Subject: RE: Forward-dated entries in a CRL

From: Peter Williams <[email-masked]>
Date: Thu, 18 Nov 1999 11:04:40 -0800

> -----Original Message-----
> From: Russ Housley [mailto:[email-masked]]
> Sent: Thursday, November 18, 1999 6:05 AM
> To: Salz, Rich
> Cc: [email-masked]'
> Subject: Re: Forward-dated entries in a CRL
> 
> 
> Rich:
> 
> No.  RFC 2459 says:
> 
>     The invalidity date is a non-critical CRL entry extension that
>     provides the date on which it is known or suspected that 
> the private
>     key was compromised or that the certificate otherwise 
> became invalid.
> 
> Since the extension is non-critical, a certificate user can ignore 
> it.  Thus, any entry on the CRL is treated as revoked at the 
> time it is put 
> on the list.

Perhaps, answer the following question:

User signed transaction arrives at 13:00; it was timestamped at 11:00. 
Latest CRL was issued at 12:00, with 1 revocation notice, dated 10:00. User 
verifies authenticity at 14:00, after lunch, noting the latest CRL lists on
itself 
a revoked certificate - for a cert used during PKIX cert processing.

Is the document signature good?  Is the contract properly signed?

Would DoD recognise the document as signed, and effective, for 
example, today, or not?

> 
> Russ
> 
> 
> At 12:11 PM 11/16/99 -0500, Salz, Rich wrote:
> >Is it legal to put future date in the revocationDate
> >field of a revokedCertificates entry?
>

---

From: Al Arsenault <[email-masked]>
Date: Thu, 18 Nov 1999 21:54:10 -0500

Okay, I'll take a shot, but with the usual caveat that this represents
only my opinion, not official DoD positions:

> Is the document signature good?  Is the contract properly signed?

Under your scenario, no.  There is strong evidence (as accepted by a CA,
indicated in the "invalidity Date" in the CRL) that the certificate was
revoked (1000) prior to the timestamp (1100), and thus, this is not a
valid transaction.
 
> Would DoD recognise the document as signed, and effective, for

It depends on a bunch of things.  First of all, a lot of the
applications with which I'm familiar don't do things with any finer
granularity than 1 day, in which case this transaction would be rejected
(since revocation happened on the same day as the transaction).  
Assuming that you had granularity to the hour, or even to the second,
then it would depend on how the applications treated the extension.  If
they chose to ignore it (as Russ pointed out, it's non-critical), then I
'm not sure what they'd do.  If they processed it, then they would
probably reject the transaction as well.

(A more interesting case would be if the transaction had been
time-stamped at 0800, with the rest of the data as you specify.  In that
case, the "right thing" to do would be to accept the transaction, but
I'm willing to bet that a significant number of applications would
reject it.)

			Al Arsenault

-- the opinions stated here are those of the author, and may or may not
reflect the official policies of his employer or of any other
organization with which he has a relationship.