Subject: RE: TSA signing key?

From: Michael Zolotarev <[email-masked]>
Date: Tue, 13 Jun 2000 10:26:45 +1000

Martin,

Not allowing using the same cert for CA and TSA is simply a matter of
clearly specifying what a TTP is doing.  An entity claiming that it is a TSA
(by putting a special value of extKeyUsage flag), accepts certain legal
responsibilities which makes it distinct in the PKI world. The
responsibilities of CA are 100% different from those of TSA, and you would
not generally expect the same physical(!) entity to operate as both a CA and
a TSA.
A CA which signs a TSA cert (if it is not a self-signed), is expected to
perform a diligent check that the subject (TSA) complies to whatever a TSA
must be compliant to.

For those very reasons, as a verifier of a timestamp, I'd never trust a TSA
cert which does not have the extKeyUsage set to "timestamping", and I would
be very suspicious about a TSA cert which has both "timestamping" and "CA"
flags set.

Also, in a TSA cert there may be certain extensions specific to TSA only.
And there are heaps of CA-specific extensions too. Mixing them in one
certificate will be just messy and more than confusing.

If a CA organisation wants to run a TSA, it won't be a problem to issue a
dedicated cert for the TSS, be it a self-signed or a CA-signed certificate.

Hope it answered your question.

Regards
Michael

> -----Original Message-----
> From: Martin Szotkowski [mailto:[email-masked]]
> Sent: Saturday, June 10, 2000 3:00 AM
> To: [email-masked]
> Subject: TSA signing key?
> 
> 
> In draft is written that TSA cert must be used exclusively 
> for time stamp.
> Why TSA certificate cann't be same as CA certificate?
> 
> thanks Martin
>