Subject: Re: What non-repudiation is not and the PA bit, was Re: To Be,or NR To Be ...

From: Ed Gerck <[email-masked]>
Date: Mon, 23 Aug 1999 09:06:26 -0700

[This dialogue corrects a mistatement in one of
my messages and is forwarded with permission
by David Boyce.  His original message is also
included below.]

David:

I agree with  you.  My only excuse is that it was a "humorous rendering" :-)

The problem of more than one public-key cert for one key is
a liability issue for the signer -- and always is, because if cert revocation
of one cert is already at most a probability (ie, you can never be certain
that all of your cert users received or have acessed or will acess your
cert revocation -- and no CA warrants it either) then for two certs or
more ... it simply gets worse.  This is even worse in consequences for NR certs
(whatever they are).  Also, since a signature may not include the key-usage
bits or may be verifiable regardless of the key usage bits it may embed,
it is not advisable at all to have the same key in common and in NR certs.

That said, I believe the following (still humorous and informal text) would
better express what IMO the current PKIX NR bit really is:

  We hereby declare that when the proofOfAuthentication [POA] bit is asserted
  in a certificate, any message verifiable with that certificate can be used
  as legal proof against us, but not otherwise.

Comments?

Cheers,

Ed Gerck

David Boyce wrote:

> Ed Gerck writes:
>
> >- We hereby declare that when the proofOfAuthentication bit is
> asserted in a
> >  certificate, any  message signed with the certificate can be used as legal
> >  proof against us, but not otherwise.
>
> Ed,
>
> keep up the good work!
>
> I'm sorry to be pedantic, but may I point out that there is a problem
> with the wording "any message signed with the certificate" which may be
> bigger than just requiring more precise text?
>
> A message is not *signed with* the certificate - it is *signed with* a
> private key which presumably corresponds to the public key contained in
> a claimed supporting certificate which has this 'PA' bit set.
>
> This may be a problem if that key pair may be represented in several
> certificates, some with the PA bit set and (at least one) unset.
>
> (I know use of the same key in several certs is discouraged, but it may
> still happen.)
>
> In these circumstances, a message which the originator signed with that
> private key and passing his non-PA certificate to support the signature,
> might have that certificate fraudulently switch with a PA certificate,
> thereby apparently giving the relying party legal proof not intended by
> the originator when he signed the message with that key.
>
> This same line of argument would apply to the NR bit, or any other
> semantic difference between two certificates representing the same key
> pair.
>
> Regards,
>
> David.
> --
> David Boyce
>
> MessagingDirect Ltd.
> Tel:    +44 181 332 9091                 Richmond, Surrey, ENGLAND
> Email:  [email-masked]  WWW: http://www.MessagingDirect.com/