Subject: Re: Non-Repudiation

From: "Aram Perez" <[email-masked]>
Date: Wed, 11 Aug 1999 10:24:39 -0700

Steve Kent wrote:

> Aram,
> 
> The term "digital signature" has a well defined meaning in the technical
> literature, and was specifically coined in the context of public key
> cryptography, although one can achieve analogous features via symmetric
> crypto.
>
> [Also note that your characterization of signing a hash by "encrypting" it
> is not correct, in general, e.g., DSA does not encrypt a hash to sign it.]
>
> The term "signature" is more generally applied, and is more broadly defined
> outside of the technical area in which we are working. Hence a definitoion
> from a dictionary for the term signature does not address our debate.
>
> The X9.9 standard was written at a time when the distinction was clear and
> that's why that standard does not confuse matters by refering to a MAC as a
> signature, much less a digital signature.  A critical aspect of a digital
> signature is that the ability to verify it is cryptogra[hically distinct
> from the ability to generate it.  That asymmetry is essential if signatures
> are to be used to support NR.
>
> I would argue that your example of a MAC does not fit this definition, as
> the controls used to effect asymmetry are procedural, not cryptographic.
> We have about 20 years of technical literature on this topic, most of which
> is quite consistent in the use of this terminology.

I don't care whether MAC "fits the definition". I was arguing David Kemp's
point that "Symmetric cryptography involves shared secrets, and so cannot be
used to distinguish between parties in a communication." All I was stating
was that you can build a system that uses MAC (and hence symmetric
cryptography) to replace handwritten signatures and the system can provide
the ability to "distinguish between parties".

Regards,
Aram Perez

---

From: "Phillip M Hallam-Baker" <[email-masked]>
Date: Wed, 11 Aug 1999 14:51:28 -0400

I find this thread facinatingly irrelevant to PKIX. For good
or ill PKIX is for PUBLIC KEY Infrastructure.

The only objective definition of Non-Repudiation in my view
is that a signature has the property of Non-Repudiation if
the signatories belief in the strength of NR is such that
she does not repudiate or if a court judgement rules the
signature to be valid.

Any other definition of NR will inevitably involve an
element of subjectivity. This is not surprising since
the idea that logic provides a route to objective truths
on any topic other than logic is pretty much discredited
these days (Alan Sokal's tantrums aside).

The PKIX group has clearly arrived at an intersubjective 
understanding of Non Repudiation based on the use of Public
Key cryptography. It may be possible to achieve the same 
quality in other ways but these are outside the scope of
the working group.

		Phill

---

From: Ed Gerck <[email-masked]>
Date: Wed, 11 Aug 1999 14:10:06 -0700

Phill:

Your comments are IMO  fascinatingly irrelevant to PKIX ;-)
And that is why I believe they are timely, since they address
that twilight zone between a PKI and its users -- the transition
from subjective to objective that is not in the objective specs
but which eventually separates what is to be included in the
objective specs.

BTW, if NR would be 100% objective or 100% subjective
then I believe there would be no need to discuss it here --
and we do so exactly because it has several intersubjective
aspects.  Users will have the same problem.

> she does not repudiate or if a court judgement rules the

I agree that the second statement "if a court judgement rules the
signature to be valid" is an objective definition of NR -- but
one which cannot ascertain NR before the reliance act since it
cannot be applied a priori in most law systems.  Thus, we can't
use it here.

[COMMENT:  in regard to court rules being objective, of course
they are but if there would be a court above the Supreme Court then
it is probable that many Supreme Court decisions would be overturned
-- including those that are unanimous.  OTOH,  technical decisions
such as the value of pi cannot be overtuned. This means that technical
rules can be less dependent on the observer -- ie, can be more
objective.]

The first statement "if the signatories belief  in the strength of NR is such
that she [it] does not repudiate" is  IMO always intersubjectively true
but the usefulness of NR is when one the signatories does NOT believe
in the strength of NR but the other does.  Or, when neither signer
believes but the law "believes" (ie, mandates). Or, any such combination
in tension.  Thus, IMO the first statement is neither objective (eg, in regard
to law) nor useful here, though true (intersubjectively).

> these days (Alan Sokal's tantrums aside).

Yes, agree on both counts.

> Key cryptography.

Yes, I think so.

> It may be possible to achieve the same quality in other ways
> but these are outside the scope of the working group.

I tend to agree, also. Automating such intersubjective understanding
is not a PKIX matter. BTW, I agree with Bill Brice that if adequate
cert policy OIDs are introduced then adequate software could do it
at least to a certain extent -- but this is also outside the scope of the
WG as far as I understand it.  And, I  agree with David Kemp that
if we want to make distinctions about what a company wishes to
provide, we should use the CP or other extensions to communicate
it, not the keyUsage extension.

Cheers,

Ed Gerck

---

From: Stephen Kent <[email-masked]>
Date: Thu, 12 Aug 1999 12:42:31 -0400

Aram,

>the ability to "distinguish between parties".

I do care whether terms used in our discussions fit standard technical
defintions apropos to the discussion.  Inaccurate use of words in these
discussions wastes the time of everyone on the list.

Steve