Subject: RE: German Law and OCSP

From: Ambarish Malpani <[email-masked]>
Date: Thu, 24 Feb 2000 15:02:48 -0800

Hi Paul,
    Just one correction - OCSP can tell you of the historical
status of a cert - there is an ArchiveCutoff mechanism. If your
cert expired after ArchiveCutoff, then the status is as indicated
in the response.

Regards,
Ambarish

P.S. I, too, would appreciate pointers to English versions of both
the German and Italian Digital Signature laws.

---------------------------------------------------------------------
Ambarish Malpani
Architect                                                650.567.5457
ValiCert, Inc.                                  [email-masked]
1215 Terra Bella Ave.                         http://www.valicert.com
Mountain View, CA 94043-1833

> -----Original Message-----
> From: Paul Halliden [mailto:[email-masked]]
> Sent: Thursday, February 24, 2000 8:53 AM
> To: 'Hesse, Johan'; [email-masked]; [email-masked];
> [email-masked]
> Cc: [email-masked]
> Subject: RE: German Law and OCSP
> 
> 
> > It seems that there are a lot of confusions regarding some terms 
> > in the German Law.  
> Agreed ;)
> 
> [snip]
> 
> > I think the confusion springs from legal terms. In the above 
> > mentioned example the technical term of *valid* for a certificate 
> > would be the moment of the signing with the signing key. 
> Technically a certificate is valid from the date and time 
> contained in the
> ASN.1 element "notBefore" in the "Validity" sequence of the 
> X.509 structure.
> This may or may not be the time of signing by the CA.  
> Indeed, it may be
> delayed with respect to time of signing to cope with the scenario you
> describe in your later mail.  This is the same as the process 
> known as "Thro
> dating" used by credit card companies to protect against the risks you
> mention.
> 
> > The legal term assumes the publishing of the certificate.
> >
> > Another misunderstanding seems to be the role of the CRL in 
> German Law. 
> > Antonio Lioy wrote (28.01.2000) "... the only legally binding way
> > to prove that a cert was not valid at a certain date is to provide
> > a CRL (or a CSL!!!) that includes it." The German Law requires
> > only the *checkability* of the status of a certificate for anybody 
> > to any time (§4 SigG). 
> This is §5(1) in my (English) copy dated 1 August 1997.  Is 
> there a later
> version?  More importantly, it was explained to me that the 
> German model
> needed to know if a certificate was valid at the time that 
> the corresponding
> signature key was originally used and not at the time the request for
> validation is performed.  This is because one might be 
> checking a legal
> document that is tens of years old.  Is that what you mean by 
> "to any time"?
> 
> > The interoperability schemes (SigI A5) propose OCSP. 
> As I understand it, OCSP is designed to tell you status now 
> not status at
> some previous date.  If so, is this another issue with German 
> Law and OCSP?
> 
> > The status *suspension* isn't allowed according to the German Law, 
> > in comparison with Italian law which requires a CRL (Art. 29 par. 3)
> > and the possibility of suspension (Art. 33).
> Do you have a reasonable English translation of the Italian 
> law - or a link
> to a translation?
>

---

From: Ingmar Camphausen <[email-masked]>
Date: Fri, 25 Feb 2000 02:56:46 +0100

Ambarish,

> P.S. I, too, would appreciate pointers to English versions of both the
> German and Italian Digital Signature laws.
[...]
> >> Another misunderstanding seems to be the role of the CRL in German Law.
[...]
> > This is _5(1) in my (English) copy dated 1 August 1997.  Is there a
> > later version?
[...]
> > Do you have a reasonable English translation of the Italian law - or a
> > link to a translation?

The German wording of the Signaturgesetz ("German Digital Signature Act"
-- SigG) as passed by the German Bundestag (Parliament) on 13 June 1997
is online in HTML and PDF format at

	http://www.iid.de/rahmen/iukdgbt.html#a3

The English version (or translation?) of the German SigG, dated
"August 1 1997", is at

	http://www.iid.de/rahmen/iukdgebt.html#a3

As this is part of the online presence "Initiative Information Society
Germany" by the German Federal Government (Federal Ministry for Education
and Research), the German version of the SigG at the URL above should be
the exact wording of the Act.

The Act has not been changed or amended since it became effective.
(It is under review now, as Stefan Kelm mentioned earlier, and will be
modified and/or amended in some points to reflect the changes required
by the European Directive on electronic signatures "Council of 13 December
1999 on a Community framework for electronic signatures" -- online at
http://europa.eu.int/eur-lex/en/dat/2000/l_013/l_01320000119en00120020.pdf)

At http://www.iid.de/iukdg/sigve.html you can find an English version of
the German "Signaturverordnung" (Digital Signature Ordinance, SigV) that
concretizes some of the technical details intentionally omitted from the
SigG itself in order to make the SigG more "generic".

These -- and other -- documents related to digital signature legislation
in Germany and on the European level are also available from our project
FTP server at

	ftp://ftp.pca.dfn.de/pub/pca/docs/SigG/
	ftp://ftp.pca.dfn.de/pub/pca/docs/SigG/Europe/

		.	.	.

Regarding an English version of the _Italian_ Digital Signature
legislation, I can only point you to the section covering Italy in
Simone van der Hof's "Digital Signature Law Survey", online at

	http://cwis.kub.nl/~frw/people/hof/DS-lawsu.htm

It provides a nice (English) overview of how the Italian Digital
Signature legislation took place, as well as links to two English
texts about its unfolding.

Please note that some of the hyperlinks in that section have slightly
changed! The "Presidential Decree No. 513 of 10 November 1997" can be
found at

	http://www.aipa.it/english[4/law[3/law5997.asp

now, and the "Regulations establishing criteria and means for implementing
Section 15(2) of Law No. 59 of 15 March 1997 concerning the creation,
storage and transmission of documents by means of computer-based or
telematic systems" have moved to

	http://www.aipa.it/english[4/law[3/pdecree51397.asp

Hope this helps,

    Ingmar

--
Ingmar Camphausen    PGP key: 'finger [email-masked]' or via keyserver
DFN-PCA (Policy CA, German Research Network)                [email-masked]
Vogt-Koelln-Str. 30                                    http://www.pca.dfn.de/
D-22527 Hamburg, Germany                       +49.40.42883-2262 / Fax: -2241