Subject: Re: RE: OCSP and historical data

From: Markus Bitterli <[email-masked]>
Date: Mon, 01 Feb 1999 07:58:24 +0100

Hello,
Probably I do misunderstand this, but I think this is just to provide an
answer for certificates which are already expired.
My problem is that I would like to check certificates which signs
transactions, e.g. within an e-mail. In this case   I should actually check
the validity of the certificate for the time of the signing process and not
when I receive it. For this I saw no mechanism in the standard.

Regards,
Markus

[email-masked] wrote:

> Hi Denis, Markus,
>     Yes, you can get historical data from an OCSP responder, as long
> as the responder chooses to support archiving of data. Check section
> 5.4.4.
>
> Regards,
> Ambarish
>
> 5.4.4  Archive Cutoff
>
>    An OCSP responder MAY choose to retain revocation information beyond
>    a certificate's expiration. The date obtained by subtracting this
>    retention interval value from the producedAt time in a response is
>    defined as the certificate's "archive cutoff" date.
>
>    OCSP-enabled applications would use an OCSP archive cutoff date to
>    contribute to a proof that a digital signature was (or was not)
>    reliable on the date it was produced even if the certificate needed
>    to validate the signature has long since expired.
>
>    OCSP servers that provide support for such historical reference
>    SHOULD include an archive cutoff date extension in responses.  If
>    included, this value SHALL be provided as an OCSP singleResponse
>    extension identified by id-pkix-ocsp-archive-cutoff and of syntax
>    GeneralizedTime:
>
>    id-pkix-ocsp-archive-cutoff  OBJECT IDENTIFIER ::= { id-pkix-ocsp 6 }
>
>    ArchiveCutoff ::= GeneralizedTime
>
>    To illustrate, if a server is operated with a 7-year retention
>    interval policy and status was produced at time t1 then the value for
>    ArchiveCutoff in the response would be (t1 - 7 years).
>
> ---------------------------------------------------------------------
> Ambarish Malpani
> Architect                                                650.567.5457
> ValiCert, Inc.                                  [email-masked]
> 1215 Terra Bella Ave.                         http://www.valicert.com
> Mountain View, CA 94043-1833
>
> > -----Original Message-----
> > From: [email-masked]
> > [mailto:[email-masked]]On Behalf
> > Of Denis Pinkas
> > Sent: Friday, January 29, 1999 2:26 AM
> > To: Markus Bitterli
> > Cc: [email-masked]
> > Subject: Re: OCSP and historical data
> >
> >
> > Markus,
> >
> > Your analysis is correct. OCSP assumes the current date only.
> >
> > > I've read the OCSP draft and wonder whether it is possible
> > to request
> > > information about the validity for a certificate for a
> > specific date and
> > > time in the past. As I've understood it, this is not
> > possible. If so,
> > > has somebody any idea for a solution to that requirement.
> >
> > There are several ways. One solution is to gather the
> > appropriate CRL or OCSP
> > responses close to the time of the signature.
> > If you want to rely on an external service, there have been
> > discussions around
> > the DCS draft and the DVS concept: "Data Validation Service".
> > This kind of
> > service is supposed to do some verification upon some data
> > that is presented.
> > I recently send an E-mail on that topic. Please refer to it.
> >
> > Denis
> >
> > > Markus Bitterli
> >

---

From: Simon Tardell <[email-masked]>
Date: Mon, 1 Feb 1999 10:00:43 +0100

> when I receive it. For this I saw no mechanism in the standard.

If a certificate is revoked, you get the revocation time _and_ revocation
reason in the response. From that, you should be able to figure if you
should trust the signature or not (obviously, the revocation reason is
important here -- e.g. if the keys are compromised and you don't have a
trusted time stamp, the revocation time doesn't matter). The archive cutoff
time is just to tell you if the OCSP responder keeps that information for
old (expired) certificates, as it is not normally required to.

Simon

Simon Tardell       voice +46 8 7755225, fax +46 8 191499
iD2 Technologies    [email-masked], http://www.iD2tech.com
Grand Prize Winner European IT-prize 1998  --  http://www.it-prize.org