Subject: RE: Signing what you don't understand

From: Adrian McCullagh <[email-masked]>
Date: Tue, 18 Jul 2000 13:08:27 +1000

Stephen,

I do not want to get into an argument with you.  Yes I am a lawyer but I
also have a technical background so your suggestion otherwise, I thought was
not moving the discussion forward. Admittedly, I do not possess the
technical knowledge that you have.

Your example is well put but is this really a digital signature or is it a
set of bits (a mark) that has been affixed using the same technology known
as digital signature technology.

You mention the difference between the 2 intents.  I would be surprised, if
anyone (other than the technically minded) even knows that a challenge
response is even being "signed".  There is no intent at all in this case. It
is the technology as designed that is effecting the response to the
challenge.  I am surprised that "you" sign authentication challenges, just
for authentication purposes.  Is it really a signature?  Are you really
signing the authentication challenge or is it the software on your machine
effecting the response to the challenge? 

To me this is not a signature.  It may use digital signature technology but
it is not a signature.  This is probably the problem.  It is the use of the
word "signature" which is a technical term but has been used by the PKI
community to cover a myriad of uses.  Some uses of the term by the PKI
community are confusing. 

I also do not agree with your position that the NR bit can signal any intent
either way.  With respect, intent is ascertained at the time of signing.  A
certificate has nothing what so ever to do with signing.  Its primary
purpose is to identify a public key that corresponds to a private key that
may be held by some previously identified person or entity.  The public key
is used to verify a digital signature that has supposedly been created using
the corresponding private key.  That is it as far as I understand it unless
there is some other primary purpose that I do not know.  I do not see the
relationship between digitally signing a document and the contents of a
certificate. Verification of the signature at some later time is a different
issue which may involve the use of a certificate but this may not be so.

Adrian McCullagh
Director of Electronic Commerce		Tel: 617 3231 1522
Gadens Lawyers					Fax: 617 3229 5850	
level 39
Central Plaza 1
345 Queen Street
Brisbane Australia 4000

Ph. D. Candidate 
Thesis "The Incorporation of Trust Strategies in Digital Signature
Regimes for Elec. Comm."
Information Security Research Centre
Queensland University of Technology

-----Original Message-----
From: Stephen Kent [mailto:[email-masked]]
Sent: Tuesday, July 18, 2000 10:00 AM
To: Adrian McCullagh
Cc: [email-masked]
Subject: RE: Signing what you don't understand

At 12:50 PM +1000 7/15/00, Adrian McCullagh wrote:
>Stephen
>
>I really do not understand your response.  Why would anyone sign a document
>that they do not understand.  It does not make sense.  If I sent you a
>document written in Chinese and assume you can not read Chinese and at the
>same time I said just sign this - Why would you sign it.  Now if you
trusted
>me then you may sign it based upon the information about the document that
I
>tell you.  A classic case for Non-est-factum.  But all the cases that I
have
>read clearly rely upon some information provided by an Alleged trusted
third
>party.  Usually some relative.  So without some external information being
>provided by a third party it is not as far as I can determine possible to
>rely upon non est factum.

Because we sign authentication challenges, just for authentication 
purposes, but not for NR purposes, it is prudent to distinguish 
between the two intents.  Your comments seem to ignore this use of 
digital signature technology. One way of signalling intent is via the 
NR bit. Although it has been argued that having this bit set to True 
does not necessarily signal intent to sign for NR purposes, having it 
set to False certainly signals an intent to not be bound re NR.

(Your use of Latin and your e-mail "signature" suggests a legal, but 
perhaps not a technical background. We've also decided, after much 
debate, that PKIX deals with technical aspects of NR, not legal 
details that may vary based upon jurisdiction.)

>Also what does a "bit" in a certificate got to do with non-repudiation.
The
>commercial world and the law does not in my opinion support this position
of
>yours.  You appear to be on a path to re-engineering the entire commercial
>legal fabric and as such I with the greatest respect I do not  believe that
>society and the law will buy into it.  With out the commercial involvement
>PKI will not survive.

The position is not just mine.  Sorry of you don't understand, or 
merely don't agree with the use of the NR bit, or its name, but we 
had this debate a while ago and we're not having it again.

>
>I do not understand how - "what you are proposing" - will work in practical
>terms.

I'm not "proposing," but I am citing existing Internet and ITU 
standards and the applicability to the question at hand.

Steve

---

From: Ben Laurie <[email-masked]>
Date: Tue, 18 Jul 2000 17:22:34 +0100

> community to cover a myriad of uses.  Some uses of the term by the PKI

If it is not a signature to you, then surely no digital signature is a
signature to you, since they are _always_ done by the machine.

As far as I'm concerned (and, I suspect, most other people on this
list), a digital signature is a technical term that describes a way to
bind some data to a (private) key.

You can then assign some significance to the intent of that "signature",
or, at least, people want to. A real issue with that assignment is that
the signature has always been done by software on behalf of the user.
Demonstrating that the user had intent is troublesome.

> issue which may involve the use of a certificate but this may not be so.

The relationship is that the creator of the certificate has stated what
he intends the use of the signature to be. So, if the NR bit is not set,
the owner of the private key has effectively stated that they do not
expect the key to be used for NR!

Cheers,

Ben.

--
http://www.apache-ssl.org/ben.html

Coming to ApacheCon Europe 2000? http://apachecon.com/

---

From: [email-masked] (Terry Hayes)
Date: Tue, 18 Jul 2000 09:57:33 -0700

> expect the key to be used for NR!

This is the root of the problem (in my opinion).  While you say that the owner of
the private key has stated what they want the key to be used for, in fact the
"creator" of the certificate is the CA, not the end entity.  This level of
indirection is very troubling for some.  It allows additional certificates to be
created (possibly by untrustworthy CA) that cloud the meaning of the signature.

In my opinion, it is best to put a clear statement of the intended purpose of the
signature in the signature itself.  A simple policy (or application) OID included
in the authenticated attributes would do the trick.  Failing that, the fingerprint
of the certificate itself should be included (as is proposed elsewhere), and the
application should check that the proper extensions are included in that
certificate prior to signing.

Terry Hayes
[email-masked]

---

From: Ben Laurie <[email-masked]>
Date: Tue, 18 Jul 2000 23:33:07 +0100

> created (possibly by untrustworthy CA) that cloud the meaning of the signature.

Since a certificate is comprised of public information signed by a CA,
clearly a CA can create a certificate saying more-or-less what they
want. I suppose this is an argument for having certificates that are
dual-signed (by the CA and the public key the contain).

> certificate prior to signing.

Or the relying application could check. Keep heading in this direction
and you'll get SPKI (which would be no bad thing, IMO).

Cheers,

Ben.