Subject: Re: NR-Bit Truth-In-Advertising

From: [email-masked]
Date: Fri, 19 Nov 1999 22:32:32 -0500

I don't think that the list of claims given (denial of ownership, key
compromise, etc. ) is the list of claims that the NR service protects
against.  In fact, that was my guess at the list of claims which the NR
service may not be able to guarantee against.  What the NR services should
be able to do is to provide a level of certainty for the validity of the
specified signature high enough that a party disclaiming such a signature
needs to establish one of those claims with some level of real proof - the
level required not being a technical matter which this group can help with.
     Some NR products may help weaken or eliminate some of the claims on
the list, but I seriously doubt that PKIX can do much about signer
incompetence or duress.

          Tom Gindin

Tony Bartoletti <[email-masked]> on 11/19/99 09:51:28 PM

To:   Tim Polk <[email-masked]>, [email-masked]
cc:
Subject:  NR-Bit Truth-In-Advertising

Tim,

My problem with the suggested wording in 4.2.1.3 Key Usage:

   The nonRepudiation bit is asserted when the subject public key is
   used to verify digital signatures used to provide a non-repudiation
   service which protects against the signing entity falsely denying
   some action, excluding certificate or CRL signing.  In the case of
   later conflict, a reliable third party may determine the authenticity
   of the signed data.

First, the term "signing entity" is misleading.  The central theme of NR
is to establish that the "named-cert-holder" is first of all the signer
in question, and the one who must bear the burden of proving a "true
denial" in the face of a presumption of falsity.  For instance, if my
NR-key is compromised, and a stranger uses it to sign, NR is not going
to begin by challenging the stranger in his false denial, even though
he is the "true signer".  The point is, I may be forced to accept my
role or responsibility, especially in an unsubstantiable compromise.

So, in the interest of "truth in advertizing", I offer my

   Suggested Replacement, short version:

   The nonRepudiation bit is asserted when the subject public key is
   used to verify digital signatures used to provide a non-repudiation
   service which protects against the named certificate subject falsely
   denying responsibility for a signature generated by the certified key,
   excluding certificate or CRL signing.  Such service may allow a
   determine the veracity of various elements in a claim of repudiation.

Second, the term "some action" is way-overly vague.  I know there are
many kinds of NR, and we cannot hope to enumerate them all, but why not
be a bit more specific, helpful?  Here is a suggestion, borrowing from
Tom Gindin's partial enumeration:

   Suggested Replacement, long version:

   The nonRepudiation bit is asserted when the subject public key is
   used to verify digital signatures used to provide a non-repudiation
   service which protects against the named certificate subject falsely
   denying responsibility for a signature generated by the certified key,
   through false claims that may include denial of ownership, assertion
   of key compromise, assertion of misleading presentation, assertion of
   software problem, or of incompetence or duress, excluding certificate
   or CRL signing.  Such service may allow a reliable third party to
   determine the veracity of various elements in a claim of repudiation.

Finally, I was not happy with the last sentence, in particular the
mere "authenticity of the signed data".  This suggests that the reliable
third party may do no more than help establish that the signing key was
actually used, and the certificate valid at the time.  If that was all
there were, we should adopt Tom Gindin's version directly, since it
refers to this property alone.  Perhaps the intent was for "signed data"
to refer to ALL of the elements that an NR service might archive with
respect to a transaction.  My suggestion would be to replace

   In the case of later conflict, a reliable third party may determine
   the authenticity of the signed data.

with the more general

   Such service may allow a reliable third party to determine the
   veracity of various elements in a claim of repudiation.

____tony____

Tony Bartoletti                                             LL
IOWA Center                                              LL LL
Lawrence Livermore National Laboratory                LL LL LL
PO Box 808, L - 089                                   LL LL LL
Livermore, CA 94551-9900                              LL LL LLLLLLLL
phone: 925-422-3881   fax: 925-423-8081               LL LLLLLLLL
email: [email-masked]                                   LLLLLLLL

---

From: Tony Bartoletti <[email-masked]>
Date: Mon, 22 Nov 1999 10:36:08 -0800

>the list, but I seriously doubt that PKIX can do much about signer

Tom,

I do agree, and in that respect I support your suggested version.  But to
those who want the bit to say "this CA is OK with using such a cert to
support a service that hopes to provide some or all of those provisions"
then at least the listed provisions give someone more of a clue than just
"protects against the signing entity falsely denying some action".  And I
still object to "signing entity", since the term tends to hide that fact
that "presumption begins with the cert-holder".

I keep returning to the point that these Key Usage bits and definitions
are mostly guidance for the folks that make "conforming" software.  That
is why your version is reasonable.  I would have some idea what I was
supposed to conform to.  The standing definition leaves far too much
to my limited imagination... :)

___tony___

Tony Bartoletti                                             LL
IOWA Center                                              LL LL