Subject: Re: [saag] some ITU-T liaisons asking for responses

From: Stephen Farrell <[email-masked]>
Date: Thu, 24 Jan 2013 11:49:44 +0000

On 01/23/2013 11:32 PM, Peter Gutmann wrote:
> Stephen Farrell <[email-masked]> writes:
> 
>> If someone cares more than that and wants us to say something else, please
>> let Sean and I know or reply here.
> 
> Shall I be the one to make the response about the standard total misuse of the
> term "nonrepudiation"?  Could they at least call it a contentCommitment
> architecture?

Well, we're sinners there ourselves too, though I do hope
at least folks in the security area have moved all their
"N-R as a n/w service" texts to the fiction shelf:-)

Could be a fine informational RFC or BCP though if someone
wanted to write one up e.g. describing why and when to not
use the term N-R and suggesting better alternatives. We
still fairly regularly see the term used in non-security
drafts so having something at which to point might help a
bit.

Anyway, I expect haggling over terminology with ITU-T
won't be highly productive (for us anyway;-) so I'd suggest
we not get into that for now, but we could if folks really
want us to send back that message.

S.

> Peter.

---

From: Paul Hoffman <[email-masked]>
Date: Thu, 24 Jan 2013 06:03:08 -0800

> want us to send back that message.

A big -1 on us sending that message to the ITU until we have cleaned up our own act on use of the term. No need to spread the hypocrisy.

--Paul Hoffman

---

From: Ben Laurie <[email-masked]>
Date: Fri, 25 Jan 2013 09:37:32 +0000

> "N-R as a n/w service" texts to the fiction shelf:-)

http://tools.ietf.org/html/rfc5280

---

From: Stephen Farrell <[email-masked]>
Date: Fri, 25 Jan 2013 10:06:43 +0000

> http://tools.ietf.org/html/rfc5280

Heh. To be fair when we did that we were trying to work
around the N-R bit. Much as we'd like to have denied its
existence, that wasn't possible;-)

S.

---

From: Paul Hoffman <[email-masked]>
Date: Fri, 25 Jan 2013 08:49:37 -0800

> existence, that wasn't possible;-)

We could have gotten a lot closer than we did, but we chose not to because of lack of gumption on our part. Thus, we should not point any fingers at the ITU for perpetuating something that we could have helped deprecate long ago.

--Paul Hoffman

---

From: Eliot Lear <[email-masked]>
Date: Fri, 25 Jan 2013 17:52:36 +0100

Paul,

> We could have gotten a lot closer than we did, but we chose not to because of lack of gumption on our part. Thus, we should not point any fingers at the ITU for perpetuating something that we could…

This needn't be about finger pointing.  It be about pointing out
difficult problems we have faced, and perhaps some that we need to face.

Eliot

---

From: Paul Hoffman <[email-masked]>
Date: Fri, 25 Jan 2013 08:54:31 -0800

> difficult problems we have faced, and perhaps some that we need to face.

If our note to the ITU admits that the IETF needs to deal better with dismissing the notion of non-repudiation, that's great. I would happily work on the wordsmithing for such a statement. That's not what was proposed, however.

--Paul Hoffman