Subject: Re: NR Signing-Entity vs Certificate-Subject

From: [email-masked]
Date: Mon, 22 Nov 1999 18:37:06 -0500

The main reason for using "signing entity" here is that if the named
certificate subject can PROVE that he was not the signing entity he may
well not be held responsible.  If he can prove that the certificate was
issued to someone else as a result of a masquerade he probably will not be
held responsible.
     However, it is worth reiterating that there are only two basic ways
for the law to treat the question of whether the certificate subject is the
signing entity: in the first, the certificate subject must prove that he
was not the signing entity; and in the second, where the relying party must
prove that the certificate subject was the signing entity, the NR service
is not likely to be of much use.
     That particular program would be better off asking for a PIN.

          Tom Gindin

Tony Bartoletti <[email-masked]> on 11/22/99 05:59:33 PM

To:   "[email-masked]" <[email-masked]>
cc:
Subject:  NR Signing-Entity vs Certificate-Subject

All,

Would it not be more "up front" to refer to the "signing entity"
in the NR definition as the "certificate subject"?

Granted, in these circles it may seem to be another one of those
"understood" things, but to common folk it might appear a bit
disengenuous.

Suppose I am about to execute an electronic contract with you,
and I'm all ready to hit the "sign with NR here" button.  But I
have second thoughts, and get up to brew another cup of coffee.
In my absense, a neighbor walks in, and out of mischief or
misguided helpfulness, clicks the button for me.

Who is the "signing entity"?

(Yes, I may well be the liable party, and "effectively" the
signing entity.  But many would reasonable hold that the person
who "effected the signature" was the neighbor.  So... )

I go to court (or am taken there upon refusal to honor the
contract) and I subpoena my (now uncooperative) neighbor as a
hostile witness, claiming that they perpetrated a fraud by
signing with my signature key.  The neighbor falsely denies it.

The NR definition says "protects against the signing entity
falsely denying...".  Now in fact, my neighbor is the signing
entity, and is falsely denying!  But NR is not interested!

As the relying party, you don't care to be protected from my
neighbor's false denials (especially is they have no assets;)
You intend to hold ME responsible (as I may well be through
negligence) and NR only serves you in this regard.  Why ME?
Not because I am the "signing entity" in the commonly used
sense, but because I am the certified key holder.

So why not replace "signing entity" with "certificate subject"
and eliminate one more point of semantic indirection and
confusion?  Unless you are prepared to be able to distinguish
the two (especially via the NR service) I see no reason to
obscure this issue.

___tony___

Tony Bartoletti                                             LL
IOWA Center                                              LL LL
Lawrence Livermore National Laboratory                LL LL LL
PO Box 808, L - 089                                   LL LL LL
Livermore, CA 94551-9900                              LL LL LLLLLLLL
phone: 925-422-3881   fax: 925-423-8081               LL LLLLLLLL
email: [email-masked]                                   LLLLLLLL

---

From: Ed Gerck <[email-masked]>
Date: Mon, 22 Nov 1999 17:31:15 -0800

> issued to someone else as a result of a masquerade he probably will not be

The object "signing entity" is nowhere defined in X.509, and is used only once.
So, what you mention is not written and should be used as an argument unless
you are actually proposing a change to X.509 and PKIX.

OTOH, since DNs in X.509 are not unambiguous to individuals  (and, were
never intended to be, even in a local registry under X.500),  X.509 certificates
cannot be considered proof of identity -- neither legally nor protocol-wise.

The distinction between "signing entity" and "certificate subject" (aka key
holder, or certificate subscriber) is thus artificial and *cannot* be dealt with
within X.509. Hence, if any, it must lie outside the scope of X.509.

Thus, it makes sense to substitute it for "certificate subject" -- a well-defined
object, visible in the certificate.

> is not likely to be of much use.

I suggest that digressing to legal evaluation will not be very helpful here.
However, the NR service can be of use if the technical assessment can prove
within an acceptable margin that the subject's private-key was used to
produce the signature. Further, the NR service can be of use if the technical
assessment can prove within an acceptable margin that the subject's
private-key was not used to produce the signature.

Likewise, though, there are "only two basic ways" -- either is was or was not ;-)
Of course, in law and here, this means that one is using an explicit  threshhold
value  in the balance of probabilities in order to differentiate between each way.

Cheers,

Ed Gerck

---

From: Tony Bartoletti <[email-masked]>
Date: Mon, 22 Nov 1999 17:33:06 -0800

At 06:37 PM 11/22/1999 -0500, you wrote:

(pardon me if I break the first paragraph into two parts.)

>well not be held responsible.

OK, suppose I PROVE that I (true-cert-owner) was NOT the signing entity.

In which case, the "signing entity" was "Mr. Else".  So the description

  "prevent the signing entity from falsely denying some actions"

would seem to imply that NR helps to prevent this "Mr. Else" from
falsely denying HIS role.  But of course it does not.

In essence, its real meaning is "prevents the cert-subject from denying
they are the signing entity unless (perhaps) they can prove otherwise."

Or perhaps "places burden of proof upon the cert subject upon their
denial of signature (authenticity, liability, actuality, pick any)."

In any case, a full explanation involves the term "cert-subject" at
some point, and this is missing, IMO.  It treats "signing entity" as
a nebulous quantity.  Is it the OK-button-pusher?  Is it the party
who willfully unlocked the signing key, but turned away while his
mischevious cat stepped on the OK-send button?  Where is the term
"signing entity" defined with any particular care in this regard?

Especially, does NR=1 trigger some assumption about the *identity*
of the "signing entity" that NR=0 does not?
  
>If he can prove that the certificate was

That sounds fairly difficult!  If its as easy to get other folks credentia
are we are led to believe (credit card receipts, credit reports, etc) and
someone doesn't like you, they fraudulently obtain a NR-cert/key in your
name, and proceed to bind you in knots.  It would seem that NR serves them
very nicely.

>is not likely to be of much use.

But is that not precisely its intended use?  That is, to place the burden
of proof on the cert-subject to show they were:

(a) not the certOwnerInFact (nor the signer), in case of cert fraud, or
(b) not the signer, in case of key compromise or even carelessness?

Is the burden suddenly shifted to the RP because the (supposed) cert
subject proclaims "I never requested/obtained that cert"?  Sounds too
easy.

___tony___

Tony Bartoletti                                             LL
IOWA Center                                              LL LL