Subject: OCSP and historical data

From: Markus Bitterli <[email-masked]>
Date: Fri, 29 Jan 1999 10:44:21 +0100

I've read the OCSP draft and wonder whether it is possible to request
information about the validity for a certificate for a specific date and
time in the past. As I've understood it, this is not possible. If so,
has somebody any idea for a solution to that requirement.

Markus Bitterli

---

From: Denis Pinkas <[email-masked]>
Date: Fri, 29 Jan 1999 11:25:53 +0100

Markus,

Your analysis is correct. OCSP assumes the current date only.

> has somebody any idea for a solution to that requirement.

There are several ways. One solution is to gather the appropriate CRL or OCSP
responses close to the time of the signature.
If you want to rely on an external service, there have been discussions around
the DCS draft and the DVS concept: "Data Validation Service". This kind of
service is supposed to do some verification upon some data that is presented.
I recently send an E-mail on that topic. Please refer to it.

Denis

---

From: "Ambarish Malpani" <[email-masked]>
Date: Fri, 29 Jan 1999 11:10:24 -0800

Hi Denis, Markus,
    Yes, you can get historical data from an OCSP responder, as long
as the responder chooses to support archiving of data. Check section
5.4.4.

Regards,
Ambarish

5.4.4  Archive Cutoff

   An OCSP responder MAY choose to retain revocation information beyond
   a certificate's expiration. The date obtained by subtracting this
   retention interval value from the producedAt time in a response is
   defined as the certificate's "archive cutoff" date.

   OCSP-enabled applications would use an OCSP archive cutoff date to
   contribute to a proof that a digital signature was (or was not)
   reliable on the date it was produced even if the certificate needed
   to validate the signature has long since expired.

   OCSP servers that provide support for such historical reference
   SHOULD include an archive cutoff date extension in responses.  If
   included, this value SHALL be provided as an OCSP singleResponse
   extension identified by id-pkix-ocsp-archive-cutoff and of syntax
   GeneralizedTime:

   id-pkix-ocsp-archive-cutoff  OBJECT IDENTIFIER ::= { id-pkix-ocsp 6 }

   ArchiveCutoff ::= GeneralizedTime

   To illustrate, if a server is operated with a 7-year retention
   interval policy and status was produced at time t1 then the value for
   ArchiveCutoff in the response would be (t1 - 7 years).

---------------------------------------------------------------------
Ambarish Malpani
Architect					         650.567.5457
ValiCert, Inc.				        [email-masked]
1215 Terra Bella Ave.		              http://www.valicert.com
Mountain View, CA 94043-1833

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]]On Behalf
> Of Denis Pinkas
> Sent: Friday, January 29, 1999 2:26 AM
> To: Markus Bitterli
> Cc: [email-masked]
> Subject: Re: OCSP and historical data
> 
> 
> Markus,
>