Subject: A data certification server question.

From: "Parag Namjoshi" <[email-masked]>
Date: Thu, 6 May 1999 17:48:28 +0530

Hi All,

I have a question about DCS (Data certification server)
(draft-ietf-pkix-dcs-00.txt) .
(Same issue applies to the time-stamp draft too.)

The (now expired but the latest that I know of ) draft says,

   "The DCS signing key MUST be of a sufficient length to allow for
    a sufficiently long lifetime.  Even if this is done, the key
     will have a finite lifetime.  Thus, any token signed by the DCS
    SHOULD be time stamped (if authentic copies of old CRLs
    are available) or certified again (if they aren't) at a later
    date to renew the trust that exists in the DCS's signature.
    Data certification tokens could also be kept with an Evidence
    Recording Authority [ISONR] to maintain this trust."

This signifies that when DCS / TS certificate expires, the request must
be sent again. This poses two problems :

1.  Token holder must go through the process each time when DCS / TS
certificate
     will expire . Another related problem would be keeping track of which
tokens would
     be expiring and when. If left to human agencies,it would be error prone
(you would
     probably end up having expired tokens ) and done automatically (say one
day after
     the certificate expired) could result in flooding the server.

2.  Even worse, the time in the token ( DCSTime or the timestamp ) will bear
newer time.This
     would probably not be acceptable in many situations.

I would like to suggest addtional request that would take previously issued
token & issue
a new one. The server should be required to have access to its older
certificates . Then  it
can verify the older token & issue new token but containing same time as the
previous
token.

Considering long term nature of DCS / timestamp  protocols  (For example it
could be years
since token was issued that it needs to be verified.) it would be a leap of
faith to assume that
authentic copies of the old CRL's would be assesible but it would be
certainly be feasible
for the DCS/TS to store/have access to their older certificates.  I think
the reissuing of token
requests would address both the problems .

Thanks with regards,
Parag Namjoshi