Non-repudiation (was RE: The PAIN mnemonic)

[Carl Ellison]

> -----Original Message-----
> From: Anne & Lynn Wheeler [mailto:lynn at garlic.com] 
> Sent: Sunday, December 21, 2003 6:42 AM
> To: Carl Ellison
> Cc: 'Anne & Lynn Wheeler'; cryptography at metzdowd.com
> Subject: Re: The PAIN mnemonic
> 
> At 11:20 PM 12/20/2003 -0800, Carl Ellison wrote:

> >and it included non-repudiation which is an unachievable, 
> nonsense concept.

> one could look at one aspect of non-repudiation as the 
> requirement for 
> everybody having a unique pin/password with guidelines never to share 
> pin/passwords ... which could be considered across a broad range of 
> security activities. 

That's an interesting definition, but you're describing a constraint on the
behavior of a human being.  This has nothing to do with cryptosystem choice
or network protocol design.  What mechanisms do you suggest for enforcing
even the constraint you cite?  Of course, that constraint isn't enough.  In
order to achieve non-repudiation, the way it is defined, you need to prove
to a third party (the judge) that a particular human being knowingly caused
a digital signature to be made.  A signature can be made without the
conscious action of the person to whom that key has been assigned in a
number of ways, none of which includes negligence by that person.

Let's just leave the term "non-repudiation" to be used by people who don't
understand security, but rather mouth things they've read in books that
others claim are authoritative.  There are lots of those books listing
"non-repudiation" as a feature of public key cryptography, for example, and
many listing it as an essential security characteristic.  All of that is
wrong, of course, but it's a test for the reader to see through it.

 - Carl

+------------------------------------------------------------------+
|Carl M. Ellison         cme at acm.org      http://theworld.com/~cme |
|    PGP: 75C5 1814 C3E3 AAA7 3F31  47B9 73F1 7E3C 96E7 2B71       |
+---Officer, arrest that man. He's whistling a copyrighted song.---+ 

---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com