Subject: RE: Signing what you don't understand

From: Adrian McCullagh <[email-masked]>
Date: Sat, 15 Jul 2000 12:50:52 +1000

Stephen

I really do not understand your response.  Why would anyone sign a document
that they do not understand.  It does not make sense.  If I sent you a
document written in Chinese and assume you can not read Chinese and at the
same time I said just sign this - Why would you sign it.  Now if you trusted
me then you may sign it based upon the information about the document that I
tell you.  A classic case for Non-est-factum.  But all the cases that I have
read clearly rely upon some information provided by an Alleged trusted third
party.  Usually some relative.  So without some external information being
provided by a third party it is not as far as I can determine possible to
rely upon non est factum.   

Also what does a "bit" in a certificate got to do with non-repudiation.  The
commercial world and the law does not in my opinion support this position of
yours.  You appear to be on a path to re-engineering the entire commercial
legal fabric and as such I with the greatest respect I do not  believe that
society and the law will buy into it.  With out the commercial involvement
PKI will not survive.

I do not understand how - "what you are proposing" - will work in practical
terms.

Adrian McCullagh
Director of Electronic Commerce		Tel: 617 3231 1522
Gadens Lawyers					Fax: 617 3229 5850	
level 39
Central Plaza 1
345 Queen Street
Brisbane Australia 4000

Ph. D. Candidate 
Thesis "The Incorporation of Trust Strategies in Digital Signature
Regimes for Elec. Comm."
Information Security Research Centre
Queensland University of Technology

-----Original Message-----
From: Stephen Kent [mailto:[email-masked]]
Sent: Thursday, July 13, 2000 11:49 PM
To: [email-masked]
Cc: [email-masked]
Subject: Re: Signing what you don't understand

Denis,

>The most important point of my previous message was buried under a pile of
>other stuff, so I am repeating it here:
>
>
>It is my proposal that a signature format is designed which will allow an
>entity to say: "I signed this data, but I didn't understand what I signed.
>You are free to use this signature as proof that I possess a certain
private
>key, but this is also the only purpose for which this signature can be
>used."

We have had an analogous debate on this list last year.  This is one 
motivation for the use of the non-repudiation bit in certificates, 
i.e., if this bit is NOT asserted, one can reasonably interpret the 
signature as not binding.  This does not require a change to the 
signing format, but rather appropriate use of key usage bits in 
certificates. As others have pointed out, the preferred way to 
represent the distinction between binding and non-binding signatures 
is via flags in certificates, e.g., key usage, cert policy, etc.

Steve

---

From: Eric Rescorla <[email-masked]>
Date: 14 Jul 2000 22:09:25 -0700

Adrian McCullagh <[email-masked]> writes:
> that they do not understand.  It does not make sense.
People perform digital signatures of data they don't understand all the
time. One most common case is cryptographic protocols which use
digital signature for authentication of various kinds of keying
material. (SSL and IKE both do this). Note that these signatures
are often completely automatic.

Now, as a matter of cryptographic practice, one generally arranges
that neither party completely controls the input to the signature to
to prevent one party from forcing another to sign an arbitrary
document. However, as a matter of defense in depth, it's also nice
to have those keys tagged in such a way that even if the protocol
protections were broken, the signature still couldn't be used against
the signer.

Part of the issue here is that digital signature is a cryptographic
primitive that can be used for other purposes than those which
holographic signatures are currently used.

-Ekr

[Eric Rescorla                                   [email-masked]]

---

From: Stephen Kent <[email-masked]>
Date: Mon, 17 Jul 2000 20:00:21 -0400

>rely upon non est factum.

Because we sign authentication challenges, just for authentication 
purposes, but not for NR purposes, it is prudent to distinguish 
between the two intents.  Your comments seem to ignore this use of 
digital signature technology. One way of signalling intent is via the 
NR bit. Although it has been argued that having this bit set to True 
does not necessarily signal intent to sign for NR purposes, having it 
set to False certainly signals an intent to not be bound re NR.

(Your use of Latin and your e-mail "signature" suggests a legal, but 
perhaps not a technical background. We've also decided, after much 
debate, that PKIX deals with technical aspects of NR, not legal 
details that may vary based upon jurisdiction.)

>society and the law will buy into it.  With out the commercial involvement

The position is not just mine.  Sorry of you don't understand, or 
merely don't agree with the use of the NR bit, or its name, but we 
had this debate a while ago and we're not having it again.

>I do not understand how - "what you are proposing" - will work in practical

I'm not "proposing," but I am citing existing Internet and ITU 
standards and the applicability to the question at hand.

Steve