Subject: RE: OCSP support for historical reference to certificate suspensi on

From: Michael Myers <[email-masked]>
Date: Fri, 1 Sep 2000 12:51:02 -0700

This is first I've heard of this specific requirement but it seems quite
natural once the need is exposed.  We'll take this into account in the
2560bis work.  Thanks also for the OPTIONAL.  That'll make things a little
bit easier.

But for discussion purposes, I've been architecting under the presumption
that in the instance when signing time was important, the time when the
digital signature was created would be integrated somehow into the subject
electronic document and thus there exist a well-defined time.

I believe you're implying that it may not be the case that signing time is
integrated into a subject document, and so one is led to bracket the signing
time.  Could confirm please, or otherwise clarify?  Thanks.

Mike

> -----Original Message-----
> From: Karl Scheibelhofer [mailto:[email-masked]]
> 
> > -----Original Message-----
> > From: Michael Myers [mailto:[email-masked]]
> > Given the current work underway regarding 2560bis, I 
> propose to include in
> > the 2560bis work effort an optional "ValidAt" (or some 
> such) field in the
> > request syntax to accomodate this requirement.
> 
> normally, it will not be possible to determine the signature 
> creation time
> exactly. the best i can reliable determine is, that the signature was
> created in a time intervall (between two time stamps). so if 
> you plan to
> include a time field, i think it would be nice to consider taking an
> interval. you can make the second value optional.

---

From: "Patrick G. Moore" <[email-masked]>
Date: Fri, 01 Sep 2000 17:46:41 -0400

Hi,

In my case, the signing time is part of the signed data.  We may
like to re-verify old data from our archives at any time.  Thus,
we would also like a "VALID AT" type of option.  I agree that an interval
could be problematic, if a cert was suspended for a period between
the endpoints, how would you discover that.  Just checking the endpoints
would not reveal the suspension.  I would say, if the app is uncertain
of the signing time, let it make as many "VALID AT" queries as it likes
to make it happy.

Pat

---

From: "Karl Scheibelhofer" <[email-masked]>
Date: Mon, 4 Sep 2000 08:55:16 +0200

> time.  Could confirm please, or otherwise clarify?  Thanks.

of course, it is desirable that the document is timestamped before it gets
signed. and to fulfill the requirement for non-repudiation, it is necessary
to timestamp the signed document afterwards. but there are cases thinkable,
where there is a longer time between these two timestamps; e.g. if you are
signing on a mobile device, that does not have permanent access to a
timestamping sever. very often, the first time stamp will be replaced by
just a time value that is added before the document gets signed. but if it
is just a value, i can insert any value i like; it is not detectable
afterwards. so you cannot proof that you signed the document not before a
specific time.
only if you are using two timestamps, you can proof later on that the
signature was created between these two timestamps. in case of a dispute, i
think this is very helpful.

regards

  Karl Scheibelhofer

--

Karl Scheibelhofer, <mailto:[email-masked]>
Institute for Applied Information Processing and Communications (IAIK)
at Technical University of Graz, Austria, http://www.iaik.at
Phone: (+43) (316) 873-5540