Subject: Re: Meaning of Non-repudiation

From: "todd glassey" <[email-masked]>
Date: Fri, 26 Apr 2002 08:48:34 -0700

Tom,
I agree with you - the X.509 model is broken too. NR is a bigger thing than
a bit in a data structure and using the term NR causes problems for auditors
and other professionals that would have to use these protocols.

I and many others define NR as the sum-total of all the Information
Assurance technologies, techniques, and practices that make up and operating
environment. Thus NR is a state specific to a totality of condition and
maybe needs essentially gradiant levels rather than a binary on or off
state. Thats why a single bit alone without the accompanying OID is of
questionable value here.

Todd

----- Original Message -----
From: "Tom Gindin" <[email-masked]>
To: "Stephen Kent" <[email-masked]>
Cc: "David P. Kemp" <[email-masked]>; <[email-masked]>
Sent: Wednesday, April 11, 2001 3:50 PM
Subject: Re: Meaning of Non-repudiation

>
>      IMHO, if X.509 had not been calling the bit in KeyUsage
> "non-repudiation" for some years, I would prefer to put "Persistent Data
> Authentication" into KeyUsage and define several different flavors of
> non-repudiation in ExtendedKeyUsage, profiling non-repudiation services in
> parallel with those ExtendedKeyUsage values.  This would also allow us to
> define different levels of NR and put them into certificates in a natural
> way.  However, they have been calling the bit "non-repudiation", and I'm
> not sure we can change its meaning on the installed base of certificates
> and on the X.509 group without an unusual level of unanimity and
> near-certainty that it won't break anything.
>
>           Tom Gindin
>
>
>

---

From: "Tom Gindin" <[email-masked]>
Date: Fri, 26 Apr 2002 16:46:00 -0400

I hope that everyone understands that whatever else the KeyUsage
non-repudiation bit might do, it does NOT imply that everything signed with
a certificate containing it meets UCC sections 2-609/2-610, or any similar
provisions.  The exact limit of what it does has been controversial on this
list in the past, and I see no reason to go over it in this context.

            Tom Gindin

"Aisenberg, Michael" <[email-masked]>@mail.imc.org on 04/26/2002
12:37:08 PM

Sent by:    [email-masked]

To:    "[email-masked]'" <[email-masked]>,
       Tom Gindin/Watson/IBM@IBMUS
cc:    "[email-masked]'" <[email-masked]>
Subject:    RE: Meaning of Non-repudiation

As an under-initiated tech-wanabe lawyer who has observed the
'non-repudiation'
debate for several years, it occurs to me that, not only do I concur in
Todd's observation
regarding the use of NR {as a technical bit-descriptor being problematic
vis-à-vis
his described more 'comprehensive' view of  NR as a 'condition' achieved
through the
deployment of an IA environment}, but would further suggest that even
THAT interpretation requires
calibration against the generally accepted legal concept of
non-repudiation
inherent in the construct and case law around UCC secs. 2-609/2-610.

Todd's analysis suggests a non-statutory analog --based on a description
of a
complex of conditions existing simultaneously-- that provides a
technology-grounded basis for asserting
the same absolute of  'undeniability of existence' that the
legal/statutory phrase implies (but, lawyers would never
assert with the same absolutism as, say, a law of physics, unless a
court of last resort had
ruled!)--but it is of course still different from, and therefore capable
of being confused with the
bit descriptor.  All of which is a long-winded way of stating the
obvious--that the importation
of 'terms of art' from one discipline to another is risky--absent
precise equality of
definition, intent and usage--which we obviously don't have here......

Michael Aisenberg
--VeriSign/D.C.--

-----Original Message-----
From: todd glassey [mailto:[email-masked]]
Sent: Friday, April 26, 2002 11:49 AM
To: Tom Gindin
Cc: PKIX-IETF
Subject: Re: Meaning of Non-repudiation

Tom,
I agree with you - the X.509 model is broken too. NR is a bigger thing
than
a bit in a data structure and using the term NR causes problems for
auditors
and other professionals that would have to use these protocols.

Assurance technologies, techniques, and practices that make up and
operating

Todd