Subject: Re: Meaning of Non-repudiation

From: [email-masked]
Date: Wed, 11 Apr 2001 13:24:00 -0600

David,

>...Here is the litmus test: do you agree that in
>order to validate a signature on an S/MIME message (any message, for
>any purpose, signed by any entity), the NR bit must be set?

I certainly don't, because of the ambiguity caused by the uncertain 
legalisms. I note that the certificates issued by DoD and contained on the 
Common Access Card, even those issued to federal contractors, DO 
contain the NR bit, and for that reason I would be quite reluctant
personally to use such a certificate.  Likewise, I would be  
concerned if I were the CIO of such a federal contractor and
someone in my organization were to use such a certificate for any 
purpose, but most especially for anything outside of the strict 
purview of the DoD. The DoD CP may provide some definitive 
definition of what NR means in their context (although I haven't 
read it, and wouldn't bet my life on it), but who is in a position to say 
that the DoD CP would be binding on some other, unrelated,
relying party?

Back in the AUTODIN days, there was a sharp distinction drawn 
between "official" traffic, which were essentially legally binding 
military orders sent by or under the authority of the commanding 
officer, vs. "unofficial" traffic, which could be much less formal.

Nuclear release orders, troop movements -- "take that hill or die trying",
transfer of funds from one account to another, contract signings and 
amendments, legal or other official notices -- those are the sorts of
things that I would think might legitimately deserve something like the
NR bit within DoD.

Using a certificate containing the NR bit to sign your previous 
message, although not wrong per se, would certainly constitute
overkill and an unnecessary risk, at least to my way of 
thinking.  

Personally, I would keep the private key corresponding to a public 
key in a certificate containing the NR bit stored away in my safe, or
in some other very secure location, to be taken out with considerable 
trepidation and perhaps a certain amount of ceremony.  I would 
NEVER use it for this kind of casual e-mail, even though I am willing 
to sign it to demonstrate authenticity of origin and the absence of 
any modification.  Despite my willingness to agree that I signed the 
message, I don't regard it as legally binding -- it isn't a contract (no offer
and acceptance of consideration), it isn't a legal notice, will, testament,
or other form of obligation, it is just a letter.

(Even if I were to sign it "Love and kisses", I wouldn't expect to be
held to that commitment with respect to this audience! :-)

"I do not anticipate any change to the NR bit in X.509 nor in PKIX."
                                                             Steve Kent

"We have met the enemy, and they is us." 
                                                              Pogo

Regards,

Bob

---

From: "David P. Kemp" <[email-masked]>
Date: Wed, 11 Apr 2001 16:13:29 -0400

[email-masked] wrote:
> personally to use such a certificate.

That's why, if Steve doesn't want to change the name of the bit,
definitions are essential.  Are we talking:

1) non-binding (ephemeral) authentication vs. binding (persistent)
   signatures, or

2) non-legally-binding persistent signatures vs. legally-binding
   persistent signatures.

We haven't had any success in two years of attempting to come to grips
with 2.  I agree with Ed Gerck that problem 2 is important, but it
cannot be solved with one bit in a certificate.  I agree with you
that a bit that claims to address 2 should be deprecated.

Problem 1 is easily solved with one bit, as long as the definitions
are unambiguous.  It would be preferable to rename the bit because
the word NR is an obstacle to common understanding and agreement.
But if agreement and understanding can occur without changing the
name, that's fine with me.