Subject: Re: New Internet Draft on Non-Repudiation Requirements

From: [email-masked]
Date: Wed, 1 Sep 1999 10:41:28 -0400

I was referring to X.509 (June '97 edition) section 11.2 note 2, which says
"If a non-repudiation of data service is dependent on keys provided by the CA,
the service should ensure that all relevant keys of the CA (revoked or expired)
and the timestamped revocation lists are archived and certified by a current
authority."  This is one of the very few statements in X.509 or RFC 2459 which
makes clear demands on the CA in connection with the non repudiation service.
Perhaps my reading of this passage as applying only to those CRL's which record
the revocation of certificates with NR set but not to those which don't is
debatable, but it certainly applies to them at a minimum.

          Tom Gindin

Denis Pinkas <[email-masked]> on 09/01/99 04:22:04 AM

To:   Tom Gindin/Watson/IBM@IBMUS
cc:   [email-masked]
Subject:  Re: New Internet Draft on Non-Repudiation Requirements

Tom,

You said:

>      I think that we should remember that the NR bit is supposed to cause CRL
> archiving  as well.

I am not sure what you mean by this statement. If you mean archiving
by the CA that issued the CRL, then I disagree. If you mean
archiving of CRL by the verifier when it first verifies the
signature, then I agree (but this archiving is not triggered by the
presence of the NR bit). But maybe you mean something else.

Denis

---

From: Denis Pinkas <[email-masked]>
Date: Wed, 01 Sep 1999 17:07:48 +0200

Tom,
 
> authority."  

As far as I know, notes in an ISO standard are not normative.
Secondly, the sentence says "should". So this is not mandated.

> This is one of the very few statements in X.509 or RFC 2459 which

The content of the note is very debatable and I suspect subject to
multiple interpretations. I would not even try to make it better
understandable.

I only wanted to point out that CAs issuing certificates with the NR
bit set are not *mandated* to do anything more than CA issuing
certificates with the NR bit not set.

Denis

---

From: Tony Bartoletti <[email-masked]>
Date: Wed, 01 Sep 1999 10:10:31 -0700

Tom,

>and the timestamped revocation lists are archived and certified by a current

... does not place demands upon the CA, per se.  What it says is that the
"non-repudiation of data service" should ensure that the relevant CA stuff
 is archived and certified."

Are you assuming that the NR-service is strictly provided by the CA?

___tony___

Tony Bartoletti                                             LL
IOWA Center                                              LL LL
Lawrence Livermore National Laboratory                LL LL LL
PO Box 808, L - 089                                   LL LL LL
Livermore, CA 94551-9900                              LL LL LLLLLLLL
phone: 925-422-3881   fax: 925-423-8081               LL LLLLLLLL
email: [email-masked]                                   LLLLLLLL