Subject: Re: proposed key usage text

From: "David P. Kemp" <[email-masked]>
Date: Thu, 18 Nov 1999 09:20:04 -0500 (EST)

> From: Stefan Santesson <[email-masked]>
> 
> Some systems will in fact use this information to technically separate keys
> used for the challenge/response type of signing (DS bit) and the electronic
> signature on a message type of signing (NR-bit). So this IS a very useful and
> relevant distinction, even in absence of a policy.
> 
> At 04:26 PM 11/18/99 +0000, Peter Gutmann wrote:
> >
> >Why not use NR vs digitalSignature to distinguish long-term signature vs 
> >short-term authentication signing?  Several standards already use it for 
this,
> >this usage at least is practical and meaningful.

Which is where we started before Bob screwed things up seven months
ago :-) :

> Date: Fri, 30 Apr 1999 13:37:05 -0600
> From: "Bob Jueneman" <[email-masked]>
> 
> Recently, we have been having some discussion regarding 
> Nonrepudiation on the cert-talk list, and I have been taking the 
> position that the Nonrepudiation key usage bit should be reserved
> for those key pairs that are used exclusively to indicate the user's
> conscious and willing intent to be legally bound by what is being 
> signed.

I agree with Stefan and Peter that we should turn back the clock to
April 29, and use the bit to specify exclusively concrete usage of the
key by applications.  Any probative value of signed evidence would
derive from the way applications apply the private key and how the 
private key has been handled, not on the state of the NR bit in a
particular public key cert.

---

From: Ed Gerck <[email-masked]>
Date: Thu, 18 Nov 1999 09:57:57 -0800

"David P. Kemp" wrote:

> > this, this usage at least is practical and meaningful.

Short-term authentication signing is an attribute of the signature and is based
on an ephemeral key valid during a session, while long-term signature is an
attribute both of the signature and of the certificate and is based on a
non-ephemeral public-key which may be valid during many years (even if
the private-key is destroyed and especially so).

Of course, one could have a long-term certificate used for short-term
signing, but the certificate lifetime should not be confused with the NR
bit in this case while the authentication would be still short-term as
defined in its signed attributes.

Also, PKIX standard is free to call "non-repudiation" what is
"non-ephemeral" but this seems to *add* to the confusion, no?
It would decrease interoperation with accepted usages of the term, in
the real-world of business for example.  Or, when one consults a
dictionary. Or, with technical cryptographic texts and textbooks.
It would be a private language.

> key by applications.

I agree with this, but I don't need to travel back in time for it. Rather,
requiring "concrete usage of the key by applications" is what has
been the cornerstone of these discussions after April 29th, where the
lack of a real-world model for NR bit usage was apparent in the former
work.

> Any probative value of signed evidence would

Agreed, as I don't subscribe to the notion that "intent" can
be present or be measurable by a bag of bytes.  Further,
a bank teller will not ask whether you "intended" to sign a
check that was paid and then kindly reverse the charge to the
bank if you say "No", but will verify whether the signature
cannot be distinguished from your signature in the archives --
in which case the teller will pay the check and will not reverse
it, even if you later on prove that you were in coma shock
that day.

So, "intent" has nothing to do with non-repudiation.  Nor,
whether it is ephemeral. An order to fire a bomb needs to
be non-repudiable and yet it is very ephemeral.

Cheers,

Ed Gerck

---

From: Stephen Kent <[email-masked]>
Date: Thu, 18 Nov 1999 15:59:22 -0500

Ed,

>the private-key is destroyed and especially so).
This might be nice, but it is not generally true.  Many (most?) 
protocols today that use signature for authentication do so using 
long term keys held in certs, not ephemeral signing keys, perhaps 
held in very short lived certs.  Since several standard protocols do 
operate in this fashion,e.g., TLS and IKE, and since there is not 
general agreement that this is a bad thing, let's not make statements 
of this sort a basis for further deliberation.

Steve

---

From: Ed Gerck <[email-masked]>
Date: Thu, 18 Nov 1999 14:26:25 -0800

Stephen Kent wrote:

> Ed Gerck wrote:
>
> >Short-term authentication signing is an attribute of the signature
> >and is based on an ephemeral key valid during a session, while
> >long-term signature is an attribute both of the signature and of the
> >certificate and is based on a non-ephemeral public-key which may
> >be valid during many years (even if the private-key is destroyed
> >and especially so).
> >
> operate in this fashion,e.g., TLS and IKE,

But they explictly do (most?) -- short-term authentication signing
pertains to the session, not to the message sent.  The difference is
between signing the protocol messages and signing what is conveyed
(tunneled) by the protocol, of course.  This is the difference I am
emphasizing, even though some protocol implementations may use the
same key for  both.  I surely can use different keys for both -- nowadays.

> and since there is not

There is a general agreement that a NR cert (whatever that beast
might turn out to be) should not be used for non-NR purposes.
This is what I am saying, no more.

Cheers,

Ed Gerck

---

From: Stephen Kent <[email-masked]>
Date: Thu, 18 Nov 1999 17:46:52 -0500

Ed,
>same key for  both.  I surely can use different keys for both -- nowadays.

Yes, the protocols in question sign data for session authentication, 
not data sent during the session.  We agree on that.  I objected to 
your comment that the keys used for such signing were ephemeral, 
which is untrue.

>This is what I am saying, no more.

Yes, we agree on that point as well.

steve

---

From: Ed Gerck <[email-masked]>
Date: Thu, 18 Nov 1999 16:24:45 -0800

> your comment that the keys used for such signing were ephemeral,

Steve:

The keys used for session signing could be ephemeral, and yet the
session may be NR.  OTOH, the keys used for message signing may
be non-ephemeral and yet the message may be non-NR (sorry for
the double negative ;-) -- ie, repudiable).

So, what I was pointing out is that equating "non-ephemeral" with
"non-repudiation" is similar to equating apples to speedboats -- they
are two different concepts. Namely, the time window of signature
usefulness and the context window of signature validity.

That is why "encoding" the NR attribute as a time window of signature
usefulness will not be sucessful, IMO.

Cheers,

Ed Gerck

---

From: Stephen Kent <[email-masked]>
Date: Thu, 18 Nov 1999 19:35:40 -0500

Ed,

i was discussing reality, as reflected in standard protocols, as I 
said.  None of them use ephemeral signing key for authentication. I 
was not discussing what one might do, or why.

Steve

---

From: Al Arsenault <[email-masked]>
Date: Thu, 18 Nov 1999 21:36:43 -0500

With all due respect to Ed Gerck and to Menezes, et alia, I must
disagree with Ed's proposed definition of non-repudiation.

The salient point is the absence of the word "falsely"; i.e.,

(Polk & Housley's proposed wording:)

  ...a non-repudiation service which protects against the signing entity
falsely denying some action...

(Menezes's definition, often quoted by Gerck:)

   Non-repudiation: a service that prevents the denial of a previous
act.

To me, the presence of that word "falsely" is important.  Building a
service that purports to hold you responsible for something you can
prove beyond a doubt you didn't do is not in general useful.  (Although
I do acknowledge that there are some very rare situations where it is
useful and even necessary.  Those are not the general case, though.)

In addition, in my search of the technical literature, I find Menezes et
alia almost alone in this definition.  Almost everybody else includes
the word "falsely".  Check Schneier, for example.  Also, the write-up of
non-repudiation in Ford & Baum's "Secure Electronic Commerce" is one of
the better ones, in my opinion, and it certainly doesn't agree with

> It would be a private language.

It might disagree with some limited set of texts, but not what appears
to me to be the majority.

Added to all of this is that, at least in the US legal system (and yes,
I recognize the international scope of PKIX, but I'm simply not as
familiar with other legal systems), any "contract" which purported to
hold me liable for something that I can prove I didn't do will almost
assuredly be tossed out in court as being "unfair" to me.  This is
particulary true when an individual is dealing with a large institution
such as a bank.  So, when Ed says:

> ... Further,

My attorney asserts that this is most assuredly not true, at least under
the US/Maryland legal systems.  She's confident that, as a competent
attorney, if we could "prove" that I could not possibly have written the
check, she could win this case in court, and get the money restored to
my account.  (Of course, I'd wind up paying her in legal fees far more
than the amount of any check that could possibly clear against my
account, so I'd have to make a tough choice, but that's a different
issue. :-)

I liked the words that Tim and Russ proposed.  I suggest that we go with
them.

			Al Arsenault

-- this message reflects the opinion of the author only, and may or may
not reflect the policies of his employer or of any other organization
with which he has a relationship.

---

From: Ed Gerck <[email-masked]>
Date: Thu, 18 Nov 1999 22:57:34 -0800

Al Arsenault wrote:

> ... when Ed says:
> my account.

I can understand how she can say this *before* reading the
contract you have with your bank ... but not afterwards.  Most
probably, your bank has the same non-repudiation terms found in
bank contracts in the UK (common law) and which I quoted here
before.  Yes, even if you could prove beyond any doubt that you
did not write that check, as long as:

(i) the bank teller could not have (in the balance of probabilities)
distinguished the check signature from a signature you did *not*
make, and

(ii) you could *not* prove that you told the bank not to cash that
check *before* the check hit the bank teller,

you cannot repudiate that check. Freedom of contract has allowed
you and the bank to define mutually acceptable rules, to which
you must comply. Legally, in the US also.

The same goes for your other examples of different technical
definitions for non-repudiation -- X.509 itself agrees with Menezes,
as I pointed out in another thread today.  But,  if one insists on
defining non-repudiation as that which "protects against the signing
entity falsely denying some action" then one must be prepared to
prove that intent (as in false or true denial) can be measured by a
protocol over the wire.  Can you?

Cheers,

Ed Gerck

---

From: Al Arsenault <[email-masked]>
Date: Fri, 19 Nov 1999 17:15:39 -0500

(comment in line, below)

> you must comply. Legally, in the US also.

AWA:  No, this is not correct in the US.  I *can* and *will* repudiate
that check, and will most likely prevail in court. 

I readily acknowledge not knowing UK law on this point.  So, I will not
dispute what you say - I will leave support or disagreement for your
point to those who know what they're talking about.

According to my attorney's overview, this is how the argument would go:

	- remember that, as Ed himself has pointed out, any contract can be
nullified under the UCC if it is on its face unfair to one of the
signing parties.  This is particularly true if the party to which it is
unfair is a "standard consumer", and the other party is a
well-resourced, experienced organization.

	- so the trick would be to show that the contract between myself and
the bank is unfair to me.  This is accomplished as follows:

	1) prove that fraud can be committed.  This is trivial, given our
assumptions.  I can prove that I did not sign the check.  The bank
asserts that it has a signed check.  Therefore, fraud was committed, and
therefore fraud can be committed.  

	2) show that the bank itself could have committed the fraud. (I don't
have to show that the bank DID commit the fraud, or that it has ever
committed such fraud; just that it could.) This is the tricky part, but
what you would do is show that the bank could easily have gotten a check
printed up that would be valid for my account, and that the bank could
have forged my signature to meet their standards.  This most likely can
be shown - since the bank controls the standards for the signature, and
somebody is capable of meething their standards, as shown in 1), the
bank could if it wanted commit the fraud.

	3) show that if the bank did commit this fraud, I would be defenseless
under the terms of the contract.  That is, assuming that the terms of
the contract were in force, and that the bank had a "department of
forgery" set up to steal money from customers' accounts through forged
checks, I would be absolutely powerless to stop the bank from stealing
every nickel I have - they hold all the cards in the game.

Given these three items, it becomes clear that a contract that holds me
liable for something I can prove I didn't do is so one-sided in the
bank's favor that it is unfair to me, and thus the contract would be
nullified.

Now, in fact it would probably come down to which side had the better
lawyer, and who the judge was, but the lawyers I've talked to about this
are pretty confident about the scenario I've described.  Thus, Ed, I'm
going to stick to my disagreement with you.

> protocol over the wire.  Can you?

AWA:  No, I disagree with this point completely.  I do not have to prove
intent via a protocol over a wire.  "False denial" means that in point
of fact I did it and I'm trying to argue I didn't.  "True denial" means
that I really didn't do it, and I'm arguing that.  No protocol can ever
know which human is doing something, and thus whether a later denial
will be true or false.  That's what the rest of the non-repudiation
system is for.

The only place "intent" ever enters into non-repudiation is if I did
something without understanding the full implications of it - that is, I
signed a blank check and gave it to Dave K. to hold.  There, I really
did something, but I didn't mean for him to clean out my entire account,
just get 20 bucks cash for me. You can't tell that in a protocol,
either; that's what the rest of the NR system is for.

			Al Arsenault

-- insert usual disclaimer about this not reflecting my employer's
policies here.

---

From: Ed Gerck <[email-masked]>
Date: Fri, 19 Nov 1999 16:55:02 -0800

> going to stick to my disagreement with you.

I see your "lawyer" text as fiction, especially in the US where banks
dictate the rules over consumers.  For your benefit, however, I suggest
you read your bank's policies on check cancellation.  Or, if you provide me
your bank's name, I can gratuitously get them for you and point out where
you are amiss.

> I do not have to prove intent via a protocol over a wire.  "False denial"
> means that in point of fact I did it and I'm trying to argue I didn't.

"Point of fact" is unknown -- perhaps an omniscient being can tell you
what "point of fact" is, but I doubt anyone else could.

Cheers,

Ed Gerck