Subject: Re: Progression of RFC 3161 (TSP) to Draft Standard

From: Alfonso De Gregorio <[email-masked]>
Date: Wed, 2 Jan 2002 23:05:00 +0100

> I have no opposition to this protocol becoming a standard as long as it does
> not likewise rule out NTP's use as a time stamping protocol since NTP has
> had a standards number reserved for it from a time from before when the
> original TSP I-D was published, oh and NTP  has at least twenty thousand
> commercial implementers.

NTP is not a time stamping protocol in the sense of 3161.
 
> Also - I don't count Academic systems as commercially viable until they
> migrate their warez into the private sector as there is no real financial
> commitment to what a grad-student does by the university. This is an
> important key to realizing anything in the commercial world, especially in
> the defining of a security model in which there is a need for a TTP based
> TSP as an evidentiary model and getting it approved for roll out. This last

AFAIK, there are 3161 commercial users, at least in Italy.

Sincerely,
alfonso

---

From: "todd glassey" <[email-masked]>
Date: Wed, 2 Jan 2002 14:07:36 -0800

----- Original Message -----
From: "Alfonso De Gregorio" <[email-masked]>
To: "todd glassey" <[email-masked]>
Cc: "pkix" <[email-masked]>
Sent: Wednesday, January 02, 2002 2:05 PM
Subject: Re: Progression of RFC 3161 (TSP) to Draft Standard

> NTP is not a time stamping protocol in the sense of 3161.

yes it is - it is exactly the same  - The TST is easily encapsulated as an
optional payload in the NTP service model. The NTP protocol is then exactly
as capable of being used as a time stamp generator as the TSP. In fact the
NTP Solution from a trst standpoint is orders of magnitude better  than the
PKIX effort which is totally arbitrary in its operations. There is no more
commercial value in the PKIX TSP than looking at the micky mouse watch on
your wrist and declaring this package to have arrived at some time point.
The issue is that in a retrospective manner the only value the timestamp has
is evidentiary in nature. Otherwise if the TS was just used to trigger some
other digital event there would be no need to keep it. So no need for the
token itself.

That's the whole point - Time Stamping is supposed to be a method of
enstantiating some more credibility than what was there from the testimony
alone of the human representing the event. And it simply doesnt.

> AFAIK, there are 3161 commercial users, at least in Italy.

Who are they and what is the operations model - what type of services are
they using and providing and has an auditor ever looked at the system.

---

From: Stephen Kent <[email-masked]>
Date: Wed, 2 Jan 2002 18:58:36 -0500

Alfonso,

>other digital event there would be no need to keep it. So no need for the

You are right about the mismatch between the semantics for NTP vs. 
TSP; I noted the same thing a private exchange with Todd earlier 
today. TSP is a request/response protocol specifically designed to 
allow a client to request a time stamp for a hash value corresponding 
to some data of interest. NTP is a time distribution protocol that 
has security features designed to ensure authenticity and integrity 
for the time values it distributes, but it is not engineered to 
satisfy the sort of operation that TSP does.

Todd has in mind a model for time stamping that has not been accepted 
by this WG, and which also is not consistent with the models employed 
by other protocol  standards bodies (e.g., ETSI) working in the area. 
His comments have to be interpreted relative to that model. We have 
discussed this difference of opinion on this list many times in the 
past.  See the archives to Todd's description of his model.

Steve