revoke it.

I think this satisfies reasonable requirements for verifier-centric
reliance, without a struct challenge/response.  (But I suppose one might
argue that the "challenge" in this scenario is implicit.)

[...]
>Thank you for the opportunity to clarify my statement -- which is a general
>statement valid in many legal systems (including common and civil law). If
>a person is positively identified  by DNA evidence of his sperm on a dress
>then the person has full liability to the extent of that identification (say,
>1:1000,000)  and to the extent that production of the sample was (most
>liked than not) voluntary and within his *power* to avoid.  Likewise, if a
>fresh sample of a person's blood is present at a crime scene then this
strongly
>implies that the person was present and has full liability for that presence
>to the extent of the time factor (fresh) and blood identification because
production
>of the sample at that time and place was (most likely than not) within his
>*power* to avoid.

So what you are describing here is the principle that liability can arise
only as the result of a *willing* action (e.g. _intent_ to commit a crime;
_wilful_ neglect of safety procedures;  _willing_ and _informed_ execution
of a contract; etc.)?

Then, I think your use of the term "legal repudiation" means "repudiation
of liability"... ?

My _dictionary_ definition of repudiate also allows "deny", prevention of
which I thought was the primary intent of technical non-repudiation
mechanisms:

  repudiate :
  1 a disown; disavow; reject. b refuse dealings with. c deny.
  2 refuse to recognize or obey (authority or a treaty).
  3 refuse to discharge (an obligation or debt).
  4 (esp. of the ancients or non-Christians) divorce (one's wife).

Clearly, any purely technical system can only be _part_ of the evidence
that may be used to establish liability in the affairs of men (as opposed
to machines).

#g

------------
Graham Klyne
([email-masked])

---

From: Ed Gerck <[email-masked]>
Date: Tue, 03 Aug 1999 21:06:56 -0700

> argue that the "challenge" in this scenario is implicit.)

Yes, in the sense that a fresh broadcast is expected at certain intervals. But, the
basic tenet of "verifier-centric" reliance must be that the verifier is able to verify
*at will* -- which would be negated by a CRL that is broadcast in the CA's
terms, not the verifier's terms.

So, your example is valid insofar as the broadcast frequency is adequate to
the verifier. Which may be hard to accomplish, since the verifier would need a
CRL more frequently for transactions with higher risk (ie, value at stake) and
less frequently otherwise -- but the broadcast rate would be constant.

> _wilful_ neglect of safety procedures;  _willing_ and _informed_ execution

No, what I am describing is that liability is the counterpart of power. I did
not mention intent.

There are two basic symmetry axis in law theory, valid in general:

1. liability versus power
2. duty versus right

and these two axis are mostly orthogonal, so that it is possible to have
duties without liability and vice versa.  Here, non-repudiation implies a
liability, not a duty.  So, non-repudiation of an authentication act must be
derived from the subject's power to avoid that authentication act -- but,
if the act is automatic or automatically accepted even if the subject did
revoke the cert in a CRL, such power does not exist in regard to that act.

> that may be used to establish liability in the affairs of men (as opposed

Yes, but when that technical system denies the basic requirements of providing
such evidence (for example, by denying power to the subject) then that technical
system denies evidence in regard to non-repudiation.

Cheers,

Ed Gerck