Re: [stir] Review of: draft-ietf-stir-passport-05

[Eric Rescorla <[e-mail]>]

On Sat, Aug 27, 2016 at 2:40 PM, Dave Crocker <[e-mail]> wrote:

> Chris,
>
> Thanks for the followup.  Pruned responses to responses, below...
>
>
> On 8/22/2016 10:58 AM, Chris Wendt wrote:
>
>> Detailed Comments -----------------
>>>
>>>> STIR
>>>> C. Wendt Internet-Draft
>>>> Comcast Intended status: Standards Track
>>>> J. Peterson Expires: January 23, 2017
>>>> Neustar Inc. July 22, 2016
>>>>
>>>>
>>>> Persona Assertion Token draft-ietf-stir-passport-05
>>>>
>>>> Abstract
>>>>
>>> ...
>
>> Is the timestamp the basis of claiming non-repudiation?
>>>
>>
>> Partially, depending on your interpretation of how non-repudiation is
>> achieved.  The digital signature based on a certificate is the
>> non-repudiation of the original assertion and signing of the token.
>>
>
> That seems to equate authentication with non-reputation of originator. But
> they aren't the same.
>

Do you mean "non-repudiation" here? I ask because "reputation" is also a
concept potentially in play here.


repudiation the sender of and authorization to send information
>>>> related to the originator of personal communications.  A
>>>>
>>>
>>> 'info related to'... what does this mean?
>>>
>>
>> Yes this was a bit too broad and the abstract text wasn’t updated
>> when the scope was reduced.
>>
>> replaced with: 'non-repudiation the author of the token, their
>> authority to author the token and, minimally, the asserted
>> originating identity or persona contained within the token
>> corresponding specifically to the originator of personal
>> communications'
>>
>
> My guess is that all of the above fall under authentication, not
> non-repuduation.  If my guess is wrong, it really would help to see a
> careful explanation of how it is non-repudiation rather than authentication.


I think it would probably be fine to remove the term "non-repudiation" from
this spec, since it only appears in the abstract. Generally, it's not that
useful a concept for most security settings, especially when one starts to
ask questions about the legal context.

With that said, given that these tokens are signed by their creator and
there is a timestamp to provide anti-replay, there is at least potentially
an important technical property being provided here, which is that in the
case where a passport creator signs a bogus passport, it is possible to
demonstrate that it did so, which is not a property necessarily provided by
authentication systems.

-Ekr