Subject: Re: Non-Repudiation

From: "Bob Jueneman" <[email-masked]>
Date: Fri, 13 Aug 1999 17:17:43 -0600

>>> Stephen Kent <[email-masked]> 08/13/99 04:32PM >>>
[snip]
>Most of "we" are not trying to do what you suggest.  We are defining a bit
>and explaining what we mean when the bit is turn on or off.  Others will
>decide, over time, how that fits into any specific legal context.  We have
>an obligation to make good technical decisions regarding the syntax and
>processing for our protocols, and I believe that we are doing just that.

The issue is not the syntax, but the semantics, and semantics necessarily
involve more than just "good technical decisions".  Such decisions have
to fit into a broader context of how the specifications and products 
embodying them are to be used.

[snip]

>Deliberation on a topic is valuable up to a point.  I think we passed that
>point on this topic a while ago.

Pardon me, Steve, but the fact that this issue has droned on for a number
of years without any satisfactory resolution is an obvious indication that 
there is a lack of consensus on this.  

On the contrary, there seems to be a fair amount of consensus that the
current definition and explanation of "what we mean when the bit is 
turned on or off"  is NOT adequate, and NOT a good technical decision,
and various people are trying to decide how to fix it.

Bob

---

From: Tony Bartoletti <[email-masked]>
Date: Fri, 13 Aug 1999 17:34:51 -0700

Bob and Stephen,

You both make valid points, and I don't know where best to draw a line
between syntax and semantics.  One certainly cannot imbue a bit with
any meaning besides "on/off", and yet its utility must be made clear.

Otherwise, I suggest adding an "Alpha-bit" to the profile with the
following utility:

  1.  PKIX-compliant products must recognize the Alpha-bit.
  2.  Each CA is free to accept or reject certificate requests
      according to the Alpha-bit setting. 
  3.  Refer to each CA's CP/CPS regarding the intention of that
      CA with respect to the Alpha-bit setting.

Of course, Relying-Parties should be aware of both the CA's intent
regarding the Alpha-bit, as well as their own vendor's certificate
software (browser) processing behaviors regarding the Alpha-bit,
lest they incur unexpected liabilities.

OK, The profile says more about the NR-bit than the Alpha-bit.
But not sufficient to preclude these debates, it seems.

___tony___