Subject: The time mark can be used as a simple time stamp substitute

From: "Peter Rybar" <[email-masked]>
Date: Mon, 9 Oct 2006 12:45:00 +0200

A time mark can be used as a simple time stamp substitute when we specify content of OCSP nonce as a hash value of MessageImprint type as result of some asymmetric operation.

If someone has a demand for retrieval of an approximate time when asymmetric operation has happened and   he wants that implementation will not to have an impact on the present solutions to the future, then I suggest to use the present widely used protocol which already contains trusted time inside and attribute like nonce which can encapsulate useful information.  

For example OCSP protocol (RFC2560) contains the attribute “producedAt” (trusted time at which the OCSP responder signed OCSP response) and some OCSP can also contain useful extension “nonce”. 

In RFC2560 the nonce is defined as:“ the nonce is included as one of the requestExtensions in requests, while in responses it would be included as one of the responseExtensions. In both, the request and the response, the nonce will be identified by the object identifier id-pkix-ocsp-nonce, while the extnValue is the value of the nonce”.

As we can see in RFC2560 the value of nonce is not limited and it can contain anything. If we will describe one alternative of the value of nonce, in some RFC2560 update, which can contain value of type MessageImprint which is defined in RFC3161 (Time-Stamp Protocol) then any result of asymmetric operation (binary string as result of signing or encryption) where X509 certificate can be used, can be time marked with OCSP which contains:

1.      validity status of X509 certificate,

2.      HASH from the result of asymmetric operation which is included in nonce as a MessageImprint type,

3.      Time of the time mark in the attribute producedAt of time before which the asymmetric operation could happen.

A definition of MessageImprint is from RFC3161 (Time-Stamp Protocol):

MessageImprint ::= SEQUENCE  {

        hashAlgorithm                AlgorithmIdentifier,

        hashedMessage                OCTET STRING  }.  

Proposed solution has not negative impacts on the present implementation because present implementation will work with nonce as it does today. New application will test the value of nonce and if it contains ASN.1 structure of MessageImprint type then they will test the Hash value of asymmetric operation and the hash value in MessageImprint and if they have identical Hash value, then application can declare that the asymmetric operation was realized before OCSP.ProducedAt time.

What do you think about this solution?

Is it possible to add such additional information to the OCSP protocol (RFC2560)?

Can somebody give an advice how to include this solution into RFC document, in the easiest way?

Best regards

Peter Rybar

[email-masked]

---

From: "Liaquat Khan" <[email-masked]>
Date: Mon, 9 Oct 2006 19:43:28 +0100

I believe SAFE uses the approach you describe.

Regards,

LK

  _____  

From: [email-masked] [mailto:[email-masked]] On
Behalf Of Peter Rybar
Sent: 09 October 2006 11:45
To: [email-masked]
Subject: The time mark can be used as a simple time stamp substitute 
Importance: High

A time mark can be used as a simple time stamp substitute when we specify
content of OCSP nonce as a hash value of MessageImprint type as result of
some asymmetric operation.

If someone has a demand for retrieval of an approximate time when asymmetric
operation has happened and   he wants that implementation will not to have
an impact on the present solutions to the future, then I suggest to use the
present widely used protocol which already contains trusted time inside and
attribute like nonce which can encapsulate useful information.  

For example OCSP protocol (RFC2560) contains the attribute "producedAt"
(trusted time at which the OCSP responder signed OCSP response) and some
OCSP can also contain useful extension "nonce". 

In RFC2560 the nonce is defined as:" the nonce is included as one of the
requestExtensions in requests, while in responses it would be included as
one of the responseExtensions. In both, the request and the response, the
nonce will be identified by the object identifier id-pkix-ocsp-nonce, while
the extnValue is the value of the nonce".

As we can see in RFC2560 the value of nonce is not limited and it can
contain anything. If we will describe one alternative of the value of nonce,
in some RFC2560 update, which can contain value of type MessageImprint which
is defined in RFC3161 (Time-Stamp Protocol) then any result of asymmetric
operation (binary string as result of signing or encryption) where X509
certificate can be used, can be time marked with OCSP which contains:

2.      HASH from the result of asymmetric operation which is included in
nonce as a MessageImprint type,

3.      Time of the time mark in the attribute producedAt of time before
which the asymmetric operation could happen.

Proposed solution has not negative impacts on the present implementation
because present implementation will work with nonce as it does today. New
application will test the value of nonce and if it contains ASN.1 structure
of MessageImprint type then they will test the Hash value of asymmetric
operation and the hash value in MessageImprint and if they have identical
Hash value, then application can declare that the asymmetric operation was
realized before OCSP.ProducedAt time.

Is it possible to add such additional information to the OCSP protocol
(RFC2560)?

Can somebody give an advice how to include this solution into RFC document,
in the easiest way?

Best regards

Peter Rybar

[email-masked]

---

From: Róbert Kisteleki <[email-masked]>
Date: Mon, 09 Oct 2006 22:32:08 +0200

Also, if I remember correctly, the openxades.org guys tried something 
similar back in 2003.

Cheers,
Robert

Liaquat Khan wrote:
> ------------------------------------------------------------------------
> 
> *From:* [email-masked] 
> [mailto:[email-masked]] *On Behalf Of *Peter Rybar
> *Sent:* 09 October 2006 11:45
> *To:* [email-masked]
> *Subject:* The time mark can be used as a simple time stamp substitute
> *Importance:* High
> 
>  
> 
> A time mark can be used as a simple time stamp substitute when we 
> specify content of OCSP nonce as a hash value of MessageImprint type as 
> result of some asymmetric operation.
> 
>  
> 
> If someone has a demand for retrieval of an approximate time *when 
> asymmetric operation has happened *and   he wants that implementation 
> will not to have an impact on the present solutions to the future, then 
> I suggest to use the present widely used protocol which already contains 
> trusted time inside and attribute like nonce which can encapsulate 
> useful information. 
> 
>  
> 
> For example OCSP protocol (RFC2560) contains the attribute “producedAt” 
> OCSP can also contain useful extension “nonce”.
> 
>  
> 
> In RFC2560 the nonce is defined as:“ the nonce is included as one of the 
> requestExtensions in requests, while in responses it would be included 
> as one of the responseExtensions. In both, the request and the response, 
> the nonce will be identified by the object identifier 
> id-pkix-ocsp-nonce, while the extnValue is the value of the nonce”.
> 
>  
> 
> contain anything. If we will describe one alternative of the value of 
> nonce, in some RFC2560 update, which can contain value of type 
> MessageImprint which is defined in RFC3161 (Time-Stamp Protocol) then 
> any result of asymmetric operation (binary string* *as result of* 
> signing* or *encryption*) where X509 certificate can be used, can be 
> time marked with OCSP which contains:
> 
> because present implementation will work with nonce as it does today. 
> New application will test the value of nonce and if it contains ASN.1 
> structure of MessageImprint type then they will test the Hash value of 
> asymmetric operation and the hash value in MessageImprint and if they 
> have identical Hash value, then application can declare that the 
> asymmetric operation was realized before OCSP.ProducedAt time.
> 
>  
> 
> [email-masked] <mailto:[email-masked]>
> 
>  
>

---

From: "Peter Hesse" <[email-masked]>
Date: Mon, 9 Oct 2006 17:43:54 -0400

Liaquat,
 
While SAFE allows for the "hash as nonce" approach, it is an unfair
characterization to say that "SAFE uses" this approach.  SAFE also allows
for the traditional RFC3161 method of time stamping, and in fact several
SAFE member companies prefer the RFC3161 compliant method.  The comment I
made earlier about the 3161 method potentially being less expensive in the
long run is as a result of our experience with SAFE and SAFE members.
 
--Peter

  _____  

From: [email-masked] [mailto:[email-masked]] On
Behalf Of Liaquat Khan
Sent: Monday, October 09, 2006 2:43 PM
To: 'Peter Rybar'; [email-masked]
Subject: RE: The time mark can be used as a simple time stamp substitute 

Regards,

LK

  _____  

Best regards

Peter Rybar

[email-masked]

---

From: "Liaquat Khan" <[email-masked]>
Date: Tue, 10 Oct 2006 08:41:13 +0100

Yes I agree fully with your points.  Of course I did not mean to imply this
is the only approach used by SAFE.

In fact my company only supports RFC3161 currently, mainly because of the
cost reasons you state in your other email (for the OCSP responder it will
be no extra effort, but for end-entity applications to request and validate
this special value for the nonce is where the extra work comes in).    

Regards,

LK

  _____  

From: [email-masked] [mailto:[email-masked]] On
Behalf Of Peter Hesse
Sent: 09 October 2006 22:44
To: 'Liaquat Khan'; 'Peter Rybar'; [email-masked]
Subject: RE: The time mark can be used as a simple time stamp substitute 

Liaquat,

--Peter

  _____  

Regards,

LK

  _____  

Best regards

Peter Rybar

[email-masked]