Re: [stir] Review of: draft-ietf-stir-passport-05

[Eric Rescorla <[e-mail]>]

On Sat, Aug 27, 2016 at 5:07 PM, Dave Crocker <[e-mail]> wrote:

> On 8/27/2016 4:52 PM, Eric Rescorla wrote:
>
>>
>>
>> On Sat, Aug 27, 2016 at 2:40 PM, Dave Crocker <[e-mail]
>> <mailto:[e-mail]>> wrote:
>>
>
>
>>             Is the timestamp the basis of claiming non-repudiation?
>>
>>
>>         Partially, depending on your interpretation of how
>>         non-repudiation is
>>         achieved.  The digital signature based on a certificate is the
>>         non-repudiation of the original assertion and signing of the
>> token.
>>
>>
>>     That seems to equate authentication with non-reputation of
>>     originator. But they aren't the same.
>>
>>
>> Do you mean "non-repudiation" here? I ask because "reputation" is also a
>> concept potentially in play here.
>>
>
> I'm using 'non-repudiation' because the spec uses that term.
>
> If the spec really means 'reputation', that opens a different set of
> concerns, since nothing in any of the 3 documents has to do with
> reputation, per se.


Just checking.


I think it would probably be fine to remove the term "non-repudiation"
>> from this spec, since it only appears in the abstract. Generally, it's
>> not that useful a concept for most security settings, especially when
>> one starts to ask questions about the legal context.
>>
>> With that said, given that these tokens are signed by their creator and
>> there is a timestamp to provide anti-replay, there is at least
>> potentially an important technical property being provided here, which
>> is that in the case where a passport creator signs a bogus passport, it
>> is possible to demonstrate that it did so, which is not a property
>> necessarily provided by authentication systems.
>>
>
> And I believe that was my original guess, although my very limited
> understanding of non-repudiation includes the significant burden of having
> the timestamp, itself, be validated by an independent authority. Otherwise,
> the signer could claim any time they want to...


That doesn't seem correct to me, at least if "independent" means someone
other than the relying party. The signature is itself a proof attaching the
signer's private key to the passport and to a claim by the signer about the
passport object's assertions being valid at the time in the timestamp. If
the relying party checks the timestamp and rejects it if it has a bogus
timestamp, then any acceptable passport will be relatively fresh and thus
will be usable as a proof of the signer's representation at the relevant
time. Overall, this seems less important than the freshness property wrt
authentication, but it's still a technical property.

-Ekr


> d/
>
>
> --
>
>   Dave Crocker
>   Brandenburg InternetWorking
>   bbiw.net
>