Subject: Re: NR, redux, again.

From: [email-masked]
Date: Tue, 2 Nov 1999 12:23:06 -0500

(snip)
All,

I think we have long agreed that a single NR-bit is of very limited
utility in conveying the range of qualities we may need to assert in
non-repudiation.  (Ed Gerck's taxonomy and Tom Gindin's codification
are certainly a solid representation of this range.)  In particular,
as Bob reminds us, there is no a-priori reason to assume that NR is
strictly (or even best) the job of the CA.

As a exercise, it may be useful to imagine that you are going to set
yourself up as an "Full-Serve Digital NR Service" but you are NOT a CA.
Of course, you will be involved with digital documents, signatures,
certificates, independent time-stamps, and countless other concerns.
Now the question to ask is "What, if anything, would you want a given
certificate's NR-bit to signify?"  Of what utility is it to you?

Being a full NR service, I imagine you will certainly be archiving
relevant objects as a matter of course, so do you care if the CA is
providing (redundant) long-term storage?  I doubt so.  Hence the
association of cert NR-bit with cert "lifetime" is misplaced.

[Tom Gindin]   The CA is the logical candidate to provide long-term storage
for CRL's in those cases where NR is supported.  Because a revocation may
carry a claim about "invalidityDate", the NR service cannot be sure when it
has sufficient evidence that the subject of the certificate for the signing
key pair will not claim that the signature was invalid because of key
compromise - simply having a CRL dated later than the signature is not
enough.  However, this is not an issue with certificate lifetime.  I know
of no other long-term storage that any NR service can expect from the CA.

I can understand why some folks (CAs) would like to limit the NR-bit
to such a simple notion.  It is "do-able", and they are under pressure
to "do NR" from some quarters.

[Tom Gindin]   CRL archiving is all the CA needs to do to support NR.  That
does not mean that it is all that must be done for NR.

Comments?

___tony___

Tony Bartoletti                                             LL
IOWA Center                                              LL LL
Lawrence Livermore National Laboratory                LL LL LL
PO Box 808, L - 089                                   LL LL LL
Livermore, CA 94551-9900                              LL LL LLLLLLLL
phone: 925-422-3881   fax: 925-423-8081               LL LLLLLLLL
email: [email-masked]                                   LLLLLLLL

---

From: Tony Bartoletti <[email-masked]>
Date: Tue, 02 Nov 1999 11:15:21 -0800

>does not mean that it is all that must be done for NR.

Hmmm.  Regarding the CA, that depends on what one expects from NR.

Question:  What exactly does CRL archiving do for you?
Answer:    You can establish that CA-x held Cert-y valid at time t.
           Would you need to have your own timestamped archive of the
           the CA's (public) CRL-signing key taken while it was itself
           valid, to be more comfortable?

If this is exactly what the "NR-bit" will imply, then it should be
called the "CRL-Archive-bit" and the debate about its implications
will be greatly reduced.

But I am missing something here.  To "NR" a transaction, I will need the
(supposedly) signed elements of the transaction to be timestamped and
archived at (near?) the time of transaction, true?  In particular, the
NR-service (at the outset) would test that the supposed EE-signature
actually verifies with a cert valid according to a current CRL.
(Else a revoked and "discarded key" might be used to forge a pre-dated
element.)  But if the NR-service must archive "some" elements at/near
the transaction time, then why not the relevant CRL itself?

Still, I ask myself "Is this all that I want from a CA in support of an
NR-transaction?"  Would I not want some "better" assurance, or evidence
that the EE who was issued this key was who they claimed to be?

Put another way, if I were a sloppy CA, handing out certs blindly,
(and my CP/CPS admits as much) but I dutifully archive my CRL's,
would my signing of an NR-bit on a cert be of any real value to
the individual (RP) who wants a transaction to be NR?  Would not
the RP be laughed out of court once the CP/CPS was entered into
evidence?  And contrastingly, if the CP/CPS were strong, wouldn't
that document need to be timestamped/archived circa the transaction?

___tony___  

Tony Bartoletti                                             LL
IOWA Center                                              LL LL