Subject: Re: Non-Repudiation

From: "David P. Kemp" <[email-masked]>
Date: Wed, 4 Aug 1999 16:53:10 -0400 (EDT)

> From: Ed Gerck <[email-masked]>
> 
> It is not "assent" because if the CA would assume this role or even
> merely imply it, then that power to assent or co-assent to a key
> usage by the subscriber would make the CA liable or co-liable for
> that key's usage.
> 
>   [... and ...]
> 
> But... "I will charge for not standing in your way".  What this means is that
> CAs now have two  "products": one with NR and another without NR--
> and both are "standards-compliant".  The product without NR costs X and
> warrants Z. The product with NR costs Y but also warrants Z, where
> Y > X.  In other words, a "value-add" without the value ;-)

The CA's CPS says that it will sign whatever value of the NR bit is
requested by the subject.  Since the CA is powerless to do otherwise,
its liability is zero.  If Y != X, I agree with your conclusion :-).

> But, some believe that the "non-repudiation bit" feature can still be justified,
> even if not by reason nor by cost, by the "death penalty syndrome".  By
> raising the stakes (ie, "be extra careful with that NR cert now, because any
> misuse will haunt you")  the logic is that the "probability of occurrence" will
> decrease.

Now the CA's CPS is augmented to say that it will set the NR bit if
requested by the subscriber, but only if it can ensure that the private
key resides on a hardware token from which the key cannot be
extracted.  The CA's liability is still zero if the subscriber has a
token, because the subscriber completely controls whether the NR bit is
set.  The CA is liable only for failing to follow its CPS.

Do you disagree that with a proper hardware token, the probability of
private key compromise is decreased?