Subject: RE: 3280bis: security considerations for combining the nonRepudiation bit with other bits

From: "Stefan Santesson" <[email-masked]>
Date: Wed, 15 Feb 2006 17:44:41 -0000

I agree. The proposed text would require us to define what a trusted
environment is. This not realistic.

Stefan Santesson
Program Manager, Standards Liaison
Windows Security

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Stephen Farrell
Sent: den 15 februari 2006 08:32
To: Denis Pinkas
Cc: pkix
Subject: Re: 3280bis: security considerations for combining the
nonRepudiation bit with other bits

Denis,

I would oppose this change since:

a) this text has been done to death and is good enough, more debate
    is pointless, in fact, the less said here the better

b) the text assumes the existence of an environment where the data
    to be signed can be "fully" controlled and no such environment
    actually exists - i.e. the text is purely aspirational

S.

Denis Pinkas wrote:
> 3280 states:
> 
>    Combining the nonRepudiation bit in the keyUsage certificate
>    extension with other keyUsage bits may have security implications
>    depending on the context in which the certificate is to be used.
> 
> This sentence is quite correct and the reader would expect 
> more information in the security considerations section. Howver, there
is none.
> 
> The following text is proposed:
> 
> "When a certificate has the nonRepudiation bit set, then the
certificate holder should only use 
> the corresponding private key in environments that can be trusted,
e.g. where the data 
> to be signed can fully be controlled, otherwise some untusted local or
remote application 
> could attempt to get the signature of a challenge that corresponds to
the hash value of a contract.. 
> 
> When a certificate has only the digitalSignature bit set, then the
certificate holder may use 
> the corresponding private key in untrusted environments, e.g. where
the data to be signed 
> is not fully controlled.
> 
> When a certificate has both the nonRepudiation bit and the
digitalSignature bit set, then 
> the certificate holder should only use the corresponding private key
in environments that 
> can be trusted, e.g. where the data to be signed can fully be
controlled". 
> Denis

---

From: "Stefan Santesson" <[email-masked]>
Date: Thu, 16 Feb 2006 02:05:36 -0000

Hoyt,

That text is accurate but it really would belong in the key usage
section and not in the security considerations section.

Personally I think that guidance is a bit redundant since the bits are
defined individually and nothing suggests that setting multiple bits
would change those definitions.

Current text already allows setting multiple bits.

Stefan Santesson

Windows Security

________________________________

From: [email-masked] [mailto:[email-masked]]
On Behalf Of Hoyt L Kesterson II
Sent: den 15 februari 2006 10:41
To: pkix
Subject: Re: 3280bis: security considerations for combining the
nonRepudiation bit with other bits

I'm not interested in starting up another discussion in this area.
However, I suggest that the 3280 text referenced might be read in such a
way as to violate the text in clause 8.2.2.3 in the upcoming fifth
edition. That revised clause was circulated to this group some time ago
in a Technical Corrigendum.

8.2.2.3 states

	More than one bit may be set in an instance of the keyUsage
extension. The setting of multiple bits shall not change the meaning of
each individual bit but shall indicate that the certificate may be used
for all of the purposes indicated by the set bits.

   hoyt

At 17:17 +0100 2/15/06, Denis Pinkas wrote:

	3280 states:
	
	   Combining the nonRepudiation bit in the keyUsage certificate
	   extension with other keyUsage bits may have security
implications
	   depending on the context in which the certificate is to be
used.
	
	This sentence is quite correct and the reader would expect
	more information in the security considerations section. Howver,
there is none.

	"When a certificate has the nonRepudiation bit set, then the
certificate holder should only use
	the corresponding private key in environments that can be
trusted, e.g. where the data
	to be signed can fully be controlled, otherwise some untusted
local or remote application
	could attempt to get the signature of a challenge that
corresponds to the hash value of a contract..
	
	When a certificate has only the digitalSignature bit set, then
the certificate holder may use
	the corresponding private key in untrusted environments, e.g.
where the data to be signed
	is not fully controlled.
	
	When a certificate has both the nonRepudiation bit and the
digitalSignature bit set, then
	the certificate holder should only use the corresponding private
key in environments that
	can be trusted, e.g. where the data to be signed can fully be
controlled".
	
	Denis