Subject: Qualified Certificates and NR

From: "Bill Brice (listserv)" <[email-masked]>
Date: Wed, 11 Aug 1999 12:47:15 -0500

All,

The recently published Qualified Certificates draft states
regarding key usage and NR:

---
3.2.3 Key Usage

The key usage extension SHALL be present. If the key usage nonRepudi-
ation (1) is asserted then it SHALL NOT be combined with any other
key usage, i.e. if set, the key usage non-repudiation SHALL be set
exclusively.
---

The above requirement would mandate that a QC cert be only used 
for signing based on policy defined NR requirements. 

My query is a practical one. I see two issues. First,
this requirement precludes QC certs from being dual use, as
is common now (RSA signing + encryption), which is typically done
by combining the digital signature bit with the key encipherment bit
(if used as all). This list knows the security value of single use certs,
but most software in use today can't handle them. Certain versions of
Netscape and Microsoft email software would see a QC cert in a signed
message, save it in the address book, and later use it for sending
an encrypted message back to the signer.

What is the value of precluding other, complementary, bits when the
NR bit is asserted in a QC cert? Is this really what is desired?

The second issue: Does anyone know what today's popular software would do
with a cert that had only the NR bit set? Would it recognize it as
valid for signing without the digital signature bit being set?

-Bill Brice, CEO
alphatrust.com

---

From: Stefan Santesson <[email-masked]>
Date: Sun, 15 Aug 1999 13:50:10 +0200

Bill,

Comments in line.

>for signing based on policy defined NR requirements. 

No. This is only true if the NR bit is set.

>(if used as all). 

No. This works just fine. But these bits can't be combined with the NR bit.

>This list knows the security value of single use certs,

The NR bit covers digital signatures used for NR. No other bits have to be
set to meet this purpose.
If this bit is set, these types of certificates should not be combined with
other usages.

The reason for this is to avoid repudiation of signatures due to the fact
that the private key was used to sign an important agreement under another
key-usage policy than the NR-bit.

>valid for signing without the digital signature bit being set?

Yes absolutely. I know of several and they use the right interpretation of
the bits. The digital signature bit is only defined for purposes OTHER than
non-repudiation. See RFC 2459 and X.509.

>alphatrust.com

/Stefan