Subject: Question - certificate status in past

From: "Pinkava Jaroslav" <[email-masked]>
Date: Wed, 1 Sep 2004 11:19:00 +0200

I couldn´t find answer to the following question. For CA services would be useful service

giving answer to simple question.:

There is given a certificate, and moment of time (in the past). I want know status of certificate

exactly in this time moment.

I have no implemented OCSP nor DVCS, but I want follow pkix recomendation.

What is the simplest way?

Thank You in Advance.

                      Jaroslav

 

 

 

Ing. Jaroslav Pinkava, CSc., 

Security Consultant

telefon: +420 541 558 281

mobil:  +420 604 222 854

fax:    +420 541 558 303

e-mail: [email-masked]

http://crypto-world.info/ 

PVT  a.s., 

Veveří 102 

602 00, Brno

www.pvt.cz <file:///\\www.pvt.cz\>

---

From: "Miguel Rodriguez" <[email-masked]>
Date: Wed, 1 Sep 2004 10:16:18 -0500

Hi Jaroslav, 
 
I think that the best you can do within PKIX is to have a timestamp (RFC
3161) for your digital signature, preferably right after the signature
has been created. The the entity in charge of validating the signature
(some time in the future) will have to obtain revocation status for the
signer's certificate (using CRL, or OCSP). In case the certificate has
been revoked, the validating entity will have to check if the revocation
happened after the issuing of the timestamp (checking the revocation
date against the timestamp's date). Time stamp server are required to
have a trusted source of time to avoid disputes. However CAs or OCSP
responders are allowed to use local "not trusted" clocks. Your point
raises important issues, I hope we can discuss it here.
 
Regards,
 
Miguel A Rodriguez
SeguriData
Mexico

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Pinkava Jaroslav
Sent: Wednesday, September 01, 2004 4:19 AM
To: [email-masked]
Subject: Question - certificate status in past

I couldn´t find answer to the following question. For CA services would
be useful service

There is given a certificate, and moment of time (in the past). I want
know status of certificate

I have no implemented OCSP nor DVCS, but I want follow pkix
recomendation.

Thank You in Advance.

                      Jaroslav

 

 

 

Security Consultant

mobil:  +420 604 222 854

fax:    +420 541 558 303

PVT  a.s., 

Veveří 102 

602 00, Brno

---

From: "Liaquat Khan" <[email-masked]>
Date: Wed, 1 Sep 2004 17:54:32 +0100

One could go a little further, as in the case of our PDF Signer
application, we embed the timestamp (RFC3161) and the signer's
certificate status information (CRLs or OCSP) at the time the user signs
the PDF document (actually shortly after signing).   Therefore the
information required to validate the signature in the future is actually
held within the document, i.e. independent proof of time of signing and
independent proof of signer's certificate status at time of signing.   
 
Regards,
LK   

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Miguel Rodriguez
Sent: 01 September 2004 16:16
To: [email-masked]
Subject: RE: Question - certificate status in past

Hi Jaroslav, 

Regards,
 
Miguel A Rodriguez
SeguriData
Mexico

-----Original Message-----

Thank You in Advance.

                      Jaroslav

 

 

 

Security Consultant

mobil:  +420 604 222 854

fax:    +420 541 558 303

PVT  a.s., 

Veveří 102 

602 00, Brno

---

From: Jean-Marc Desperrier <[email-masked]>
Date: Wed, 01 Sep 2004 19:53:13 +0200

Liaquat Khan wrote:

> O ne could go a little further, as in the case of our PDF Signer 
> certificate status information (CRLs or OCSP) at the time the user 
> signs the PDF document (actually shortly after signing).   Therefore 
> the information required to validate the signature in the future is 
> actually held within the document, i.e. independent proof of time of 
> signing and independent proof of signer's certificate status at time 
> of signing.  
>
>     *From:* [email-masked]
>     [mailto:[email-masked]] *On Behalf Of *Miguel Rodriguez
>     *[....]*
>       
>     I think that the best you can do within PKIX is to have a
>     timestamp (RFC 3161) for your digital signature, preferably right
>     after the signature has been created. The the entity in charge of
>     validating the signature (some time in the future) will have to
>     obtain revocation status for the signer's certificate (using CRL,
>     or OCSP).
>
A normalized format to do that has been defined by EU in ETSI TS 101 
733, which content is also available in the informational RFC 3126.

---

From: "Liaquat Khan" <[email-masked]>
Date: Wed, 1 Sep 2004 21:06:56 +0100

Yes, exactly.

Regards,
LK

> On Behalf Of Jean-Marc Desperrier
> Sent: 01 September 2004 18:53
> To: [email-masked]
> Subject: Re: Question - certificate status in past
> 
> 
> Liaquat Khan wrote:
>