Re: [stir] Review of: draft-ietf-stir-passport-05

[Dave Crocker <[e-mail]>]

On 8/27/2016 4:52 PM, Eric Rescorla wrote:
>
>
> On Sat, Aug 27, 2016 at 2:40 PM, Dave Crocker <[e-mail]
> <mailto:[e-mail]>> wrote:

>
>             Is the timestamp the basis of claiming non-repudiation?
>
>
>         Partially, depending on your interpretation of how
>         non-repudiation is
>         achieved.  The digital signature based on a certificate is the
>         non-repudiation of the original assertion and signing of the token.
>
>
>     That seems to equate authentication with non-reputation of
>     originator. But they aren't the same.
>
>
> Do you mean "non-repudiation" here? I ask because "reputation" is also a
> concept potentially in play here.

I'm using 'non-repudiation' because the spec uses that term.

If the spec really means 'reputation', that opens a different set of 
concerns, since nothing in any of the 3 documents has to do with 
reputation, per se.


> I think it would probably be fine to remove the term "non-repudiation"
> from this spec, since it only appears in the abstract. Generally, it's
> not that useful a concept for most security settings, especially when
> one starts to ask questions about the legal context.
>
> With that said, given that these tokens are signed by their creator and
> there is a timestamp to provide anti-replay, there is at least
> potentially an important technical property being provided here, which
> is that in the case where a passport creator signs a bogus passport, it
> is possible to demonstrate that it did so, which is not a property
> necessarily provided by authentication systems.

And I believe that was my original guess, although my very limited 
understanding of non-repudiation includes the significant burden of 
having the timestamp, itself, be validated by an independent authority. 
Otherwise, the signer could claim any time they want to...

d/


-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net