Subject: RE: OCSP request

From: Simon Tardell <[email-masked]>
Date: Thu, 27 Jul 2000 13:06:33 +0200

Denis,

> Bob picked up the same sentence in one of your E-mails and replied.
> I would like to comment on the same sentence.
> 
> (text deleted) 
> 
> > Now, if a key gets compromised, you cannot trust *any* signatures by
that
> > key (before or after compromise), because you cannot trust the signer's
> > assertion of what time it was. 
> 
> This is untrue. See the paper I co-wrote with Hans Nilson about the
> rational for using a time stamp. If the key of the TSA is not
> compromised, then you can prove that a given digital signature was
> done after the key compromise.

Eh? This was a rational FOR time stamping (as is evident by the next two
sentences).
 
> > A practical system has to protect itself from
> > that somehow. Enters time stamping. A time stamping service would
probably
> > check the revocation status of the signatory cert and store  that
together
> > with the time stamp.
> 
> This is certainly not the definition of a time stamping service
> within the PKIX WG. The TSA does NOT "check the revocation status of
> the signatory cert and store that together with the time stamp".

draft-ietf-pkix-time-stamp-09.txt:
  extensions is a generic way to add additional information in the 
  future. Extensions is defined in [RFC 2459].
  Particular extension field types may be specified in standards or 
  may be defined and registered by any organization or community. 

Seems like a definite "MAY" to me. 
 
Simon.

Simon Tardell, Software Architect, iD2 Technologies
voice +46 8 7755225, fax +46 8 7267912, cell +46 70 3198319
[email-masked], http://www.iD2tech.com
Securing the Internet economy

---

From: Denis Pinkas <[email-masked]>
Date: Thu, 27 Jul 2000 15:24:21 +0200

Simon,

(deleted text)
 
> Eh? This was a rational FOR time stamping (as is evident by the next two

I did not see it this way. This is a rational for an *extension* to
the current *basic* definition of a Time Stamping Service.

>> probably check the revocation status of the signatory cert and store
>> that together with the time stamp.

> Seems like a definite "MAY" to me.

You may *add* anything else you like. Since we were talking of basic
features and optional features about OCSP it is important not to mix
basic features and options.

Denis