Subject: RE: draft-ietf-pkix-time-stamp-01.txt comments ( Re: serialNumber )

From: Robert Zuccherato <[email-masked]>
Date: Thu, 13 May 1999 09:49:33 -0400

Michael;

The primary purpose of this document is for time stamping with a PKI to
support the non-repudiation of signatures.  In this situation we will
primarily be comparing time stamps to revocation times and certificate
expiry times, neither of which involves "who was the first".

However, that doesn't mean that resolving the "who was first" argument isn't
important or isn't something we want to do within this protocol.  (After
all, we do support precision greater than a second even though it probably
isn't required for the stated purpose above.)  If we do decide that this is
something that is important and is something we want to do, I think that the
serialNumber is the wrong place to do it.  All timing (and therefore
sequencing) information should be contained with the TSTTime field.  Thus,
we could, for example, mandate that the fractionOfSecond field must be
strictly monotonically increasing within a second and mandating that the TSA
not generate more than one time stamp with the same time value.

I really think that the serial number should remain simply a method for
identifying specific tokens and therefore, does not need to be mandatory.  

	Robert.

> ----------
> From: 	Michael Zolotarev[SMTP:[email-masked]]
> Reply To: 	[email-masked]
> Sent: 	Wednesday, May 12, 1999 8:59 PM
> To: 	[email-masked]
> Subject: 	RE: draft-ietf-pkix-time-stamp-01.txt comments ( Re:
> serialNumber )
> 
> The unique monotonic etc serialNumber is critical when you have to resolve
> 'who was the first' argument between two stamps, having the same time
> value.
> This may well happen if the resolution of the clock is relatively low, and
> two requests entered the TS server virtually simultaneously. Think about
> on-line betting, auctions, etc.
> 
> Defining serialNumber OPTIONAL will make it very confusing for a client
> who
> relies on the sequence as well as on the time itself.
> 
> And I would be deadly scared of seeing something like "if more than one
> time
> stamp are generated with the same time value, then TSA MUST include
> serialNumber into the TSTInfo. Otherwise, the field may not be present
> ...".
> 
> MichaelZ
>

---

From: "Michael Zolotarev" <[email-masked]>
Date: Fri, 14 May 1999 10:12:44 +1000

Robert,

>identifying specific tokens and therefore, does not need to be mandatory.

I have no objections to any other means to resolve the naughty 'who is the
first' problem.
However, if we keep on using the time itself, then theoretically we can run
into the same problem. It is just that the finer time resolution makes the
the chance of simultaneous requests less probable. But the chance is still
there. And I do not see how the TSA would technically be able to guarantee
to "not generate more than one time stamp with the same time value."

Regards
MichaelZ