Subject: Re: Post-facto queries [Was: RE: DPD & DPV requirements]

From: "Tom Gindin" <[email-masked]>
Date: Tue, 23 Jan 2001 12:55:37 -0500

Denis:

     Is your primary objection to post-facto queries that they pose a
temptation to NR relying parties to avoid archiving contemporary
verification information?  If we look at the actual verifications performed
in NR, I think that you and I are in agreement that to have the RP keep the
(signed) revocation data supporting his initial determination is more
robust than to have the RP rely on the subsequent verifier acquiring the
revocation data through a post-facto query.  IMO this is not a reason why
post-facto queries would be useless in all cases, however - an auditor
attempting to find whether a strong login had occurred before a revocation
or after it (in a case where CRL publication is typically delayed) would
find them useful.
     These queries have their place when there is no better alternative,
but I think NR RP's are better off not relying on them.  If such an RP (or
the escrow holder for 2-way NR in my draft) maintains contemporary
revocation information, it cannot be affected by the CA ceasing operations
or failing to maintain archives.

          Tom Gindin

Denis Pinkas <[email-masked]> on 01/23/2001 12:04:14 PM

To:   Russ Housley <[email-masked]>
cc:   PKIX-List <[email-masked]>
Subject:  Re: Post-facto queries [Was: RE: DPD & DPV requirements]

Russ,

Your statement is too short so that I can understand what you do not
understand. :-)

Could you elaborate a little bit more, or maybe some one else could explain
better than I can.

Denis

> Denis:
>
> I do not understand your point.
>
> Russ
>
> At 04:48 PM 1/23/2001 +0100, Denis Pinkas wrote:
> >[Denis]
> >
> >The additional problem to be considered is that the structure of the
answer
> >in case (a) would be different from the answer in the case of a
current-time
> >checking, since one structure would include individual time stamps while
the
> >other would not.
> >
> >[Russ]
> >
> >Why does the DPV need a 3rd party time stamp on the CRLs?  It can keep
> >track using its own clock as long as it has a trusted time source.  The
> >STIME working group is going to provide a straightforward mechanism for
> >that...
> >
> >[Denis * new answer]
> >
> >If you use the evidence, it is because you do not trust the "valid"
answer
> >from the server (otherwise, you would not need the evidence). Hence you
> >would not trust either the clock from the server.

---

From: "Yuriy Dzambasow" <[email-masked]>
Date: Wed, 31 Jan 2001 09:37:35 -0500

I think Tom captures the essence of why post-facto queries are needed.  I
don't think we can assume that every RP will maintain its own information to
support non-repudiation disputes in the future.  RPs should have a
capability to rely on a service to do this for them, especially smaller
institutions that do not want to go through the effort to implement such a
capability within their organization.

In addition, I think it is helpful to have a capability to perform
post-facto queries when for some reason the DPV service is originally
unavailable.  For example, I am a contractor submitting a proposal to the
Federal Government, and the proposal needs to be in by noon on Friday.  I
complete my proposal, sign and timestamp it, and submit it at 11:55A.  The
Federal Agency receives my proposal, but for some reason their DPV service
is down for a few hours; therefore, the agency cannot validate my signature
on the proposal at that time.  When it comes back up, the agency will want
to know if my signature was valid when the proposal was submitted (at
11:55A), and not when the service comes back up.

Yuriy

-----Original Message-----
From: Tom Gindin [mailto:[email-masked]]
Sent: Tuesday, January 23, 2001 12:56 PM
To: Denis Pinkas
Cc: Russ Housley; PKIX-List
Subject: Re: Post-facto queries [Was: RE: DPD & DPV requirements]

     Denis:

          Tom Gindin

Russ,

Denis

answer
current-time
the
answer

---

From: Denis Pinkas <[email-masked]>
Date: Wed, 31 Jan 2001 15:59:31 +0100

Yuriy,

> support non-repudiation disputes in the future.  

If you are interrested to support non-repudiation, then you had better to
save the proof. You can save it on a server if you wish. But that server is
only providing a safe storage.

> RPs should have a

At the time you first receive a signature you had better to make sure that
it is a valid one. So at the time you make the first verification, either
yourself or using a remote server (like DPV), it is easy to grasp the proof
and save it either locally or remotely. There is thus no need for
post-validation. 

> unavailable.  

Making a query an hour later is fairly different from making the query 10
years later.

> For example, I am a contractor submitting a proposal to the
> on the proposal at that time.  

There is no need to do what you describe. An acknowledge of receipt may be
sent to the sender without the need to validate the signature, if any. Note
also that the sender may be different from the sender.

> When it comes back up, the agency will want

If the service was down for only a few hours, this can easily be be done.
Doing it, 10 years later is a different story.

Denis