Subject: Re: New Internet Draft on Non-Repudiation Requirements

From: [email-masked]
Date: Tue, 7 Sep 1999 11:26:30 -0400

Thank you for your comments.  After looking at some of these comments, I
think I should add some more stuff to some of the sections.  I'm copying in my
proposed section 3.4 from the transmittal as well.  My direct responses to your
questions are bracketed with [TG: comment].

3.4  The relying party should create, and save with the data submitted, a
package containing a current time stamp signed by an independent authority.
This object signed by the independent authority should include, in addition to
the time stamp, one of the following: a countersignature created by the relying
party, a copy of the "signature block" of the submitted document, or the entire
submitted document.

(Add to 3.2)   If the relying party has verified the certificate using a server
supporting a "signed-status-response" protocol such as OCSP or SCVP, the relying
party must store the tatus responses with the data submitted.  If the relying
party has verified the certificate using a CRL, the relying party may store that
CRL with the data submitted.  The relying party should also include the chain of
issuer certificates back to his (or her) trusted root.

(Add to 4.1)   If the relying party has verified the certificate using a server
supporting a "signed-status-response" protocol such as OCSP or SCVP, the relying
party must include the status responses in the escrow package.  If the relying
party has verified the certificate using a CRL, the relying party may include
that CRL in the escrow package.  The relying party should also include the chain
of issuer certificates back to his (or her) trusted root.

          Tom Gindin

Hi Tom,

I've attached an edited version of your document. My comments are bracketed
by "[AP: comment]".

Regards,
Aram

Internet-Draft                                       Thomas Gindin
PKIX WG                                                 IBM Corp.
Intended Category: Informational
Expires: 28 February 2000                          28 August, 1999

                 Internet X.509 Public Key Infrastructure
          Technical Requirements for a non-Repudiation Service
                 <draft-gindin-pkix-technr-00.txt>

STATUS OF THIS MEMO

This document is an Internet-Draft and is in full conformance with
all the provisions of Section 10 of RFC2026.

Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that other
groups may also distribute working documents as Internet-Drafts.

Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."

The list of current Internet-Drafts can be accessed at
http://www.ietf.org/ietf/1id-abstracts.txt.

The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html.

This Internet-Draft expires on February 28, 2000. Comments and
suggestions on this document are encouraged. Comments on this
document should be sent to the PKIX working group discussion list:
                <[email-masked]>
or directly to the author, at [email-masked].

This Internet-Draft represents the views of its author, and not
necessarily those of his employer.

ABSTRACT

This document describes those features of a service which processes
signed doucments which must be present in order for that service to
constitute a "technical non-repudiation" service.  A technical
non-repudiation service must permit an independent verifier to
determine whether a given signature was applied to a given data object
by the private key associated with a given valid certificate, at a time
later than the signature.  The features of a technical non-repudiation
service are expected to be necessary for a full non-repudiation service,
although they may not be sufficient.
[AP: You've defined a "'technical non-repudiation' service", but not a "full
non-repudiation service". I'll use the acronym "TNR" for technical
non-repudiation and "FNR" for full non-repudiation.]

This document is intended to clarify the definition of the
"non-repudiation" service in RFC 2459.  It should thus serve as a guide
to when the nonRepudiation bit of the keyUsage extension should be used
[AP: We should be consistent with either "nonrepudiation" or "non-repudiation".
Also, does "used" mean the same thing as "set"?]
[TG: "when the nonRepudiation bit should be used" could easily be "... set"
without any real change in meaning.]
and to when a Certificate Authority is required to archive CRL's.
[AP: Does the CA only have to archive CRL's for TNR? Does the CA need to perform
a higher due diligence before setting the NR bit? Can the CA set the NR bit
without the subject requesting that the bit be set?]
[TG: It is stated above, that FNR incorporates TNR as a core set of
requirements.  Thus, CRL archiving is only directly mandated for TNR - but that
mandates it for FNR as well.]
[TG: Higher levels of due diligence are probably needed for FNR.  I doubt if
they are needed for TNR.]
[TG: The CA can set the bit if it wishes.  This service does not have the kind
of heavy-duty legal requirements that FNR is likely to.]

1 Introduction

RFC 2459 [1] specifies a bit within the KeyUsage extension called the
nonRepudiation bit which is "asserted when the subject public key is
used to verify digital signatures used to provide a non-repudiation
service which protects against the signing entity falsely denying some
action, excluding certificate or CRL signing."  Extensive discussions
in the PKIX WG have revealed that the description of the non-repudiation
service contained in this passage is not widely enough understood or
agreed upon to characterize any given service as providing or not
providing a non-repudiation service.  Two major categories of service
have been proposed as potentially providing a non-repudiation service:
the technical non-repudiation service, which this draft attempts to
define with greater precision, and a full non-repudiation service
which is intended to prevent all possible repudiations of a signed
object or document.  Since a full non-repudiation service is required
to meet all the requirements of this technical non-repudiation service
as a prerequisite, the technical non-repudiation service's definition
is necessary for both [AP: I disagree if you require the NR bit to be set].
[TG: I'm not defining FNR here.  An FNR set of requirements is likely to define
a needed keyPurpose ID in the XKU extension, anyway.  My question is whether you
and the other FNR supporters believe that there needs to be some indication in
the certificate that a given certificate is intended for NR or FNR use.]

1.1  Definitions

Signing Certificate:     A certificate containing the key pair whose
[AP: Containing the "key pair" or the "public key component of a key pair
whose"]
[TG: Thanks - the second variant is clearer than mine.]
private key was used to create the signature being verified.

Signer:        The party who created the signature being verified.  It
is outside the scope of these requirements to distinguish between the
actual signer and the holder of the signing certificate.
[AP: The r-p is a "holder of the signing certificate". Do you mean the actual
signer and the owner of the private key?]
[TG: Probably "subject" is better than "holder" here and below.  Thanks.]

Relying Party: The party who received the signature being verified, and
initially verified it.

Verifier: An entity independent of both the signer and the relying
party who is verifying that the supplied signature, data object, and
certificate are consistent with each other.

1-way NR: A service in which the relying party preserves
sufficient evidence to permit the verifier to perform a verification,
and may submit it for verification by his or her own action.

2-way NR: A service in which the relying party submits
sufficient evidence to permit the verifier to perform a verification
to a third party, known as the "escrow holder". [AP: I had to read
this definition several times before understanding it. How about
 defining escrow holder first and then defining 2-way NR as "A service
 in which the r-p submits sufficient evidence to an escrow holder that
allows a verifier to perform a verification at a later time."?]
[TG: I'll wait to see if others are confused by 2-way vs. 1-way NR.  Your
suggestion about order might be easier to understand and doesn't damage the
meaning.]

Escrow holder: The party responsible for preserving signature evidence
in 2-way NR.  The escrow holder may also be, but need not be, the
verifier.

Escrow package:     The data submitted from the relying party to the escrow
holder, in 2-way NR [AP: ", that constitutes sufficient evidence"][TG: No - I
may need to add something about post-storage responsibilities of the escrow
holder].  The escrow holder may add certain auditing and tracking information to
this package before storage.

NR service:    The technical nonRepudiation service referenced above. [AP: I
think you should define it here again, and this be the formal definition.][TG:
Actually, it probably should include a statement about either 1-way or 2-way
being needed]

keyUsage extension: A standard extension within X.509v3 certificates
with object identifier { 2 5 29 15 }, consisting of a series of
enumerated bits.

NR bit:        The nonRepudiation bit (offset 1) of the keyUsage
extension.

1.2  Scope and caveats

     The [AP: "T"]NR service is expected to provide evidence that a given
object was signed by the private key corresponding to a given
certificate which was valid at the time of signature.  It is not
anticipated that the use of the NR service will ordinarily constitute
execution of a contract, or acceptance of any other legal obligation.
It is anticipated that the use of this service in accepting legal
obligations will be the subject of legislation or judicial decision
in various jurisdictions, which are likely to lay additional technical
burdens upon the provision of such a service to such an extent as to
constitute another, larger service which need not be the same in all
jurisdictions.[AP: This sentence is too long!]  It is outside the scope of the
definition of this
service to provide evidence that the signer and the holder of the
signing certificate are the same [AP: ditto comment above about holder vs.
owner.][TG: subject]
, that the signer has been adequately informed of the content which is signed,
that the signer is not acting
under duress, etc. [AP: I think the scope should only include when the NR bit is
set, but clearly state that you can have FNR with the NR bit not set (as have
been stated in the WG).][TG: That is fairly controversial in the WG, and I'm not
doing the FNR definition].

2    Requirements for both 1-way and 2-way NR

2.1  The signer must submit, with the signature, the signing
certificate or an unambiguous identifier of that certificate.
Unambiguous identifiers of certificates include the combination of a
certificate serial number with an issuer name [AP: You've only given 1
identifier.][TG: So far, that's right.  I wasn't trying to be exhaustive.]

2.2  The signer must submit, with the signature, the content being
signed or an unambiguous reference to that content.  It is explicitly
contemplated that a URI constitutes an unambiguous reference to its
content. [AP: Do we have to worry about platform specific transformations, i.e.
CRLF vs. CR v. LF, base-64 encoding, compression, etc?]
[TG: Canonicalization of an external document is out of scope for this.]

2.3  The signer must include, in the base over which the signature
is calculated, the time at which the signature was created.[AP: I think this
 opens up a can of worms: local time, GMT, precision, trusted, etc.]
[TG: Format is not, and does not have to be, specified for this.  The signer has
to trust this time, but either the RP or the escrow holder (depending on 1-way
vs. 2-way) will be adding a time stamp of their own.]

2.4  The relying party must, before accepting the signature, verify
that the signing certificate is valid.  This verification should include
a CRL check.[AP: Do we allow OCSP or SVCP?]
[TG: Your point about OCSP and SCVP is well taken.  They should be allowed (I
didn't remember that they had an effective time field).  However, they will need
some extra archiving requirements because CRL archiving might not apply
sufficiently to them.]

2.5  The relying party must, before accepting the signature, verify
the signature of the data object being submitted.[AP: This seems too
obvious. Why would a r-p accept a signature that does not verify?]
[TG: A single sentence on something obvious isn't a serious problem, is it?]

3    Requirements for 1-way NR

3.1  The relying party must save a copy of the content being signed.[AP: Is a
 URI sufficient as in 2.2 above?]
[TG: A URI isn't good enough.  It says "content" not "content or reference".]

3.2  The relying party must save the identity of the signing
certificate, along with the content of the signature.[AP: Isn't the
 certificate self-identifiable? Isn't is sufficient to save the certificate?]
[TG: Content of the signature, not of the certificate.  The full certificate is
acceptable, of course, since it contains its own ID.]

3.3  The relying party must check that the signing certificate
contains a keyUsage extension.  If the extension is not present or does
not contain the nonRepudiation bit, and the version of the certificate
is v3 or higher, the submission must be rejected.[AP: I (and others in the WG)
 believe this is wrong. Above you state the TNR is a requirement for FNR,
but I think it has been shown in the recent discussions that the NR bit is NOT
required for FNR.]
[TG: 1-way NR is not a basis for FNR.  We can discuss this under 4.3, however.]

4    Requirements for 2-way NR

4.1  The relying party must submit to the escrow holder a copy of
the content being signed, the identity of the signing certificate, and
the signature.[AP: ditto comment as in 3.2]
[TG: Content of the signature, not of the certificate.]

4.2  The relying party must sign the submission to the escrow holder.
The relying party SHOULD include, in the base over which that signature
is calculated, the current time. [AP: ditto comment as in 2.3]  This time will
be between the time
when the signer submitted the signature and the time when the package
is submitted.  The signed object submitted is known as the escrow
package.
[TG: This does need some work, although format and precision aren't the major
issues.  I think I need to add a requirement that the escrow holder add some
fields to the escrow package, which MUST include the time of receipt, for
example].

4.3  The relying party must check whether or not the signing
certificate contains a keyUsage extension.  If the keyUsage extension
is present and the nonRepudiation bit is not set the submission must be
rejected.[AP: ditto comment as in 3.3]
[TG: If the group really wants this, I'll put in some wording about how "larger
services extending this one may dispense from this requirement".  Note that
missing keyUsage's are allowed here although not for 1-way.]

5 Copyright

Copyright (C) The Internet Society (date). All Rights Reserved.

This document and translations of it may be copied and furnished to
others, and derivative works that comment on or otherwise explain it
or assist in its implementation may be prepared, copied, published
and distributed, in whole or in part, without restriction of any
kind, provided that the above copyright notice and this paragraph are
included on all such copies and derivative works.  However, this
document itself may not be modified in any way, such as by removing
the copyright notice or references to the Internet Society or other
Internet organizations, except as needed for the purpose of
developing Internet standards in which case the procedures for
copyrights defined in the Internet Standards process must be
followed, or as required to translate it into languages other than
English.

The limited permissions granted above are perpetual and will not be
revoked by the Internet Society or its successors or assigns.

This document and the information contained herein is provided on an
"AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

6 References

[1] R. Housley, W. Ford, W. Polk, and D. Solo "Internet X.509 Public Key
Infrastructure Certificate and CRL Profile", RFC 2459, January 1999
[2] X.509(97)

7 Author's Address

Thomas Gindin
IBM Corporation
800 North Frederick Ave.
Gaithersburg, MD 20879
USA

Email: [email-masked]

Internet-Draft Technical Requirements for a non-Repudiation Service
Expires: 28 February 2000

---

From: Tony Bartoletti <[email-masked]>
Date: Tue, 07 Sep 1999 11:07:52 -0700

>[TG: A URI isn't good enough.  It says "content" not "content or reference".]

[TB: What about the (crypto-strength) hash of a content?  Not that we often sign
100 MB documents, but perhaps digital photographs, video, sound recordings, ...
Of course, it would behoove the RP to keep a full copy so that the hash could be
reproduced at their discretion.  A URI is simply a pointer, right? and certainly
would not suffice alone.]

[TB: Overall, kudos for a well thought out exposition!]

___tony___

Tony Bartoletti                                             LL
IOWA Center                                              LL LL
Lawrence Livermore National Laboratory                LL LL LL
PO Box 808, L - 089                                   LL LL LL
Livermore, CA 94551-9900                              LL LL LLLLLLLL
phone: 925-422-3881   fax: 925-423-8081               LL LLLLLLLL
email: [email-masked]                                   LLLLLLLL

---

From: "Tamura, Takuya" <[email-masked]>
Date: Mon, 13 Sep 1999 17:29:38 +0900

Hello Tom & Aram

Subject: Re: New Internet Draft on Non-Repudiation Requirements
   Date:Tue, 7 Sep 1999 11:26:30 -0400
   From: [email-masked]
     To:"Aram Perez" <[email-masked]>
     CC: [email-masked]
> suggestion about order might be easier to understand and doesn't damage the

  I was also confused when I read this definition for the first time.
  (This may be because I didn't know the word "escrow", though)

> Subject: Re: New Internet Draft on Non-Repudiation Requirements
>    Date: Tue, 07 Sep 1999 17:02:30 -0700
>    From: "Aram Perez" <[email-masked]>
>     To: PKIX <[email-masked]>
> [AP1: I think you need a better explanation of the differences between 1 and
> 2-way NR and why they are needed.]

 I would like to know what Aram wrote above.
 I didn't understand why 2 types of NR are necessary from the draft.
  (I'm reading this mailing list for about one month.
   Do I miss something?)

 Best Regards,
 Tak