Subject: RE: AW: self-signed TSA [Was Re: Private Key Cloning]

From: Michael Zolotarev <[email-masked]>
Date: Fri, 23 Jun 2000 12:02:16 +1000

I guess the problem is a common misconception that a TSA is always a
subsidiary/sub-service of a CA. Not necessary. TSA is/can_be a service on
its own, with no inherited relationship to any CA at all.

So when NIST starts offering TSA services, it would have to get a
certificate from some CA? Why? Why wouldn't you trust their TSA certificate
directly?

> -----Original Message-----
> From: Peter Lipp [mailto:[email-masked]]
> Sent: Thursday, June 22, 2000 7:24 PM
> To: [email-masked]
> Subject: Re: AW: self-signed TSA [Was Re: Private Key Cloning]
> 
> 
> > I'm not convinced it's bad to issue self-signed TSA certificate.
> > I'm just saying it might not be a great idea.
> Agree. I don't see the big advantage. For one, if I want to 
> trust a CA I
> need to go through whatever steps are appropriate. If the CA
> offers/recommends/uses a TSA, it can give me a certificate 
> for the TSA and -
> having already decided to trust the CA - it is simple to verify the
> certificate and decide to trust the TSA too. So what does the 
> self-signed
> TSA cert buy me besides the need to go through the trust 
> decisions again?
> Now consider revocation - do you really suggest to set up a separate
> revocation-scheme for the TSA? I simply don't see any 
> advantage here...
> 
> Peter
>

---

From: "Peter Lipp" <[email-masked]>
Date: Fri, 23 Jun 2000 23:34:22 +0200

> its own, with no inherited relationship to any CA at all.
Sure it can. But I bet it still will have certificates from some CA (more
than one maybe) that trust the TSA for doing their service properly. Do you
really believe the average user will and can go and check for each and every
service provider if it should be trusted? If he at some point really
consiously decided to trust a certain CA, it will be close to a miracle.
Most will accept somebody elses decisions, maybe preconfigured by the
vendor, and if the SW asks: should I trust, he will hit the "never ask me
that question again" button....

Peter