Subject: New test TSA available

From: [email-masked] (Peter Gutmann)
Date: Tue, 21 Aug 2001 12:15:35 +1200 (NZST)

There's a new TSA available at tsa.cryptoapps.com:3318, running in a FIPS 140-1
level 4 device (it's just a demo which runs single-threaded, so if you throw
a huge number of concurrent requests at it you may get some refused 
connections, although I doubt it'll be a big issue for now).  There will also 
be an OCSP responder at ocsp.cryptoapps.com and a CMP server at 
cmp.cryptoapps.com in the near future running on the same hardware, at the
moment I think the ports are still blocked so you won't be able to get to them.

Peter.

---

From: tho <[email-masked]>
Date: Tue, 21 Aug 2001 12:12:26 +0200

hello peter,

i've tried a couple of requests to cryptoapps tsa and this is what i've
found: 

::content type::

 (A) draft-ietf-pkix-time-stamp-15 states that eContentType for a time
     stamping token should be id-ct-TSTInfo why is it instead set to
     id-data ?

 since the encapsulated content type is set to id-data, version
 field in SignedData is (`correctly' since (A)) set to 1 and not to 3

::signed attributes::

 draft-ietf-pkix-time-stamp-15 states that The certificate identifier
 (ESSCertID) of the TSA certificate MUST be included as a signerInfo
 attribute inside a SigningCertificate attribute, and here it is missing

 since (A) ContentType attribute in signedAttrs inside SignerInfo is set
 to id-data

::signature algorithm::

 signatureAlgorithm in SignerInfo is rsaEncryption, shouldn't it be more
 likely sha1withRSAEncryption ?

thank you, tho
--
(__)         
(oo)        
 \/-------\
  ||     | \  
  ||---W||  *