Subject: RE: Meaning of Non-repudiation

From: Sharon Boeyen <[email-masked]>
Date: Fri, 3 May 2002 14:41:15 -0400

I want to clarify the X.509 "status" of this topic. There are 2 reasons that

you don't see a formal defect report on this at present. The topic was
discussed 
at the X.509 meeting in February and the agreement made at that meeting was
that 
the group would initiate a study to see if we could clear up the confusion
around 
the DS and NR bits in keyUsage. As a result of that study we would then
raise a 
DR if necessary, or progress a fix through the enhancement process. We have
agreed 
that there is confusion that needs to be clarified in the 509 text. We have
not 
yet agreed on what the fix should be or which mechanism to use to repair the
text. 

I started a thread on the 500 list and did not copy to this PKIX, FPKI or
other lists,
with the naive hope that we'd reach some sort of consensus on a direction
there and 
then we could take that direction to the 509 profiling groups as a target
for them 
to review BEFORE we actually finalize either a DR or an enhancement text.
However, 
the discussion have flowed over and now there is some on the 500 list, some
on PKIX 
and some on ABA. 

I haven't seen all the traffic on the ABA list yet, but I think there is at
least a 
growing consensus around the need to retain 2 bits. I don't see consensus
yet around 
what they represent though and expect this discussion will continue a while
yet. However,
I do hope that we are able to reach a reasonable consensus and are able to
move forward. 

When (yes I naively said when and not if :-) consensus is reached on a
resolution then I fully 
expect modifications will be made to the text in X.509. I, for one, hope the
changes move 
in the direction of leaving non-repudiation to the legal and policy realm
rather than the 
technical one. All other key usages are technical processes that can be
easily verified by 
the relying party system. Non-repudiation is not.

Sharon
-----Original Message-----
From: Denis Pinkas [mailto:[email-masked]]
Sent: Thursday, May 02, 2002 5:27 AM
To: David P. Kemp
Cc: [email-masked]
Subject: Re: Meaning of Non-repudiation

Dave,
 
> Russ,
> 
> I believe we are all sorry to resurrect this topic.
> But it is currently the subject of an X.509 defect,

Not exactly. Someone would like this topic to be the subject of an X.509
defect report, but this is is currently *not* the subject of an X.509 defect
that has been officially raised.

> and if the text of X.509 eventually changes in a way
> that is incompatible with Son-of-2459, then
> Grandson-of-2459 will need to take that into
> consideration.

Very unlikely to happen.

Additional *explanations* without changing the meaning *could* be provided
and we are (nearly) all saying the same thing using different words. Santosh
in a subsequent e-mail provided one of these explanations:

"In my analysis, DS means you are signing some challenge to prove
possession of a private key and thus authenticate yourself whereas with
NR you are saying that I know what this data is and I am signing it." 

I would add that a certificate with the the DS bit set can also be used to
authenticate data (this does not mean that the signer has read the data).

Now, there are cases where, beyond the fact that the signer did know what he
signed, he wants to say exactly what its signature means.

This can be achieved using three ways:

1) the document that is signed is unambiguous and its semantics says that
the signature means XXX.

2) a signed attribute (using the CMS language) is signed in addition to the
document and indicates a signature policy that is explicit about the meaning
of all signatures performed under that policy (note that one single meaning
is possible in that case).

3) another signed attribute (using the CMS language) is signed in addition
to the document and the previous attribute. It indicates the type of
commitment being made under the signature policy for that signature 
(note that multiple meanings are possible in that case).

As a result, the variety of meanings is NOT placed in the Certificate Policy
from the CA.

> We can all live with the text because we have no consensus on 
> anything better.  

Fine.

Denis

> That doesn't rule out the faint hope that the ITU can develop a
> meaningful replacement in the future.
> 
> Dave
> 
> "Housley, Russ" wrote:
> >
> > Dave:
> >
> > I am sorry that I replied to this thread at all.  This topic has been
debated
> > before, and the text in Son-of-RFC 2459 is the result of that debate.
> > Obviously, everyone can live with that text because no objections were
raised
> > during WG Last Call or IETF Last Call.
> >
> > I am not surprised that there is not 100% agreement....
> >
> > Russ

---

From: "Michael Myers" <[email-masked]>
Date: Fri, 3 May 2002 12:59:38 -0700

Sharon,

I agree with this direction and hope others do too.

Mike

-----Original Message-----
On Friday, May 03, 2002 11:41 AM Sharon Boeyen wrote:

. . .

I, for one, hope the changes move in the direction of leaving
non-repudiation to the legal and policy realm rather than the
technical one. All other key usages are technical processes that
can be easily verified by the relying party system.
Non-repudiation is not.

Sharon