Subject: Time-stamping.

From: "Prashant Dambe" <[email-masked]>
Date: Tue, 20 Mar 2001 16:53:15 +0530

Time-stamping of the dataum does not bind the time-stamped data to paticular user.
So where it will be used as it does not bind creator identity. Any one can 
claim that  I am the author of the document. Until there is specifically identification
of the creator inside the document itself.
One way to do this is to to sign over dataum plus time-stamped -data.
In this case user can replace the signature put its own signature.
So Is not that time-stampng of signature value is necessary.
And if the time-stamped signature value is placed as unsigned attribute,
it can be also replaced and it is undetectable in current specification.
So in the current draft IS time-stamp generated fully secured?

Prashant Dambe

---

From: Jean-Marc Desperrier <[email-masked]>
Date: Tue, 20 Mar 2001 13:22:30 +0100

Prashant Dambe wrote:

> Time-stamping of the dataum does not bind the time-stamped data to
> paticular user.So where it will be used as it does not bind creator
> identity. Any one canclaim that  I am the author of the document.
> Until there is specifically identificationof the creator inside the
> document itself.

So you need to include identification of the creator inside the document
you wish to time-stamp.

This part is plain evidence.
 > One way to do this is to to sign over dataum plus time-stamped
-data.> In this case user can replace the signature put its own
signature.> So Is not that time-stampng of signature value is
necessary.> And if the time-stamped signature value is placed as
unsigned attribute,> it can be also replaced and it is undetectable in
current specification.> So in the current draft IS time-stamp generated
fully secured?

Yes, if properly used.
But some clarification about how to use it properly might be needed.

As I discuss in my other message, you need, in most cases, to insert
inside the text that you wish to time-stamp, a reference to the time at
which you claim that the statement is true, before signing and then
time-stamping it.
No one should accept as valid a message without such a statement.
This reference does not need to be time-stamped, this is what you author
of the document, claim, and when you claim it.

In SMIME, this will be required by the standard.
There's the same requirement in "Technical Requirements for a
non-Repudiation Service".

---

From: "Gary Visser" <[email-masked]>
Date: Tue, 20 Mar 2001 11:28:40 -0800

> Time-stamping of the dataum does not bind the time-stamped data to
paticular user.
> So where it will be used as it does not bind creator identity.
Correct, but the timestamp is bound to a particular entity. This entity is
providing a service similar to a public notary, someone who can attest to
the fact that the datum existed prior to a specific point in time.

> Any one can claim that  I am the author of the document.
Sure they can make the claim, but can they prove it? If you time-stamped the
document, you are claiming to have 'seen' a digest of the document, not that
you are its author. As an entity that timestamps documents I will go into a
court of law and attest to the fact that an agent of mine saw a digest of a
document at a particular point in time, provided of course that I have
determined that my agent has not been compromised. I will not make any
claims regarding the content or author of the document.

> Until there is specifically identification of the creator inside the
document itself.
> So in the current draft IS time-stamp generated fully secured?
I do not believe that the draft says you can not include the timestamp as a
signed attribute.
So you are free to do this in your systems. Others may also choose to do
this.
But the timestamp is a separate entity from the datum and need not be a
signed attribute.
An alternative that provides basically the same level of trust, is to
require that the timestamp be available from the author or timestamp
authority separate from the datum.
If the draft required that the timestamp be a signed attribute, then you
would not, for example, be able to append timestamps to messages within the
mail server as they are being delivered.

Keep in mind that these standards are not enough to build a 'fully secured'
system. You must apply and adhere to a security policy to make the system as
'fully' secured as needed. I believe that the authors of these standards go
to great lengths to ensure that no particular security policy is mandated by
the standard. Thereby allowing you to build a system that meets your
requirements.

Gary Visser
Timestamp.com

-----Original Message-----
From: Prashant Dambe [mailto:[email-masked]]
Sent: Tuesday, March 20, 2001 3:23 AM
To: [email-masked]
Subject: Time-stamping.

Time-stamping of the dataum does not bind the time-stamped data to paticular
user.
claim that  I am the author of the document. Until there is specifically
identification

Prashant Dambe