Subject: Re: Meaning of Non-repudiation

From: Peter Sylvester <[email-masked]>
Date: Wed, 11 Apr 2001 19:33:55 +0200 (MET DST)

Effective only at time of generation seems somewhat difficult;
it always happens later. 

What is the essential difference between some authentication 
handshake 'on line' or some exchange using S/MIME.

Consider for example just signature on domain boundaries, 

Or between a user and and ISP relay in order to allow
relaying from authorized users etc.   

> I agree completely with your "not considered binding", as long as there
> is an explicit statement that binding means persistent - i.e., effective
> for some time after generation, as opposed to effective only at the
> time of generation.  Here is the litmus test: do you agree that in
> order to validate a signature on an S/MIME message (any message, for
> any purpose, signed by any entity), the NR bit must be set?
>

---

From: "David P. Kemp" <[email-masked]>
Date: Wed, 11 Apr 2001 15:05:12 -0400

> Effective only at time of generation seems somewhat difficult;

Sometimes one sacrifices rigor for clarity.  A more precise expression
of the HAK remark might be:

   A fundamental distinction exists between a party A being able to
   convince itself at time t0+e of the validity of a digital
   signature s generated at time t0, and that party being able to
   convince others at some time t1 >= t0+e that s was valid at
   time t0.

For all practical purposes, e (read epsilon, a very small value)
could be fixed at one minute without significantly affecting
the use cases.  If you receive a signed message one second after
it was sent and know that the signature will become invalid 59 seconds
later, the lack of the NR bit will have achieved its purpose.
If the signature is not "binding" then your user agent should not
treat it as binding; it should authenticate the message and then
discard the authentication information before storing the message.

> handshake 'on line' or some [authentication] exchange using S/MIME.
> 

No difference - that's the point.  If the client signs S/MIME data
without NR and sends it to the domain gateway, the gateway bcomes
responsible for the data's integrity because the client signature
becomes invalid one hop or 59 seconds hence.  A proper gateway will
honor the keyUsage bit and strip off the now-useless client signature
exactly as it would strip off an SSL protocol layer before forwarding
the data.

If the client signs with NR, then the domain signature could optionally
be added to it rather than replacing it.

---

From: Stephen Kent <[email-masked]>
Date: Mon, 16 Apr 2001 18:36:43 -0400

>relaying from authorized users etc.

Non repudiation is largely an application layer issue, if one 
believes that a person is making a binding commitment when NR is 
mentioned. So, a signed authentication handshake might prove that 
someone accessed a site, but it does not say what the person did 
while accessing the site. Also, most authentication handshakes do not 
make provision for third party time stamping, an essential element of 
most non-repudiation schemes.  So, no, I don't view those sorts of 
signed transactions as being the same as an S/MIME message.

Steve