Subject: Re: non-ephemeral vs. non-repudiation, was Re: proposed key usage text

From: [email-masked]
Date: Fri, 19 Nov 1999 14:52:32 -0500

There are multiple definitions of the word "denial" and one of them
yields a sensible meaning for Menezes' definition - see my elaboration
below.  If one assumes the most common definition of the word, as most of
us on the list have done, Menezes' definition is absurd - he must be using
this other one.

          Tom Gindin

Al Arsenault <[email-masked]> on 11/18/99 09:36:43 PM

To:   Ed Gerck <[email-masked]>
cc:   "David P. Kemp" <[email-masked]>, [email-masked]
Subject:  Re: non-ephemeral vs. non-repudiation, was Re: proposed key usage
      text

With all due respect to Ed Gerck and to Menezes, et alia, I must
disagree with Ed's proposed definition of non-repudiation.

The salient point is the absence of the word "falsely"; i.e.,

(Polk & Housley's proposed wording:)

  ...a non-repudiation service which protects against the signing entity
falsely denying some action...

(Menezes's definition, often quoted by Gerck:)

   Non-repudiation: a service that prevents the denial of a previous
act.

[Tom Gindin]  Here are the six definitions given in Webster's New World
Dictionary, boiled down to essentials: 1 - the opposite of compliance; 2 -
the opposite of affirmation; 3 - a disowning or repudiation (the example
given is a denial of one's family); 4 - a refusal to believe; 5 - a refusal
to give; 6 - abstinence.  Obviously, one of the first three definitions is
intended in the standard, and it seems likely to me that Ed and Menezes
intend number 3 (especially since the definition actually uses the term
repudiation), while almost everyone else (including me) thinks that number
2 is the main definition of the word.

To me, the presence of that word "falsely" is important.  Building a
service that purports to hold you responsible for something you can
prove beyond a doubt you didn't do is not in general useful.  (Although
I do acknowledge that there are some very rare situations where it is
useful and even necessary.  Those are not the general case, though.)

[Tom Gindin]   Given the definition of "denial" which Ed is using here, the
correct modifier for it would be "successfully" or "unsuccessfully" rather
than "falsely" or "truly".  However, I question how meaningful the
distinction is between an "unsuccessful denial" in this sense and a "false
denial" in the sense of the primary definition of "denial" (a claim that
something is either not true or not associated with one's self).

In addition, in my search of the technical literature, I find Menezes et
alia almost alone in this definition.  Almost everybody else includes
the word "falsely".  Check Schneier, for example.  Also, the write-up of
non-repudiation in Ford & Baum's "Secure Electronic Commerce" is one of
the better ones, in my opinion, and it certainly doesn't agree with
Menezes. So, I disagree with Ed's assertion that:

(snip)

---

From: Ed Gerck <[email-masked]>
Date: Fri, 19 Nov 1999 13:38:24 -0800

[email-masked] wrote:

> below.

No, speaking for myself ;-) I do not intend #3 to be used.  This should
have been clear by now, after tens (hundreds?) of messages where I
have written more or less always the same words:

"Authentication is akin to the affirmation of a truth, while non-repudiation
is akin to the denial of a falsity. Both are equivalent if and only if the system
is boolean -- which security systems almost never are, since they are not
atomic and they are not binary-valued".

My Webster quotes denial as a "negation in logic" -- and this is what I
always meant and is also what Menezes must have meant as well what
X.509 *itself* meant when it defines:

"Repudiation -- The denial by a user of having participated in part or all
  of a communication."

where one can read:

"Repudiation -- The negation by a user of having participated in part or all
  of a communication."

[Try also cf. Menezes: "non-repudiation -- a service that prevents the
negation  of a previous act."]

Now, if we don't want to split hairs  you may note that your Webster's
#2 preferred definition is akin to my Webster's definition for denial,
as a "negation in logic".  Of course, the "opposite of affirmation" is not
exactly the "negation of affirmation" but is good enough for our purposes.

So, if you have been thinking of #3 while you were reading my messages,
please read them again ;-)

:-) Now, there is a further meaning of denial which could be used in
this discussion, namely -- denial is a refusal to admit the truth or reality.
It is a psychological defense mechanism in which confrontation with a
personal problem or with reality is avoided by denying the existence of
the problem or reality.

Now, regarding the use of "falsely" (or, "truly"), please recall that
non-repudiation is that which prevents even truthful denials. Ben King
has also timely recalled the example of the non-repudiation fee of $50.00
applied to all of us credit-card holders -- maybe, other points could be likewise
recalled by re-reading the archives.

Further, intent or cognizance of ulterior unspoken and unknowable
motives is not in question here.  But,  again, if one insists on defining
PKIX non-repudiation as that which "protects against the signing
entity falsely denying some action" then one must be prepared to
prove that intent (as in false or true denial) can be measured by an
Internet protocol over the wire.  Can you?

Cheers,

Ed Gerck

---

From: Al Arsenault <[email-masked]>
Date: Fri, 19 Nov 1999 17:37:42 -0500

Ed Gerck wrote:
<large amount of material snipped>
> recalled by re-reading the archives.

AWA:  Again, I could not disagree more with this.  Non-repudiation is,
as the definition in 2459, and in Schneier, and in Ford & Baum, and in
... says, concerned with preventing *false denials*.  It should not be
thought of as preventing "truthful denials" - that's such a rare service
(at least in the US) that I don't think that we need to concern
ourselves with it.  Further, I think that if the vast majority of US
consumers understand that we're building Internet security systems that
will hold them liable for things they can prove they didn't do, this
stuff will never get used.  Most consumers understand that if something
happens and they can't prove that they didn't do it, they'll probably
get stuck for something, like the $50 liability mentioned above.  But,
they tend to have faith that if they can prove they didn't do it,
they're not going to be held responsible.  (Most customers, if able to
prove they didn't do something, would be able to beat the $50 charge by
the credit card company, too.  There aren't many courts that are going
to uphold such a contract.)

> Internet protocol over the wire.  Can you?

AWA:  Again, no, you don't have to do this in an Internet protocol; you
do it in the rest of the non-repudiation system/in the courts.

I'll state once again my position: accept the words that Tim and Russ
have proposed, and let's get on with this.

			Al Arsenault

---

From: Tony Bartoletti <[email-masked]>
Date: Fri, 19 Nov 1999 16:24:22 -0800

At 05:37 PM 11/19/1999 -0500, Al Arsenault wrote:
>thought of as preventing "truthful denials" [...]
[snip]

Al,

I would grant you that the "NR-service" implied in the definition of the
NR-bit is not intended by the drafters to prevent "truthful denials"
as a design goal.  But that is not really the issue.  For instance,
if indeed I needed to set up a system that would prevent "true denials",
it seems the NR-bit is still the bit I would require, as a signal for
later presentation of evidence.

My issue with the wording is that of the term "signer", and the phrase
"denying some action".

It is not the "signer", but the "certificate owner" that is being held
to accounts.  So why not say so?

Also, my NR signature on a recent purchase order cannot prevent me from
denying I was the second gunman on the grassy knoll in Dallas.  So why
not a bit greater specifics about the "some action" I shall not deny?

We all agree, I believe, that the math itself demonstrates the key used
in a disputed signature, so that cannot be the reasonable issue.  The
same math, applied to the CA signature key, makes the binding of the
cert-owner-name to the signature-key of the disputed signature just
as virtually indisputable.  No need yet for the NR-bit.  Hmmm.

So, just what is the "some action" that the NR-service intends to
prevent the cert-owner from denying?  The only realistic possibilities
that remain are:

    Active Participant In Signature (fingerprint on the button)

    Willful Participant In Signature (no arm-twisting allowed)

    Cognizance In The Signing (knew what was being signed, even if they
      authorized their secretary to push the button)

    Liability For The Signature (throw kitchen sink in here)

But above all, it is the Named-Cert-Owner who is to be prevented from
denying.  Calling this party the "signer" is a bit like using the desired
conclusion as an axiom in the argument.  It is also a bit misleading:

  "Hey, I think I'll buy LOTS of these newfangled NR-certified keys, and
   leave them around the office.  They might be useful.  Heck, I'm not
   worried if some of the staff use them.  After all, NR is dee-signed
   only to hold the "true signer" accountable. Yup. Yessir."

Is my point here clear?  The current NR-bit definition sounds just a bit
too "mostly harmless".  Who can argue with catching FALSE denials?  Its
comes off a bit like the sell for crypto-restrictions, namely "you don't
want criminals to get away, do you?"

The NR-bit, if it comes to mean anything, is like a strong prescription
drug, and should not be given a cavalier over-the-counter dispensation.

___tony___

Tony Bartoletti                                             LL
IOWA Center                                              LL LL
Lawrence Livermore National Laboratory                LL LL LL
PO Box 808, L - 089                                   LL LL LL
Livermore, CA 94551-9900                              LL LL LLLLLLLL
phone: 925-422-3881   fax: 925-423-8081               LL LLLLLLLL
email: [email-masked]                                   LLLLLLLL