Re: [stir] Review of: draft-ietf-stir-passport-05

[Chris Wendt <[e-mail]>]

Agree, will remove term “non-repudiation", discussed this in ATIS Task Force and came to realization that we are looking at the Passport representing purely an assertion of the identity and the signer is the party responsible for that assertion, and “buyer beware”.


> On Aug 27, 2016, at 8:07 PM, Dave Crocker <[e-mail]> wrote:
> 
> On 8/27/2016 4:52 PM, Eric Rescorla wrote:
>> 
>> 
>> On Sat, Aug 27, 2016 at 2:40 PM, Dave Crocker <[e-mail]
>> <mailto:[e-mail]>> wrote:
> 
>> 
>>            Is the timestamp the basis of claiming non-repudiation?
>> 
>> 
>>        Partially, depending on your interpretation of how
>>        non-repudiation is
>>        achieved.  The digital signature based on a certificate is the
>>        non-repudiation of the original assertion and signing of the token.
>> 
>> 
>>    That seems to equate authentication with non-reputation of
>>    originator. But they aren't the same.
>> 
>> 
>> Do you mean "non-repudiation" here? I ask because "reputation" is also a
>> concept potentially in play here.
> 
> I'm using 'non-repudiation' because the spec uses that term.
> 
> If the spec really means 'reputation', that opens a different set of concerns, since nothing in any of the 3 documents has to do with reputation, per se.
> 
> 
>> I think it would probably be fine to remove the term "non-repudiation"
>> from this spec, since it only appears in the abstract. Generally, it's
>> not that useful a concept for most security settings, especially when
>> one starts to ask questions about the legal context.
>> 
>> With that said, given that these tokens are signed by their creator and
>> there is a timestamp to provide anti-replay, there is at least
>> potentially an important technical property being provided here, which
>> is that in the case where a passport creator signs a bogus passport, it
>> is possible to demonstrate that it did so, which is not a property
>> necessarily provided by authentication systems.
> 
> And I believe that was my original guess, although my very limited understanding of non-repudiation includes the significant burden of having the timestamp, itself, be validated by an independent authority. Otherwise, the signer could claim any time they want to...
> 
> d/
> 
> 
> -- 
> 
>  Dave Crocker
>  Brandenburg InternetWorking
>  bbiw.net