Subject: Time Stamp: tsa field in TSTInfo

From: "Juan Luis López" <[email-masked]>
Date: Wed, 7 Apr 1999 11:25:54 +0200

Hi everybody!
 
    I am involved in a Time Stamping project and we are analysing the PKIX draft about this subject.
 
    I would like to give my opinion on an issue to the list:
    It seems not appropriate to include a field in TSTInfo structure related to the tsa identity, i.e. tsa field. I don't find this field necessary because it is repeated when using a CMS or PKCS#7 envelope to encapsulate the token information. This information would be redundant since an identifier distinguishing the given tsa should be present in the signerInfo structure.
 
    So, I recommend the deletion of this field.
 
    Regards,
   Juan Luis López

    -------------------------------------------------------------------------------------
Juan Luis López                                              <[email-masked]>
Project Engineer                                              http://www.fnmt.es/pkits
Fábrica Nacional de Moneda y Timbre             tel: [+34] 91 506 48 40
C/ Juan de Mariana, 17                                  fax: [+34] 91 506 48 51
E-28045 Madrid, SPAIN

---

From: Robert Zuccherato <[email-masked]>
Date: Wed, 7 Apr 1999 11:44:48 -0400

Actually, I believe that when using CMS only the content (in this case
TSTInfo) is signed along with any authenticated attributes.  Thus, the
distinguishing information for the TSA would not be signed if it was not
included within the TSTInfo structure.

	Robert.

> ----------
> From: 	Juan Luis López[SMTP:[email-masked]]
> Sent: 	Wednesday, April 07, 1999 5:25 AM
> To: 	pkix
> Subject: 	Time Stamp: tsa field in TSTInfo
> 
>     Hi everybody!
>  
>     It seems not appropriate to include a field in TSTInfo structure
> related to the tsa identity, i.e. tsa field. I don't find this field
> necessary because it is repeated when using a CMS or PKCS#7 envelope to
> encapsulate the token information. This information would be redundant
> since an identifier distinguishing the given tsa should be present in the
> signerInfo structure.
>

---

From: Michael Zolotarev <[email-masked]>
Date: Thu, 8 Apr 1999 09:27:12 +1000

The core time stamp information can be used indirectly, as a field inside 
some third party WhateverService (WS) structure. Even (!) if this WS 
structure gets signed/ enveloped, the signer is not going to be the TSA. 
DCS as it stands now may serve as an example.

So, having tsa inside the TSTInfo may come as a useful thing - the WS 
clients may still want to know the TimeStamp's origin.

Michael Zolotarev
Technical Architect
Baltimore Technologies Limited (Australia)

---

From: "Juan Luis López" <[email-masked]>
Date: Thu, 8 Apr 1999 12:22:14 +0200

Yes, you're right. But, the only thing that we should take into account is
that the token is actually signed by the tsa. What tsa? the one signing the
token. This information shall be present in the "sid" field of the
SignerInfo structure. Optionally, the tsa certificate(s) could be
incorporated in the SignedData structure. So, why should we use the tsa
field in the TSTInfo structure when CMS Signed Data is used specifically for
the purpose of authenticating the signer? I mean, why are you signing "who
you are" if the signature itself (actually the process of verifying it)
provides that information?

Juan Luis
    ------------------------------------------------------------------------
-------------
Juan Luis López                                              <[email-masked]>
Project Engineer
http://www.fnmt.es/pkits
Fábrica Nacional de Moneda y Timbre             tel: [+34] 91 506 48 40
C/ Juan de Mariana, 17                                  fax: [+34] 91 506 48
51
E-28045 Madrid, SPAIN

-----Mensaje original-----
De: Robert Zuccherato <[email-masked]>
Para: pkix <[email-masked]>; 'Juan Luis López' <[email-masked]>
Fecha: miércoles 7 de abril de 1999 18:47
Asunto: RE: Time Stamp: tsa field in TSTInfo

Robert.

---

From: Peter Sylvester <[email-masked]>
Date: Thu, 8 Apr 1999 13:24:14 +0200

> DCS as it stands now may serve as an example.
I am not sure what you want to say: 

A TimeStampToken is a CMS document that contains the signature
of the TSA, and a DCS provider can choose to include this in the
DCS response to indicate the time. So you have all the signerinfo
of the TSA, TDAs and DCS, etc.

> clients may still want to know the TimeStamp's origin.
Agreed.

---

From: Peter Sylvester <[email-masked]>
Date: Fri, 9 Apr 1999 11:55:51 +0200

> Generally speaking, I  am not found of too many OPTIONS. Whenever we can avoid
> one, we should: this is much easier for interoperability testing. In that case I
> would favour the mandatory support of the authenticated attribute from ESS and
> suppress the name from the content of the token.
> 

I second that; a value that can occur in two places has
the tendancy to be misused. Someone might come up with
the idea of both places with a different name. 

Somehow this reminds me to alternate names in certificates :-) 

Peter Sylvester

---

From: "Juan Luis López" <[email-masked]>
Date: Fri, 9 Apr 1999 15:09:47 +0200

Michael,

I am not sure about what you want to say. The core time stamp information
(TSTInfo) needs to be signed by the tsa in order to have a proof of
existence value otherwise is valueless and that information TSTInfo should
not be trusted.

If you are saying that some other authority interprets an originally signed
time stamp token and extends its trust to its users by adding it to its own
structures, then the later authority should verify the signed token and thus
discovering in the process the identity of the former tsa. If that authority
wished to include information about time-stamp's origin into its structures
it could just retrieve that information from signature verification process
and simply add it together with the TSTInfo, as a new field.

Did I manage to understand you?

Juan Luis

-----Mensaje original-----
De: Michael Zolotarev <[email-masked]>
Para: 'Robert Zuccherato' <[email-masked]>; 'Juan Luis Lopez'
<[email-masked]>
CC: [email-masked]' <[email-masked]>
Fecha: jueves 8 de abril de 1999 2:28
Asunto: RE: Time Stamp: tsa field in TSTInfo