Subject: RE: Meaning of Non-repudiation

From: "Aisenberg, Michael" <[email-masked]>
Date: Thu, 5 Apr 2001 16:00:38 -0400

Am I missing something--Isn't the concept of non-repudiation to be framed
against the precedent of "repudiation" in the Code----2-610.
 
Isn't the point of this great adventure to develop a common syntax for
deployment of certificate policies, not draw distinctions and
create arguments for exceptions.  Complexities of this sort strike me as
being at the heart of marketplace resistance....
 
Michael Aisenberg 

-----Original Message-----
From: Dr. JohnDavid Hascup [mailto:[email-masked]]
Sent: Thursday, April 05, 2001 1:15 PM
To: Dave Oshman; [email-masked]
Subject: RE: Meaning of Non-repudiation

Dave

-----Original Message-----
From: Dave Oshman [mailto:[email-masked]]
Sent: Thursday, April 05, 2001 9:24 AM
To: [email-masked]
Subject: Meaning of Non-repudiation

I am trying to clarify the meaning of non-repudiation (as defined by the
technology standards) for our legal counsel. 2459 says this about
non-repudiation:
[JDH] this is the abyss of PKI. Having spent over three years working with
legal counsel on how to understand non-repudiation I have yet to find a
viable "legal" interpretation of the technological protocol. I think the
past year Tom Grindin was developing a "technical non-repudiation" draft
which I think has lapsed as of the past meeting in Minneapolis. It was an
attempt to ground non-repudiation with a meaning that would be "legal"
neutral but protocol specific.

     The nonRepudiation bit is asserted when the subject public key is 
      used to verify digital signatures used to provide a non- 
      repudiation service which protects against the signing entity 
      falsely denying some action, excluding certificate or CRL signing. 

The question is what does "some action" mean? Is the action merely signing
the transaction? Or, is the action perhaps committing to the terms described
in the signed transaction?

To rephrase: Is non-repudiation stating simply that I, Dave Oshman, signed
this document? Or, is it supposed to mean that I, Dave Oshman, attest that I
am committing myself (or my company) to the terms described herein?
[JDH] IMO "legal" non-repudiation must be set via the entire environment of
the PKI as specifically defined in whatever policies the RP sets. This means
that it is the RP's use of the bit or non-use that is important. The reason
I felt this was due to the fact that once the question enters the court it,
the technical setting of the bit is not what is important but rather the
interpretation placed upon it by the RP and thus the EE. Apart from a "clear
stated policy" of what the RP intends for it's understanding of
non-repudiation the technical aspects are meaningless. The asserting of the
bit must be given meaning in the context of the environment and cannot have
a meaning legally apart from that environment. Therefore, your second
meaning can only be grounded in the policies set by the environment in which
you are signing and not in the technical underlying protocol. As for the
first, at most, one can argue that the cert granted to you signed. This is
why we had such a difficult time moving "technical" non-repudiation into a
legal context. What is the legal relationship between the certificate and
the person to whom the cert was issued. The protocol can offer forensic
evidence regarding the relationship and the actions of the cert but in and
of itself offers no legal meaning.

Is this more clearly defined in X.813 (ITU-T Recommendation X.8131) |
ISO/IEC 10181-3:...1), Information technology - Open Systems Interconnection
- Security Frameworks in Open Systems - Non-repudiation framework)? Can
anyone snip a description of non-repudiation from X.813?

Thanks! 
Dave Oshman 
Senior Vice President 
Technology 
Identrus LLC 

Dr. JohnDavid Hascup
Senior Security Architect
ELF Technologies

---

From: "Dr. JohnDavid Hascup" <[email-masked]>
Date: Thu, 5 Apr 2001 13:44:41 -0700

Meaning of Non-repudiationMichael I wish the issue was as simple as you
desire it. Unfortunately when making use of PKI in the legal world there is
always an added complexity. I would love to see non-repudiation as a
non-issue, but having been in the discussion over the years, it is the one
issue that I continually faced at a table with legal councils. I know that
this list has quite often been faced with this and many points were
discussed with passion. Within the ABA the discussion has been also quite
active and gone on for years. Attempts were made to come to a common "legal"
understanding, unfortunately, until the legal councils I have to interact
with see decisions in a court related to non-repudiation by use of a
certificate they continue to make it hard for the acceptance of PKI in a
legal market. But I have no doubt that as with other new technologies the
real world will force lawyers to make use of it.

I know this seems strange given the history of questions surrounding the
introduction of any new technology by the legal market (privileged related
to faxes, then cell phones, and even email) and the eventual defining of the
issues. But in each of those cases the legal community came to its decisions
not on the basis of the technology but rather on the basis of court
decisions.

This may not be so for every market. Financial contracts and e-commerce
seems to have evolved with less issues surrounding non-repudiation in the
real world. But in the legal industry in which I am most familiar there are
always caveats and pages of interpretation to somehow work through. RFCs are
easy compared to the legal papers I have had to come to grips with.

Dr. JohnDavid Hascup
  -----Original Message-----
  From: Aisenberg, Michael [mailto:[email-masked]]
  Sent: Thursday, April 05, 2001 1:01 PM
  To: 'Dr. JohnDavid Hascup'; Dave Oshman; [email-masked]
  Subject: RE: Meaning of Non-repudiation

  Michael Aisenberg