Subject: RE: Words, Books, and Key Usage

From: "Trevor Freeman" <[email-masked]>
Date: Tue, 7 May 2002 13:55:39 -0700

Dave,

Semantics 
1) The branch of linguistics and logic concerned with meaning
2) The meaning of a word, phrase, sentence or text.
Concise Oxford English Dictionary - Queens English edition

If you are changing the meaning of bits when they are asserted in an
extension, then its semantics not structure we are dealing with. I don't
dispute that the semantics behind non-repudiation are a little fuzzy to
say the least, but there are some basic ground rules in there which have
been agreed and included in RFCs. If you want to define new semantics
with cleaner definitions, feel free to do so, but you cannot do so
within the confines of the existing extension as identified by the
existing OID. I don't have a problem with what you are doing, just don't
do it in such a way as you break existing standards.

Trevor

-----Original Message-----
From: David P. Kemp [mailto:[email-masked]] 
Sent: Tuesday, May 07, 2002 7:50 AM
To: [email-masked]
Subject: Words, Books, and Key Usage

    "Fiction - A literary work whose content is produced by
     the imagination and is not necessarily based on fact."

    "Non-fiction - Prose works other than fiction."

          -- www.dictionary.com

Trevor Freeman wrote:
> Santosh,
> Stop the spin doctoring ...
> 
> I really don't care which course you choose to achieve your 
> objective, but you cannot redefine the semantics of the
> existing key usage extension and retain the same identifier.

The problem is not semantics being redefined, the problem is that
many thoughtful people have been trying to figure out, without
success, the semantics of an ill-structured specification.

Consider the parts of speech: nouns, verbs, adjectives, etc.
Then X.509, if applied to the English language, might read:

  Bits in the WordUsage type are as follows:
   a) word: for words that have purposes other than those
      identified in b, f, or g below;
   b) nonFiction: for words used in non-fiction whose content
      is fact-based prose (excluding verbs and adverbs, as in
      f or g below);
   ...
   f) verb: for words that express existence, action,
      or occurrence;
   g) adverb: for words that modify a verb, adjective,
      or other adverb;

As many others have observed, the problem with key usage
is not semantic, it is structural - non-repudiation is
not something that can be provided by a certificate or
certain type of signature, it is provided by a system.
As Peter Williams rightly observed some time ago, and you
recently repeated, even SSL can play a role in supporting
some forms of non-repudiation systems.  

Even though signed objects are more commonly associated with
non-repudiation than are signed challenges, and adjectives
are more common in novels than in technical papers, there is
no one-to-one correspondence.  Calling "non-repudiation"
a key usage is as structurally flawed as calling
"non-fiction" a part of speech.  They belong to two
entirely different taxonomies.

The first step to recovery is admitting that something
is wrong.  I believe there is universal recognition and
consensus that non-repudiation is a different *kind* of
thing than certificate signing, key agreement, and
data encipherment, and that the resulting confusion
is a problem for product developers, lawyers, and users
alike.

The next step is to believe that the problem can be
fixed, and make a decision to fix it.  We're not there
yet.  But if we ever resolve to do more than talk about
it, we will find that a certain amount of semantic
redefinition is necessary -- you can't gain coherence
by retaining 100% compatibility with an incoherent
definition.

Even the ancients were smart enough to know that
the fundamental building blocks of the universe
are NOT "Earth", "Fire", "Elements Used in a Cave",
and "All Elements Except Earth, Fire, and those
used in a Cave".

Regards,
Dave

---

From: "Santosh Chokhani" <[email-masked]>
Date: Wed, 8 May 2002 07:33:14 -0400

Trevor:

I think you are off-base and have not provide argument as to how I have
changed the semantics.  Just like you have certSign and cRLSign bits to
check signatures on objects, I have the entity authentication and
digital signature separate.

I would not go into mathematical detail, but taken to extreme, in RSA,
there is no difference in encryption and digital signature.

Your most cogent argument may be backward compatibility and none of the
vendors (including you) have responded as to which of the four choices
break interoperability.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Trevor Freeman
Sent: Tuesday, May 07, 2002 4:56 PM
To: David P. Kemp; [email-masked]
Subject: RE: Words, Books, and Key Usage

Dave,

Semantics 

Trevor

-----Original Message-----
From: David P. Kemp [mailto:[email-masked]] 
Sent: Tuesday, May 07, 2002 7:50 AM
To: [email-masked]
Subject: Words, Books, and Key Usage

          -- www.dictionary.com

> existing key usage extension and retain the same identifier.

The problem is not semantics being redefined, the problem is that many
thoughtful people have been trying to figure out, without success, the
semantics of an ill-structured specification.

Consider the parts of speech: nouns, verbs, adjectives, etc. Then X.509,
if applied to the English language, might read:

As many others have observed, the problem with key usage
is not semantic, it is structural - non-repudiation is
not something that can be provided by a certificate or
certain type of signature, it is provided by a system.
As Peter Williams rightly observed some time ago, and you recently
repeated, even SSL can play a role in supporting some forms of
non-repudiation systems.  

Even though signed objects are more commonly associated with
non-repudiation than are signed challenges, and adjectives are more
common in novels than in technical papers, there is no one-to-one
correspondence.  Calling "non-repudiation" a key usage is as
structurally flawed as calling "non-fiction" a part of speech.  They
belong to two entirely different taxonomies.

The first step to recovery is admitting that something
is wrong.  I believe there is universal recognition and consensus that
non-repudiation is a different *kind* of thing than certificate signing,
key agreement, and data encipherment, and that the resulting confusion
is a problem for product developers, lawyers, and users alike.

Regards,
Dave