Subject: Re: Issues with draft-ietf-pkix-pr-tsa-02.txt

From: Denis Pinkas <[email-masked]>
Date: Fri, 14 Feb 2003 17:10:45 +0100

Jeff,

> The IESG discussed this document on today's telechat. Two issues were
> raised.

> 1. There needs to be a Security Considerations section!

Nick Pope and myself have prepared such a section. Here it is:

8. Security Considerations

When verifying time-stamp tokens it is necessary for the verifier to
ensure that the TSU certificate is trusted and not revoked. This means
that the security is dependent upon the security of the CA that has
issued the TSU certificate for both issuing the certificate and
providing accurate revocation status information for that certificate.

When a time-stamp is verified as valid at a given point of time, this
does not mean that it will necessarily remain valid later on. Every
time, a time–stamp token is verified during the validity period of
the TSU certificate, it must be verified again against the current
revocation status information, since in case of compromise of a TSU
private key, all the time-stamp tokens generated by that TSU become
invalid. Annex C provides guidance about the long term verification
of time-stamp tokens.

In applying time-stamping to applications, consideration also needs
to be given to the security of the application. In particular, when
applying time-stamps it is necessary to ensure that the integrity of
data is maintained before the time-stamp is applied. The requester
ought to really make sure that the hash value included in the
time-stamp token matches with the hash of the data.

> 2. Is this document identical to its ETSI equivalent? Do we have
>    permission from ETSI to publish this as an IETF document? Do we
>    need permission?

We do have permission from ETSI for the publication.

RFC 3126 has been published with the following advertisement.

    The contents of this Informational RFC is technically equivalent to
    ETSI TS 101 733 V.1.2.2 Copyright (C). Individual copies of this
    ETSI deliverable can be downloaded from http://www.etsi.org

The writing for this new document is nearly the same:

    The contents of this Informational RFC is technically equivalent to
    ETSI TS 102 023 V1.2.1 (2002-06) [TS 102023]. The ETSI TS is under
    the ETSI Copyright (C). Individual copies of this ETSI deliverable
    can be downloaded from http://www.etsi.org

If this is a problem, we can make it exactly the same:

    The contents of this Informational RFC is technically equivalent to
    ETSI TS 102 023 V 1.2.1 (2002-06) [TS 102023] Copyright (C).
    Individual copies of this ETSI deliverable can be downloaded from
    http://www.etsi.org

Would you tell me whether I can now place the version with the additional 
security considerations section with the current text about the copyright or 
with the new proposed text ? (or whether it does not matter which one ?)

Regards,

Denis

>                 -Jeff