Subject: 3280bis: security considerations for combining the nonRepudiation bit with other bits

From: "Denis Pinkas" <[email-masked]>
Date: Wed, 15 Feb 2006 17:17:56 +0100

3280 states:

   Combining the nonRepudiation bit in the keyUsage certificate
   extension with other keyUsage bits may have security implications
   depending on the context in which the certificate is to be used.

This sentence is quite correct and the reader would expect 
more information in the security considerations section. Howver, there is none.

The following text is proposed:

"When a certificate has the nonRepudiation bit set, then the certificate holder should only use 
the corresponding private key in environments that can be trusted, e.g. where the data 
to be signed can fully be controlled, otherwise some untusted local or remote application 
could attempt to get the signature of a challenge that corresponds to the hash value of a contract.. 

When a certificate has only the digitalSignature bit set, then the certificate holder may use 
the corresponding private key in untrusted environments, e.g. where the data to be signed 
is not fully controlled.

When a certificate has both the nonRepudiation bit and the digitalSignature bit set, then 
the certificate holder should only use the corresponding private key in environments that 
can be trusted, e.g. where the data to be signed can fully be controlled". 

Denis

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 15 Feb 2006 16:32:25 +0000

Denis,

I would oppose this change since:

a) this text has been done to death and is good enough, more debate
    is pointless, in fact, the less said here the better

b) the text assumes the existence of an environment where the data
    to be signed can be "fully" controlled and no such environment
    actually exists - i.e. the text is purely aspirational

S.

---

From: Hoyt L Kesterson II <[email-masked]>
Date: Wed, 15 Feb 2006 11:41:18 -0700

I'm not interested in starting up another discussion in this
area. However, I suggest that the 3280 text referenced might be read
in such a way as to violate the text in clause 8.2.2.3 in the upcoming
fifth edition. That revised clause was circulated to this group some
time ago in a Technical Corrigendum.

8.2.2.3 states

More than one
bit may be set in an instance of the keyUsage extension. The setting of multiple bits shall not
change the meaning of each individual bit but shall indicate that the
certificate may be used for all of the purposes indicated by the set
bits.

hoyt

At 17:17 +0100 2/15/06, Denis Pinkas wrote:

3280 states:

Combining the nonRepudiation bit in the keyUsage
certificate

extension with other keyUsage bits may have security
implications

depending on the context in which the certificate is to
be used.

more information in the security considerations section. Howver, there
is none.

"When a certificate has the nonRepudiation bit set, then the
certificate holder should only use

the corresponding private key in environments that can be trusted,
e.g. where the data

to be signed can fully be controlled, otherwise some untusted local or
remote application

could attempt to get the signature of a challenge that corresponds to
the hash value of a contract..

When a certificate has only the digitalSignature bit set, then the
certificate holder may use

the corresponding private key in untrusted environments, e.g. where
the data to be signed

is not fully controlled.

When a certificate has both the nonRepudiation bit and the
digitalSignature bit set, then

the certificate holder should only use the corresponding private key
in environments that

can be trusted, e.g. where the data to be signed can fully be
controlled".

Denis

---

From: Tom Gindin <[email-masked]>
Date: Thu, 16 Feb 2006 08:49:50 -0500

Hoyt:

        While the principle you state is correct, Denis' suggestion 
actually does not violate it.  It can be shortened, with no loss of 
meaning, by removing the paragraph mentioning both bits and replacing the 
text "When a certificate has the nonRepudiation bit set" by "When a 
certificate has the nonRepudiation bit set (whether or not the 
digitalSignature bit is also set)".  I don't think that parenthetical 
clarification violates the TC's rule about bit independence.
        I would also replace "only the digitalSignature bit set" by "the 
digitalSignature bit set without having the nonRepudiation bit also set", 
because Denis' wording by its terms excludes cases where digitalSignature 
and keyEncipherment are both set, which is almost certainly not intended. 
If you feel it better, that could become "when the nonRepudiation bit is 
not set" instead - although perhaps another exception should be made for 
the keyCertSign and cRLSign bits as well.

                Tom Gindin

Hoyt L Kesterson II <[email-masked]>
Sent by: [email-masked]
02/15/2006 01:41 PM
 
        To:     "pkix" <[email-masked]>
        cc: 
        Subject:        Re: 3280bis: security considerations for combining 
the nonRepudiation bit with other bits

I'm not interested in starting up another discussion in this area. 
However, I suggest that the 3280 text referenced might be read in such a 
way as to violate the text in clause 8.2.2.3 in the upcoming fifth 
edition. That revised clause was circulated to this group some time ago in 
a Technical Corrigendum.

8.2.2.3 states

More than one bit may be set in an instance of the keyUsage extension. The 
setting of multiple bits shall not change the meaning of each individual 
bit but shall indicate that the certificate may be used for all of the 
purposes indicated by the set bits.

   hoyt

This sentence is quite correct and the reader would expect
more information in the security considerations section. Howver, there is 
none.

"When a certificate has the nonRepudiation bit set, then the certificate 
holder should only use
the corresponding private key in environments that can be trusted, e.g. 
where the data
to be signed can fully be controlled, otherwise some untusted local or 
remote application
could attempt to get the signature of a challenge that corresponds to the 
hash value of a contract..

When a certificate has only the digitalSignature bit set, then the 
certificate holder may use
the corresponding private key in untrusted environments, e.g. where the 
data to be signed
is not fully controlled.

When a certificate has both the nonRepudiation bit and the 
digitalSignature bit set, then
the certificate holder should only use the corresponding private key in 
environments that
can be trusted, e.g. where the data to be signed can fully be controlled".

Denis

---

From: Hoyt L Kesterson II <[email-masked]>
Date: Fri, 17 Feb 2006 18:25:30 -0700

Hi Tom

I wasn't referring to Denis's proposed text. I was referring to the text that Denis wanted to change. In particular I was concerned with the use of combining "Combining the nonRepudiation bit in the keyUsage certificate extension with other keyUsage bits..."

    hoyt