Subject: RE: e-Government uses "Authority-stamp-signatures"

From: [email-masked]
Date: Sat, 14 Dec 2002 08:05:02 -0700

past discussion of non-repudiation .... a non-repudiation "service"
basically can demonstrate participation of the two end points in a
particular message. that makes such a service somewhat independent of the
content and/or processes involved in the message .... however for
non-repudiation (as opposed to the service) ... there is also electronic
signature as well as intention (aka the content of the message as well as
the actual electronic signature process).

for a legal signature ... as in manual signature, there is concept of
intention ... i.e. demonstrate that person intended to sign what they
signed. it is easier to show that when a person writes thier signature,
they intended to write their signature.

issue in technology with digital signatures ... a piece of computer
equipment may have been programed to apply signatures to messages, aka just
because the technology has been labeled digital signature doesn't make it a
digital equivalent of signatures.

somewhat taxonomy

* hash can demonstrate integrity of transmitted message
* signed hash (i.e. digital signature) can demonstrate origin and integrity
of the hash combined with the integrity of the message
* there is still the missing transition from demonstrating origin to
demonstrating intention (like demonstrating that the technology was never
used for purely integrity/origin ... or if it was, there is demonstratable
distinction)
* finally service that demonstrates that origin & destination actually
participated

abbreviatied random refs (in this mailing list):
http://www.garlic.com/~lynn/aadsm11.htm#5 Meaning of Non-repudiation
http://www.garlic.com/~lynn/aadsm11.htm#6 Meaning of Non-repudiation
http://www.garlic.com/~lynn/aadsm11.htm#7 Meaning of Non-repudiation
http://www.garlic.com/~lynn/aadsm11.htm#9 Meaning of Non-repudiation
http://www.garlic.com/~lynn/aadsm11.htm#11 Meaning of Non-repudiation
http://www.garlic.com/~lynn/aadsm11.htm#13 Words, Books, and Key Usage
http://www.garlic.com/~lynn/aadsm11.htm#14 Meaning of Non-repudiation
http://www.garlic.com/~lynn/aadsm11.htm#15 Meaning of Non-repudiation
http://www.garlic.com/~lynn/aadsm11.htm#23 Proxy PKI. Was: IBM alternative
to PKI?

[email-masked] on 12/13/2002 10:19 pm wrote:

In order to establish non-repudiation, won't you need the signature of a
person and not just proof that the email passed through a specific server?

---

From: "Jimi Thompson" <[email-masked]>
Date: Sat, 14 Dec 2002 22:05:54 -0800

<SNIP>

</SNIP>

I mentioned this whole thing again for these very reasons since the overall
impression was that there would be some form of non-repudiation going on for
traffic that was merely flowing between 2 servers.  As Lynn so clearly
illustrates, this is not a valid use of "signatures".

I have a suggestion.  In order to avoid confusing ourselves and others,
let's make a small change in nomenclature instead of lumping everything in
under "signature".   Perhaps "authorizing" and "verifying" or whatever to
distinguish the two.

Thanks,

Ms. Jimi Thompson

Those who are too smart to engage in politics are punished by being governed
by those who are dumber. - Plato

---

From: "Anders Rundgren" <[email-masked]>
Date: Sun, 15 Dec 2002 11:48:04 +0100

Guys,

Before wasting a lot of time and list-space we might as well simply agree on that we disagree on major legal issues.  

--------------------------------------------------------------------------------

But maybe we could agree on that digital signature laws were created before a single "violation" had been recorded?

--------------------------------------------------------------------------------

As far as I know, this differs widely from past legislation practices which speaks for having a very open mind at this stage.

So I can do nothing but declaring my "deviating" views:

That is, "non-repudiation" do certainly apply to server/org-signed messages. A company repudiating a purchase order, that can be verified to have been signed with their org-key (under the control of a business system), is likely to find out this the hard way.  Using legal practices that we still haven't seen a single trace of.

But why even bother calling in lawyers when the technical proof is as strong as a digital signature? 

That the repudiated purchase order may be the result of a security breach does not change much, except for who is going to get the blame internally, in the sending organization.

cheers,
Anders R

----- Original Message ----- 
From: "Jimi Thompson" <[email-masked]>
To: <[email-masked]>
Cc: "Anders Rundgren" <[email-masked]>; <[email-masked]>
Sent: Sunday, December 15, 2002 07:05
Subject: RE: e-Government uses "Authority-stamp-signatures"

<SNIP>

Thanks,

Ms. Jimi Thompson