Subject: RE: Meaning of Non-repudiation

From: Hal Lockhart <[email-masked]>
Date: Fri, 26 Apr 2002 14:24:48 -0400

I believe the terms non-repudiation and signature date back to a time
(1980's) when nobody was talking about this stuff except a few
mathematicians. They probably realized they were using analogies to name
mathematical concepts, which did have precise meanings in that limited
scope. It is now recognized that neither analogy holds up to close scrutiny.

Unfortunately, the terminology got picked up and used very loosely by the
rest of the world. I have gotten used to hearing marketing types using
"non-repudiation" to mean any use of digital signatures. (Don't get me
started on "Trust." ;-) 

I just point them at Tom's document. I agree with Tony. What else can we do?

Hal

> -----Original Message-----
> From: Tony Bartoletti [mailto:[email-masked]]
> Sent: Friday, April 26, 2002 2:50 PM
> To: Aisenberg, Michael; [email-masked]';
> [email-masked]'
> Cc: [email-masked]'
> Subject: RE: Meaning of Non-repudiation
> 
> 
> 
> 
> At the risk of incurring PKIX list-wrath ...
> 
> To my view of things, the "existence" of NR=1 in a 
> certificate is no more 
> than a statement, by the issuing CA, that "they will not 
> stand in the way 
> of this certificate being used as a component in some form of 
> NR scheme 
> (and will happily accept your Visa or Mastercard, thank you.)
> 
> If one limits the presence of an NR bit to this weak 
> assertion, it becomes 
> clear that the NR bit "means almost nothing."  Thus there is 
> little left to 
> debate about it on the list.
> 
> (As I recall, Tom Ginden's "Technical Non-Repudiation" 
> document was about 
> as far as one could reasonably take application of the NR 
> bit.  It was time 
> for everyone else to put-up or shut-up, and everyone shut-up.)
> 
> 
> ____tony____
> 
> Tony Bartoletti 925-422-3881 <[email-masked]>
> Information Operations, Warfare and Assurance Center
> Lawrence Livermore National Laboratory
> Livermore, CA 94551-9900
> 
> 
> 
>

---

From: "todd glassey" <[email-masked]>
Date: Sat, 27 Apr 2002 13:34:46 -0700

RE: Meaning of Non-repudiationHal -
  ----- Original Message ----- 
  From: Hal Lockhart 
  To: 'Tony Bartoletti' ; Aisenberg, Michael ; [email-masked]' ; [email-masked]' 
  Cc: [email-masked]' 
  Sent: Friday, April 26, 2002 11:24 AM
  Subject: RE: Meaning of Non-repudiation

  I believe the terms non-repudiation and signature date back to a time (1980's) when nobody was talking about this stuff except a few mathematicians. 

You mean as far as Computer Scientists and researchers are concerned?  because Banking and other Trust-impinged computer operations have had these concepts operating as self-proofing feature for considerably longer that the last 20 years.  NR here was implemented as an external process. But when you look at them from a logic model stanpoint the NR is the same.

What is amusing here is that the PKI world thinks it invented NR. Personally what I think  that this is more grist for the mill 'that the commercial processes require commercial inputs'. 

  They probably realized they were using analogies to name mathematical concepts, which did have precise meanings in that limited scope. It is now recognized that neither analogy holds up to close scrutiny.

  Unfortunately, the terminology got picked up and used very loosely by the rest of the world. I have gotten used to hearing marketing types using "non-repudiation" to mean any use of digital signatures. (Don't get me started on "Trust." ;-) 

  Hal