Subject: 3280bis issue: allow path/CRL validation relative to a time in the past

From: "Wen-Cheng Wang" <[email-masked]>
Date: Wed, 17 Nov 2004 18:36:48 +0800

The current certification path validation algorithm and CRL
validation algorithm defined in RFC 3280 assume the validation
is relative to the current time. However, this does not align with
RFC 3379 and SCVP. In RFC 3379 and SCVP, the validation
can be relative to the current time and a time in the past. In
practice, a RP often need to validate a certification path relative
to a time in the past.
For example, when a RP receieves a digital signature, the
signing time must be a time in the past. In such situation,
the RP need to make sure the signer's certificate is valid
at the time the signature was signed.

I proposed to to change the input item "(b) the current date/time"
of section 6.1.1 into "(b) the validation time T, where T may be the
current time or a time in the past", and then replace all references
of "the current time" in the path and CRL validation algorithm with
"the validation time T".

With this simple modification, RFC 3280 can be a solid base of
 RFC 3379 and SCVP.

Wen-Cheng Wang