Subject: time stamp of a CMS with multiple signatures

From: "Miguel Rodriguez" <[email-masked]>
Date: Mon, 5 May 2003 19:58:07 -0500

Hi! 
 
In TSP (RFC 3161) appendix A there's a guideline on how to store a time
stamp in a CMS, and it says that the messageImprint shall be the hash of
the signature field within the SignerInfo  for the SignedData being
timestamped. What should be the messageImprint for a SignedData with
multiple SignerInfo fields?
 
Thanks,
 
Miguel A. Rodriguez
Software Engineer
SeguriDATA

---

From: Jean-Marc Desperrier <[email-masked]>
Date: Thu, 08 May 2003 19:40:53 +0200

>multiple SignerInfo fields?
As it is described in appendix A, the timestamp will be the timestamp of 
a single signature, more than the timestamp of a document.

If you have multiple SignerInfo and stick to RFC3161, you will need 
multiple time-stamps.

If I haven't missed something, RFC3126 does not provide a solution to 
use only one signature in this case, but suggests to used embedded 
signature (embedding each signed CMS inside another signed CMS) instead 
of independent signatures (multiple SignerInfo) if you want to use only 
one time-stamp.

As anyway the time-stamp you want will only be added after the fact, 
after each independent signature has been added, you could embed the 
document inside a CMS signed by yourself, and timestamp this CMS.