Subject: Re: Non-Repudiation

From: "David P. Kemp" <[email-masked]>
Date: Wed, 4 Aug 1999 16:15:33 -0400 (EDT)

> From: "Aram Perez" <[email-masked]>
> 
> How can setting the NR bit ensure that there isn't a "failure in any one of
> those areas"?

It can't, obviously.  The NR bit is a tiny amount (one binary digit's worth)
of information imbedded in a technical protocol which can be used to
signal a person's intent, no more, no less.

If there is NO failure in any of the listed areas, and NO failure in
areas not listed (what the user saw is what he signed, cert is
bound to signature, etc), then the fact that the user has chosen to use
a keypair with the NR bit set instead of a keypair with the NR bit
clear MAY provide some evidence of intent to the legal process.
Or it may not, if so determined by the ABA, the courts, and the
legislatures.

> Steve, so many things are "implied" -- that one needs to be careful not
> to have "implied security" as well.  What I mean is that we need clear
> and well-defined concepts, if we want clear results.

The technical concepts really aren't that controversial:

1) Symmetric cryptography involves shared secrets, and so cannot be
used to distinguish between parties in a communication.

2) Asymmetric digital signature algorithms have applications (such as
data integrity and entity authentication) other than providing the
electronic analog of a handwritten signature.

3) Asymmetric private keys may be afforded differing levels of
protection, and information in public certificates can communicate to a
verifier the intended application of a specific private key.

What is the goal of this discussion: to argue that there is no such
thing as "technical non-repudiation" as represented by the above three
items, or that the name of the nonRepudiation keyUsage bit should be
changed, or that the NR bit serves no purpose in any conceivable
environment?

The IETF obviously does not claim that a technical mechanism can
"prevent a party in a communication from later denying having
participated in the communication" - anyone can deny anything, and
prisons are chock full of innocent bystanders.  The IETF does claim
that the products under its control (protocol specifications) will not
be the weak link in the chain of evidence used to refute such a
denial.

There are plenty of links in a system designed to be secure - one that
is designed exclusively to prevent an adversary from violating your
self-defined policy, totally ignoring legal concepts such as intent and
burden of proof.  If an IETF protocol specification is not the weak
link in this constrained environment, then it will certainly not be the
weak link when dozens of other legal grounds for successful
repudiation (weaker links) are introduced.