Subject: Re: "Authentication" and "Signature" bits...

From: Tony Bartoletti <[email-masked]>
Date: Thu, 09 May 2002 12:02:35 -0700

Relegating the NR-bit to the CA-assertion "I have never seen/touched the 
private key" is at least a "do-able" assertion, something under the CA's 
control and to which they can attest.  (But why should a CA ever have 
access to even a NR=0 private key?  Why should they need to attest to that 
which should be standard practice?  I would be no happier that someone 
"authenticated as me" in a malicious telnet session than if they signed a 
contract in my name.  I could be in hot water, either way.)

I agree with those who feel that NR needs to be asserted in the document 
signed, or the signature, rather than in the certificate.

In order to have the NR-bit "mean what we 'thought' it meant", the 
following is as close as I can come to something that might work (if it 
could be relied upon):

Suppose NR=1 in a certificate means that the signing-application must 
"pop-up" a dialog, ASKING the user "which intent is to be employed in this 
signing".  Basically it would give them the *option* of embedding either a 
"AUTH-ONLY" intent-token/bit into the data over which the signature occurs, 
OR an "ATTESTATION" (fuzzy notion that it is) intent-token/bit gets embedded.

When NR=0, the dialog is never triggered, and no token gets embedded.

Thus, NR=1 does not mean "Non-Repudiable" per se.  Rather, it means 
"message includes the intent-token/bit".  This would allow me to sign 
emails for auth-only, and yet if someone says "I need you to attest to this 
statement", I can select signature with the ATTESTATION bit included.

One would then assume that if NR=0 in the certificate, a conforming 
application would not allow the insertion of such a token.

Of course, any NR=1 certified private key would need to be protected just 
as strongly as if any signature intended NR, since it becomes a possible 
assertion.

(Whether any of this is enforceable, or useful, or breaks existing 
applications, I haven't thought through.  But at least the case NR=0 would 
not change anything ...)

FWIW ...

____tony____

Tony Bartoletti 925-422-3881 <[email-masked]>
Information Operations, Warfare and Assurance Center
Lawrence Livermore National Laboratory
Livermore, CA 94551-9900

---

From: "Santosh Chokhani" <[email-masked]>
Date: Thu, 9 May 2002 16:34:51 -0400

Tony:

You make a good argument.  But, your very first point while may appear
persuasive at first glance, but as I have said that this is not a
definition of key usage.  Also, please note that none of the other bits
issuing CA can attest to.  They are under the control of relying party
clients.

-----Original Message-----
From: Tony Bartoletti [mailto:[email-masked]] 
Sent: Thursday, May 09, 2002 3:03 PM
To: Carlisle Adams; 'David P. Kemp'
Cc: '500 list (E-mail)'; [email-masked]
Subject: Re: "Authentication" and "Signature" bits...

control and to which they can attest.  (But why should a CA ever have 
access to even a NR=0 private key?  Why should they need to attest to
that 
which should be standard practice?  I would be no happier that someone 
"authenticated as me" in a malicious telnet session than if they signed
a 
contract in my name.  I could be in hot water, either way.)

Suppose NR=1 in a certificate means that the signing-application must 
"pop-up" a dialog, ASKING the user "which intent is to be employed in
this 
signing".  Basically it would give them the *option* of embedding either
a 
"AUTH-ONLY" intent-token/bit into the data over which the signature
occurs, 
OR an "ATTESTATION" (fuzzy notion that it is) intent-token/bit gets
embedded.

Thus, NR=1 does not mean "Non-Repudiable" per se.  Rather, it means 
"message includes the intent-token/bit".  This would allow me to sign 
emails for auth-only, and yet if someone says "I need you to attest to
this 
statement", I can select signature with the ATTESTATION bit included.

Of course, any NR=1 certified private key would need to be protected
just 
as strongly as if any signature intended NR, since it becomes a possible

assertion.

(Whether any of this is enforceable, or useful, or breaks existing 
applications, I haven't thought through.  But at least the case NR=0
would 
not change anything ...)

FWIW ...

____tony____