Subject: Progression of RFC 3161 (TSP) to Draft Standard

From: Denis Pinkas <[email-masked]>
Date: Wed, 02 Jan 2002 12:56:12 +0100

As advertised at the last IETF meeting in Salt Lake City, from information
received on the mail list and directly, there exists at least seven
experimental implementations of RFC 3161 (i.e. the Time-Stamp Protocol- TSP)
available for individual testing:

- four from Italy,
- one from New-Zealand,
- one from France,
- one from Austria.

The goal is to be able to perform interoperability testing among at least
two of these implementations, so that we can report on these tests at the
next IETF meeting in Minneapolis. This is a necessary step to be able to
progress RFC 3161 from Proposed Standard to Draft Standard.

[From section 6.2 of RFC 2026]

   A specification shall remain at the Proposed Standard level for at
   least six (6) months.

[From section 4.1.2 of RFC 2026]

   A specification from which at least two independent and interoperable
   implementations from different code bases have been developed, and
   for which sufficient successful operational experience has been
   obtained, may be elevated to the "Draft Standard" level.  For the
   purposes of this section, "interoperable" means to be functionally
   equivalent or interchangeable components of the system or process in
   which they are used.(…).

   The requirement for at least two independent and interoperable
   implementations applies to all of the options and features of the
   specification.  In cases in which one or more options or features
   have not been demonstrated in at least two interoperable
   implementations, the specification may advance to the Draft Standard
   level only if those options or features are removed.

Hereafter is information about the implementations I have been made 
aware of. If more exist, please let us know.

                    ________________________

C&A experimental TSA service (http://www.com-and.com)
Date: Fri, 24 Aug 2001
From: tho <[email-masked]> or <[email-masked]>

If anyone would like another TSA to test here you can find ours:
http://195.223.2.6:8080

It is a freebsd box with an apache module that acts as a front-end and
translator to a socket based protocol backend. The backend is still directly
reached at address 195.223.2.6 port 3318.

Available interfaces are:
http at url: http://195.223.2.6:8080/timestamp 
you have to POST a time stamp request wrapped into an
application/timestamp-query MIME object.
tcp  at 195.223.2.6, port 3318 

                    ________________________

Cryptographic Appliances (Peter Gutman)
Date: Tue, 21 Aug 2001 
From: [email-masked] (Peter Gutmann)

There's a new TSA available at tsa.cryptoapps.com:3318, running in a FIPS
140-1 level 4 device (it's just a demo which runs single-threaded, so if you
throw a huge number of concurrent requests at it you may get some refused
connections, although I doubt it'll be a big issue for now).
Date: Tue, 28 Aug 2001

I've now updated the TSA to conform to the latest draft (except for the TSA
cert, because I'm using a shared generic cert which gets recycled for SSL,
OCSP, CMP, and everything else).  

                    ________________________

SIA (Società Interbancaria per l'Automazione Cedborsa S.p.A)
Date: Thu, 8 Nov 2001

From: Taglialagamba Bianca <[email-masked]>

We have developed a Time Stamping Authority according with the RFC 3161.
If you would like to do some interoperability tests with it, the IP address
is 193.203.230.166 and the port is 318 (using socket based protocol). The
service can be available from 9.00 a.m. to 6.00 p.m.

                    ________________________

Computer and Network Security Group (CNSG)
from Politecnico di Torino
Date: Mon, 03 Dec 2001

From: Cristian Marinescu <[email-masked]>

Please take a look to http://security.polito.it/test/tsp/

Address: tsp.test.polito.it  port:318.  Pure TCP. 
Testing purposes only.

Contact : [email-masked]

                    ________________________

EdelWeb Experimental 
Time Stamping Service
Date: Mon, 03 Dec 2001

From: Peter Sylvester <[email-masked]>

See the descriptions in:  http://www.edelweb.fr/tsa.html

This service uses a standard HTTP protocol to communicate.

                    ________________________

Innovery True Time
Date: Thu, 06 Dec 2001 
From: Andrea Caccia <[email-masked]>
on, 17 Dec 2001 23:36:18 +0100
Product name: Innovery True Time. Version: 1.1

Company name & address:
Innovery srl
Via Faravelli 8
20149 Milano - Italy

Contact person: Andrea Caccia <[email-masked]>

                    ________________________

Graz University of Technology (IAIK -Austria)
Contact person: [email-masked]

                    ________________________

I encourage "contact persons" to contact themselves. :-)

Denis. 
TSP lead editor.

---

From: Denis Pinkas <[email-masked]>
Date: Wed, 02 Jan 2002 17:13:52 +0100

Todd,

This is not a question to mee. So I let other people respond.

Thank you for your interest in TSP.

Regards,

Denis

> Denis - do you have any commercial users of the protocol or are the
> implementers Academic, and if they are academic what are they using the TSP
> for.
> 
> Todd Glassey
> 
> ----- Original Message -----
> From: "Denis Pinkas" <[email-masked]>
> To: <[email-masked]>; <[email-masked]>;
> <[email-masked]>; <[email-masked]>;
> <[email-masked]>; <[email-masked]>;
> <[email-masked]>; <[email-masked]>
> Cc: "pkix" <[email-masked]>
> Sent: Wednesday, January 02, 2002 3:56 AM
> Subject: Progression of RFC 3161 (TSP) to Draft Standard
> 
>    which they are used.(.).

---

From: "todd glassey" <[email-masked]>
Date: Wed, 2 Jan 2002 08:03:59 -0800

Todd Glassey

----- Original Message -----
From: "Denis Pinkas" <[email-masked]>
To: <[email-masked]>; <[email-masked]>;

- four from Italy,
- one from New-Zealand,
- one from France,
- one from Austria.

                    ________________________

                    ________________________

                    ________________________

                    ________________________

                    ________________________

EdelWeb Experimental
Time Stamping Service
Date: Mon, 03 Dec 2001

                    ________________________

Innovery True Time
Date: Thu, 06 Dec 2001

Company name & address:
Innovery srl
Via Faravelli 8
20149 Milano - Italy

                    ________________________

                    ________________________

Denis.
TSP lead editor.

---

From: "todd glassey" <[email-masked]>
Date: Wed, 2 Jan 2002 08:42:57 -0800

Denis, I am sorry you are not tracking what the people who are implementing
your protocol are doing with it. Personally  if I were pushing my
baby-protocol towards Standardization, I would know every use of it while
its on its way to becoming a standard.

I have no opposition to this protocol becoming a standard as long as it does
not likewise rule out NTP's use as a time stamping protocol since NTP has
had a standards number reserved for it from a time from before when the
original TSP I-D was published, oh and NTP  has at least twenty thousand
commercial implementers.

Also - I don't count Academic systems as commercially viable until they
migrate their warez into the private sector as there is no real financial
commitment to what a grad-student does by the university. This is an
important key to realizing anything in the commercial world, especially in
the defining of a security model in which there is a need for a TTP based
TSP as an evidentiary model and getting it approved for roll out. This last
thing is the real "ticker of value" for any core protocols that are to
compete with ANXI X.9.ANSI efforts.

Todd

----- Original Message -----
From: "Denis Pinkas" <[email-masked]>
To: "todd glassey" <[email-masked]>
Cc: <[email-masked]>; <[email-masked]>;
<[email-masked]>; <[email-masked]>;
<[email-masked]>; <[email-masked]>;
<[email-masked]>; <[email-masked]>; "pkix" <[email-masked]>
Sent: Wednesday, January 02, 2002 8:13 AM
Subject: Re: Progression of RFC 3161 (TSP) to Draft Standard

Todd,

Regards,

Denis

---

From: Stephen Kent <[email-masked]>
Date: Wed, 2 Jan 2002 12:45:07 -0500

Todd,

The IETF requirement for multiple interoperable implementations of a 
protocol, as a prerequisite for progression, does not differentiate 
between product vs. academic implementations.

NTP is an IETF standard for distribution of time information, but is 
not a time stamping protocol in the sense of TSP, so it is not a 
"competitor" for TSP.

The value of the NTP protocol number is irrelevant to this discussion.

Steve

---

From: Antonio Lioy <[email-masked]>
Date: Fri, 04 Jan 2002 21:45:53 +0100

> progress RFC 3161 from Proposed Standard to Draft Standard.

Here at the Politecnico di Torino we have been testing our
implementation against the following ones:
- SIA
- C&A
- IAIK
- Peter Guttman

We have not been able to test against the Edelweb TSA as it is HTTP
based and not socket based. We are in the process of writing a report
about these tests. Is there any standard IETF format to officially
report these results to progress an RFC to Draft Standard?

> Contact : [email-masked]

Some more information about this implementation:
- it consists of a server, a client and a library that implements a TS
  API
- everything is available for Win32 and Unix (tried under Solaris and
  Linux)
- current version is pure socket based
- HTTP and SMTP versions are in progress
- the code is based on the cryptographic part of OpenSSL, with some
  modifications
- the contact address [email-masked] is not yet active (it
  will be in a week or so); for the moment, please address everything
  related to our TSA to {lioy,[email-masked]

In reply to Todd Glassey's request for info about application field: our
TSA code is being tested for application in e-government environments
(by some Italian municipalities as well as by partners of the EuroPKI
and
NASTEC projects), although other applications are surely possible.

Cheers,

Antonio Lioy
Gianluca Ramunno
Cristian Marinescu