Certificate Purpose

[Paul Adare]

From: "Brian Komar (MVP)" <[email protected]>

| Except that non-repudiation is not needed for client authentication either.
| Non-reupdiation is more of an assertion of the measures used to link the
| holder of the private key to the subject of the certificate *and* the
| mechanisms used to protect that private key to prevent unauthorized access.
| Brian
|

And that's what an email certificate is all about.

No it is not what an email certificate is all about.

We aren't talking about a Smart Card here where we have; email, encryption and
authentication certificates.

Wrong again. When we're talking about email certificates, whether they be
signing or encryption certificates, and smart cards, the smart card is
simply a more secure storage method for the issued certificates.

 

[David H. Lipman]

|
| No, and actually non-repudiation is very difficult to implement. A signed
| email is more typically signed to indicate that the contents have not been
| tampered with during transit than to assert non-repudiation.
|

Tell that to the *very large* organization that I belong to where I have to sign email using
my specifically for purposes of non-repudiation.

 

[David H. Lipman]

From: "Paul Adare" <[email protected]>

| On Fri, 13 Jun 2008 16:22:20 -0400, David H. Lipman wrote:
|

|> Because the application is filtering on the actualy application policy used
|> to sign the email
|> You use the secure email apploication, you did not use the certificate for
|> authentication
|> Brian
|>

|
| No, and actually non-repudiation is very difficult to implement. A signed
| email is more typically signed to indicate that the contents have not been
| tampered with during transit than to assert non-repudiation.
|

http://www.infosec.gov.hk/english/itpro/public_main.html
"Digital signature is the means to ensure integrity, authenticity, and non-repudiation. A
digital signature is derived by applying a mathematical function to compute the message
digest of an electronic message or document, and then encrypting the result of the
computation with the use of the signer's private key. Recipient can verify the digital
signature with the use of the sender's public key."


http://www.pcmag.com/encyclopedia_term/0,2542,t=nonrepudiation&i=48067,00.asp
"Definition of: nonrepudiation

Not denying or reneging. Digital signatures and certificates provide nonrepudiation because
they guarantee the authenticity of a document or message. As a result, the sending parties
cannot deny that they sent it (they cannot repudiate it). Nonrepudiation can also be used to
ensure that an e-mail message was opened (see e-mail tracker). "


http://iase.disa.mil/pki/faq-pki-pke-may-2004.doc

 

[Paul Adare]

|
| No, and actually non-repudiation is very difficult to implement. A signed
| email is more typically signed to indicate that the contents have not been
| tampered with during transit than to assert non-repudiation.
|

Tell that to the *very large* organization that I belong to where I have to sign email using
my specifically for purposes of non-repudiation.

Just because your org is attempting to use the certs to assert
non-repudiation does not mean they will be successful in a court of law
when it comes down to brass tacks.
I do this for a living and I can assure you that asserting non-repudiation
is difficult at best.
Oh, and I do this for *extremely large* and security conscious orgs.

 

[Paul Adare]

"Digital signature is the means to ensure integrity, authenticity, and non-repudiation.

<snip>

I'm well aware of the various definitions here. What you're painfully
unaware of is the onerous process requirements and other requirements for
successfully asserting non-repudiation. A definition of it does not mean it
is easy to implement in practice. It isn't.

 

[David H. Lipman]

From: "Paul Adare" <[email protected]>


|
| Just because your org is attempting to use the certs to assert
| non-repudiation does not mean they will be successful in a court of law
| when it comes down to brass tacks.
| I do this for a living and I can assure you that asserting non-repudiation
| is difficult at best.
| Oh, and I do this for *extremely large* and security conscious orgs.

Tell that to the US DoJ. They ARE the Lawyers and yes, it is true for all branches of the
US Gov't. through PKE. What's good for the goose is good for the gander. If the US Gov't.
does it... it will pass the muster for corporate America.

Let's just end this with my stating...
I beg to differ and I value your input, opinions and information.

 

[Brian Komar \(MVP\)]

My summary is Non-Repudiation as you have discussed is just an attribute in
the certificate, easy to implement.
Non-repudiation as you are defining it has everything to do with the
issuance process and the tying of the certificate's private key to the
subject of the certificate.
The better the workflow and management of that workflow, the more likely you
are to achieve non-repudiation.
Personally, I do not believe that it is possible to achieve non-repudiation
without hardware protection of key material
Software key protection is too easily defeated.
Brian

 

[S. Pidgorny]

Hi David:

http://www.infosec.gov.hk/english/itpro/public_main.html
"Digital signature is the means to ensure integrity, authenticity, and
non-repudiation. A
digital signature is derived by applying a mathematical function to
compute the message
digest of an electronic message or document, and then encrypting the
result of the
computation with the use of the signer's private key. Recipient can verify
the digital
signature with the use of the sender's public key."

Digital signature is required, but is not sufficient, to facilitate
non-repudiation.