Subject: Re: Question about the edition of RFC 3280

From: Peter Sylvester <[email-masked]>
Date: Mon, 5 May 2003 17:58:23 +0200 (MET DST)

Thanks for your reply. 

Is the description of 'The Monday discussion'
an agreed report shared by the participants of the meeting?

A way forward

> In X.509 and RFC 2459 this bit is set when a digital signature mechanism is being 
  used, but not when the digital signature mechanism is used to provide a non repudiation
  service. In RFC 3280, the later restriction has disappeared. The signer is thus loosing
  its argument to repudiate its signature.

Are you saying that with the new text, when there is ONLY
the DS bit a signer is no longer able to repudiate a signature?

---

From: "Hoyt L. Kesterson II" <[email-masked]>
Date: Mon, 5 May 2003 11:50:12 -0700

you can always repudiate anything, even that it was your system
doing a key exchange. the question is whether you are
successful.

the defect report to which denis is referring is not that new and
is not being done as an alignment issue but in response to the obvious
confusion on this subject. the first version was drafted at a meeting
in september.

it has already had one ballot round but clearly still had some
problems. comments on that dtc were addressed at a meeting in london
in february with a revision of the dtc that will be resubmitted soon
for ballot. (i want to get the new pdam out first).

i don't want to discuss the proposed text here. please wait until
it is available to the group. however, one item of text in the first
proposal that was not contested in the ballot and is in the revised
dtc  that will be balloted

More than one
bit may be set in an instance of the keyUsage extension. The setting of multiple bits shall not
change the meaning of each individual bit but indicates that the
certificate can be used for all of the purposes indicated by the set
bits.

i discussed the conclusions of the group working on the dtc in my
two presentations at the rsa conference. if interested, you should be
able to find my slides on their conference presentation site

hoyt

At 17:58 +0200 5/5/03, Peter Sylvester wrote:

Thanks for your reply.

A way forward

> In X.509 and RFC 2459 this bit is set when a digital signature
mechanism is being

used, but not when the digital signature mechanism is used to
provide a non repudiation

service. In RFC 3280, the later restriction has disappeared.
The signer is thus loosing

the DS bit a signer is no longer able to repudiate a
signature?