Subject: Re: Post-facto queries [Was: RE: DPD & DPV requirements]

From: Russ Housley <[email-masked]>
Date: Tue, 23 Jan 2001 13:57:58 -0500

Denis:

Let me try again.

What evidence are you referring to?  I assume that the relying party 
validated the path (using current-time DPV, OCSP, or CRLs).  Then, later, a 
dispute arises.  A third party (arbitrator, judge, lawyer doing discover, 
etc) uses retrospective DPV to confirm that the replying party did the 
processing correctly.  Here, I a trusting the DPV server to be able to 
reconstruct the response that would have been given at the date and time 
specified in the query.

What does time stamping have to do with it?  (That could become a catchy 
song title. :-) )

Russ

At 04:48 PM 1/23/2001 +0100, Denis Pinkas wrote:
>[Denis]
>
>The additional problem to be considered is that the structure of the answer
>in case (a) would be different from the answer in the case of a current-time
>checking, since one structure would include individual time stamps while the
>other would not.
>
>[Russ]
>
>Why does the DPV need a 3rd party time stamp on the CRLs?  It can keep
>track using its own clock as long as it has a trusted time source.  The
>STIME working group is going to provide a straightforward mechanism for
>that...
>
>[Denis * new answer]
>
>If you use the evidence, it is because you do not trust the "valid" answer
>form the server (otherwise, you would not need the evidence). Hence you
>would not trust either the clock from the server.

---

From: Denis Pinkas <[email-masked]>
Date: Wed, 24 Jan 2001 10:33:33 +0100

Russ,

> Let me try again.

OK.
 
> validated the path (using current-time DPV, OCSP, or CRLs).  

No. The evidence is : a certification path + associated revocation status
information (i.e. CRLs and/or OCSP responses)

It does not include "current-time DPV". Note that the evidence could be
gathered
by using LDAP and OCSP, if the client were PKI-aware. 

The global answer from the DPV server is: the signed "current-time DPV" +
the evidence indicated just above.

The evidence is only returned if requested by the client. Most of the time
the client will be pleased with the signed "valid" DPV answer. In case of a
later dispute about that answer, then the client will have to show the
evidence which supports the signed assertion made by the server.  We should
bear in mind that the DPV client may trust the signed answer from the DPV
server, but the other disputing party may not, hence why the "evidence"
is needed.

> Then, later, a
> processing correctly.  

This would work well only when the two following conditions are met:

1) no CRL signing key nor issuing key is compromised,
2) all certificates still valid.

In other words, this would not work when these two conditions are not met,
which is *always* the case a few years after the validation. 

> Here, I a trusting the DPV server to be able to

When you say "I trust", the question is : who is "I" ? Surely the client 
can trust this, but not the disputing party. The disputing party will not
necessarilly trust the DPV server, but only the current PKI TTPs: CAs, CRL
issuers, OCSP responders and some TSAs.

> reconstruct the response that would have been given at the date and time

This only works if the two above conditions are met.
 
> What does time stamping have to do with it?  (That could become a catchy

The reasons are in the TSP document. They have been shortly explained once
again, less than 24 hours, in the e-mail exchange between Tom Guidin and
Carlin Covey.

Denis