Security Basics mailing list archives
Re: Proving non-repudiation in e-Commerce App
From: "Saqib Ali" <docbook.xml () gmail com>
Date: Fri, 2 Jun 2006 08:56:41 -0700
A Digg discussion regarding this post: http://www.digg.com/security/Can_you_prove_non-repudiation_in_eCommerce_Apps_ On 6/1/06, Craig Wright <cwright () bdosyd com au> wrote:
Hello, Firstly there is no way to prove non-repudiation. There is no valid means to prove encryption. For those who do not agree, please read up on computational mathematics and the N vs NP problem (also see computational theory in general). Micheal Sipser (from MIT) has some excellent papers on the topic. Next lets get to prove. Prove is a mathematical determination of a rule. Even in the case of a discovered and somehow proven encryption algorithm there is no way to prove non-repudiation. What does this mean? It comes down to a likelihood determination. This is a probabilistic determination of the Cumulative distribution function (CDF) associated with the survival and hazard functions of the plot of time against likelihood of compromise. Even in cases of a perfect algorithm there is an associated hazard function associated with a brute force compromise of the key. In most cases this Probability density Function (PDF) correlates to a Poisson distribution. So what you are looking at in reality is a survival function that will be acceptable in a court of law that will not be readily repudiable by the opposing party. To do this you need to look at proof beyond reasonable doubt. This is due to the criminal standard of proof being used for deceit. As you wish to prove against a person who may be lying this is the necessary level of proof. In common law courts this is generally (though not exclusively) held at a determined confidence level (CI) of 99%. That is an alpha set at 1%. Now the determination needs to be complete in a cumulative manner which includes the totality of the systems. In this you need to determine the individual hazard function for each of the components. This is than extrapolated into the total Survival function estimate for the system. One property of the exponential distribution and hence the Poisson process is that it is memory-less (This is the number of incidents occurring in any bounded interval of time after time t is independent of the number of arrivals occurring before time t). Now this means that you are attempting to determine the lambda function λ(t) associated with each hazard occurrence (being the likelihood of brute force or other key compromise). The number of expected key compromises for each component is than the integral of λ(t) for the period from 0 (start time) to a determined safe time (i.e. promised non-repudiation of 5 years, 25 years etc). So yes there are ways to achieve what you are asking. What you are looking at is the expected "safe" time of your system. Regards, Craig -----Original Message----- From: Joe [mailto:bitshield () gmail com] Sent: Friday, 2 June 2006 4:32 AM To: security-basics () securityfocus com Subject: Proving non-repudiation in e-Commerce App Dear List-Members I'm currently dealing with a review of an e-Commerce Application. One goal is to prove that this application properly implements a non-repudiation mechanism throughout the whole process-flow. This flow starts at the user authentication, communication over the web to the server component, then processing of the client requests and finally logging. The non-repudiation has similarities with e-Banking which points me to the following keywords: digital signature, signed logging and time stamp protocols. Using Google I also found various sources discussing most of those points individually. However I'm looking for a more general, broad and complete approach. Do you guys have interesting sources and experiences about verifying non-repudiation? Are there standards, defined processes, work-flows, and implementation- or audit guidelines? Thanks for your feedback Joe Liability limited by a scheme approved under Professional Standards Legislation in respect of matters arising within those States and Territories of Australia where such legislation exists. DISCLAIMER The information contained in this email and any attachments is confidential. If you are not the intended recipient, you must not use or disclose the information. If you have received this email in error, please inform us promptly by reply email or by telephoning +61 2 9286 5555. Please delete the email and destroy any printed copy. Any views expressed in this message are those of the individual sender. You may not rely on this message as advice unless it has been electronically signed by a Partner of BDO or it is subsequently confirmed by letter or fax signed by a Partner of BDO. BDO accepts no liability for any damage caused by this email or its attachments due to viruses, interference, interception, corruption or unauthorised access.
-- Saqib Ali, CISSP, ISSAP Support http://www.capital-punishment.net ----------- "I fear, if I rebel against my Lord, the retribution of an Awful Day (The Day of Resurrection)" Al-Quran 6:15 -----------
Current thread:
- Proving non-repudiation in e-Commerce App Joe (Jun 01)
- <Possible follow-ups>
- RE: Proving non-repudiation in e-Commerce App Craig Wright (Jun 01)
- Re: Proving non-repudiation in e-Commerce App Saqib Ali (Jun 02)
- Re: RE: Proving non-repudiation in e-Commerce App bitshield (Jun 02)
- RE: RE: Proving non-repudiation in e-Commerce App Craig Wright (Jun 05)
- RE: Proving non-repudiation in e-Commerce App Craig Wright (Jun 05)