Subject: Re: 3280bis: KeyUsage NR/CC bit

From: Russ Housley <[email-masked]>
Date: Tue, 02 Aug 2005 10:05:56 -0400

[ Responding as an author of RFC 3280, not as a Security AD. ]

We have had more discussion of this bit than any other bit.  In my opinion, 
way too much.  I am quite reluctant to engage in another discussion of it.

My recollection of the last time we discussed this topic is quite 
clear.  Consensus was that the text in RFC 3280 was a good compromise and 
that any further effort have a very low probability of improving it.

Yet, the discussion happened in the ITU-T.  The result is the text in the 
message from Denis.

It seems to me that this leaves us in the same position we were in a few 
years ago.  I still do not think that the new text is providing any clarity 
over the text that is in RFC 3280.  I expect we will spend a huge amount of 
time discussing it.

The ITU-T should not have changed the name of the bit.  Several 
implementors discouraged the ITU-T from making this name change, but they 
did so anyway.  I am strongly apposed to changing the name of this bit in 
our specification, and I am very please to see that Denis is not advocating 
doing so.  I think that we should probably add a note that tells the reader 
that the ITU-T did elect to make this change.

Russ

At 06:10 AM 7/28/2005, Denis Pinkas wrote:

>Extract from: draft-ietf-pkix-rfc3280bis-01.txt :
>
>« The nonRepudiation bit is asserted when the subject public key
>is used to verify digital signatures, other than signatures on
>certificates (bit 5) and CRLs (bit 6), used to provide a non-repudiation
>service which protects against the signing entity falsely denying
>some action. In the case of later conflict, a reliable third party may
>determine the authenticity of the signed data ».
>
>I can live with the proposed ASN.1.
>
>I would however suggest to re-use some of the key words of X.509.
>In the last sentence "authenticity of the signed data" may be misleading
>since it is missing the notion of time.
>
>Proposal for a compromise with X.509 2000)/Cor.3 (04/2004):
>
>" The nonRepudiation bit is asserted when the subject public key
>is used to verify digital signatures, other than signatures on
>certificates (bit 5) and CRLs (bit 6), which are intended to signal
>that the signer is committing to the content being signed.
>In the case of later conflict, this allows to provide a non-repudiation
>service which protects against the signing entity falsely denying some 
>action ».
>
>Denis
>
>PS: The original text from the TC of X.509 is:
>
>b) contentCommitment: for verifying digital signatures which
>are intended to signal that the signer is committing to the content being 
>signed.
>The precise level of commitment, e.g. "with the intent to be bound"
>may be signaled by additional methods, e.g. certificate policy.
>
>Since a content commitment signing is considered to be a digitally signed
>transaction, the digitalSignature bit need not be set in the certificate.
>If it is set, it does not affect the level of commitment the signer has
>endowed in the signed content.
>
>Note that it is not incorrect to refer to this keyUsage bit using the
>identifier nonRepudiation. However, the use this identifier has been
>deprecated. Regardless of the identifier used, the semantics of this
>bit are as specified in this standard.