Subject: OCSP request

From: "Karl Scheibelhofer" <[email-masked]>
Date: Tue, 25 Jul 2000 15:03:01 +0200

to verify a signature, it is necessary to find out, if the certificate used
for signing was valid when the signature was created. normally it is only
possible to fix the time the signature was created in a time interval; e.g.
between two timestamps.
to find out, if the certificate was valid during this time interval, i see
two options:

1. i can get the certificate status information when i create the signature,
timestamp it, and attach the whole thing to the signed document.

2. have a extended OCSP protocol that allows to request this information

are there any attempts to integrate such a feature to OCSP?
i think that this would be a valuable feature for OCSP. it would avoid the
necessity to attach all this verification stuff to all signed documents.

with best regards,

  Karl Scheibelhofer

--

Karl Scheibelhofer, <mailto:[email-masked]>
Institute for Applied Information Processing and Communications (IAIK)
at Technical University of Graz, Austria, http://www.iaik.at
Phone: (+43) (316) 873-5540

---

From: Juergen Brauckmann <[email-masked]>
Date: Tue, 25 Jul 2000 15:22:51 +0200

>2. have a extended OCSP protocol that allows to request this information

Why isn't it sufficient to get a fresh OCSP response? The OCSP response
itself contains either a revocation date or "good". The first you can
compare against your time interval, and in the latter case you have the
validity period of the certificate... .

Juergen  
-- 
Juergen Brauckmann             Tel.:  +49 (0)40 / 80 80 26-3 11
TC TrustCenter GmbH            Fax.:  +49 (0)40 / 80 80 26-1 26
Sonninstraße 24-28   	    mailto:[email-masked]
D-20097 Hamburg 		    http://www.trustcenter.de

---

From: Richard Levitte <[email-masked]>
Date: Tue, 25 Jul 2000 15:43:12 +0200

> validity period of the certificate... .

If I understand everything correctly, Karl is after verifying the signature of a

document that was signed, say, 3 months ago.  2 months ago, the certificate
got compromised and is therefore not "good" anymore, but it may still be
interesting to check if the certificate was valid at the time of signature, and
from what I understand item 2 above, Karl would like to see the possibility
to do that kind of check with OCSP.

Karl, have I understood you correctly?

--
Richard Levitte                 !!! New cell phone number !!!
[email-masked]

/* You might enjoy viewing the complete vCard */

---

From: Juergen Brauckmann <[email-masked]>
Date: Tue, 25 Jul 2000 15:50:17 +0200

At 15:43 25.07.00 +0200, Richard Levitte wrote:
>interesting to check if the certificate was valid at the time of signature, 

And this is possible with plain OCSP because the OCSP response contains the
state "revoked" and the date of the revocation, which would hopefully be
*after* the assumed signature generation date.

Juergen

---

From: Rich Salz <[email-masked]>
Date: Tue, 25 Jul 2000 09:58:23 -0400

What about the OCSP "archive cutoff" extension?

A signer who wishes proof of validity could generate an OCSP query on
himself, using a NONCE which is the "real" signature. The signed OCSP
reply could then "be" the signature, right?

---

From: Joerg Seidel <[email-masked]>
Date: Tue, 25 Jul 2000 16:05:30 +0200

> *after* the assumed signature generation date.

The problem is that OCSP does not tell you whether the certificate was already
issued at the time of the signature. It only says it was not revoked. OCSP can
therefore not answer "historical questions". You need to keep a timestamped
certificate yourself besides the signature. Or as Karl puts it you need "to
attach all this verification stuff to all signed documents."

Joerg
-- 
__________________________________________________________________

Jörg Seidel                             phone  +49-40-76629-1911
Director Technology                     fax    +49-40-76629-551
timeproof GmbH                          
Harburger Schloßstraße 6-12             mailto:[email-masked]
DE 21079 Hamburg                        http://www.timeproof.de
__________________________________________________________________

---

From: Rich Salz <[email-masked]>
Date: Tue, 25 Jul 2000 10:12:53 -0400

> issued at the time of the signature. It only says it was not revoked.

Depends on the OCSP implementation.  Some (e.g., Valicert last I looked)
can only say "not revoked" while some (e.g., CertCo last I looked) can
also say "not known"
	/r$

---

From: Oscar Jacobsson <[email-masked]>
Date: Tue, 25 Jul 2000 16:19:39 +0200

Joerg Seidel wrote:
> Or as Karl puts it you need "to

Which is the method ETSI have selected for their ES-C (Electronic
Signature with Complete validation data) electronic signature format,
IIRC.

//oscar

---

From: Juergen Brauckmann <[email-masked]>
Date: Tue, 25 Jul 2000 17:02:35 +0200

>can only say "not revoked" while some (e.g., CertCo last I looked) can

BTW: We think that theres is a real need for OCSP responders to be able to
say "Yes, I know this cert" instead of the normal OCSP "good=not revoked".
It is necessary to extend OCSP so real positive answers can be expressed in
the OCSP response. The extension of the protocol must be made in such a way
that existing clients can still understand "new" OCSP responses, so
changing or extending the CertStatus field is probably not really a good
thing.

It would work as follows:
Let's first define a OCSP Extension certHash, which contains the hash of
the certificate as an OCTET STRING.
This extension may be present (flagged non critical) in OCSP Responses, but
SHOULD NOT be present in OCSP requests.

Now if an OCSP responder can present the certHash in it's response as part
of the singleExtensions, a client can be sure that the OCSP Responder knows
what it's talking about, because it can check the hash from the server
against the certificate. The hash is a real proof, not just a vague assurance.

OCSP Responder can include the certHash extension in all responses, because
OCSP clients must be able to handle arbitrary extensions anyway. Clients
which don't understand certHash can ignore it without any risk.

The idea was developed with people from some other German CAs, it is
planned to make something like an internet draft from it. What do you think?

Juergen

---

From: Richard Levitte <[email-masked]>
Date: Tue, 25 Jul 2000 17:25:56 +0200

Rich Salz wrote:

> can only say "not revoked"

In that case, they've corrected themselves.  I just made a request with a cert they
have no chance of knowing, and I got the status "unknown".

---

From: Rich Salz <[email-masked]>
Date: Tue, 25 Jul 2000 12:02:42 -0400

> I just made a request with a cert they

Make a request for a mythical cert with a CA that they know about --
i.e., take a CertID where you got a "good" answer, and change only the
serialNumber to something likely to be unissued (e.g., 99999999992).

As the discussion here (yet again :) shows, full understanding of the
OCSP standard is tricky, and requires subtlety that is probably beyond
most potential PKI customers.
	/r$

---

From: Denis Pinkas <[email-masked]>
Date: Wed, 26 Jul 2000 08:57:02 +0200

Oscar,

> Signature with Complete validation data) electronic signature format,

To reply to your question, ETSI (in ES 201733) has chosen to keep
the *references* (including a hash code of the referenced data)
together with the electronic signature, i.e. not the actual data.
The idea was to make the verification stuff kept with the signature
short.

The referenced data can be stored:

1) either with the signed message, or
2) anywhere else (e.g. in a data base), where you can find it again.

Denis