Subject: Re: The need for two grades of time data.

From: Stephen Kent <[email-masked]>
Date: Thu, 14 Sep 2000 14:26:26 -0400

Bob,

>I believe that what Todd is trying to say is that the question isn't,
>"What time is it?" but rather "What time is it, and who says so, and
>why should anyone believe them?"

Since Todd agrees with Bob's concise translation, I think this is really easy:

	- by choosing to use the service of a given TSA, the client 
is relying on the TSA to state the time

	- the TSA has a cert to identity it, and that cert is issued 
by a CA, who vouches for the accuracy of the ID, consistent with our 
usual CA model

	- a TSA publishes the technical basis for its time keeping, 
which provides the basis for the last value judgement

So, if the goal is to answer Bob's questions, I think we're done.  If 
one believes that we should move on to establishing criteria for 
different grades of time stamps, you're probably subscribed to the 
wrong WG list, and the wrong standards body, i.e., the IETF is not in 
the business of generating assurance standards of this sort.

Steve

---

From: "todd glassey" <[email-masked]>
Date: Thu, 14 Sep 2000 13:12:52 -0700

----- Original Message -----
From: "Stephen Kent" <[email-masked]>
To: "Bob Jueneman" <[email-masked]>
Cc: <[email-masked]>
Sent: Thursday, September 14, 2000 11:26 AM
Subject: Re: The need for two grades of time data.

> which provides the basis for the last value judgement

How is this available to the Time Validator in the Client? I want to check
the time sources inline to make sure all is OK.

> the business of generating assurance standards of this sort.

Its not the standards themselves we are generating its the process of
enabling them to be put in place by adding the ability to certify the time
data in the time stamp independantly of the stamp as a total entity.

---

From: Stephen Kent <[email-masked]>
Date: Thu, 14 Sep 2000 17:22:50 -0400

Todd,

>the time sources inline to make sure all is OK.

I don't know what a "Time Validator" is, but I'll make a guess. 
First, the software checks the TSA's signature on the response, to 
verify its integrity and data origin authentication. It also checks 
the nonce for timeliness.  As is the case with CA policies, one would 
expect client to be configured with a list of TSA policy OIDs, to 
confirm that the time stamp is issued under a policy that, according 
to the folks who configured the software for this app, is appropriate 
for the app.  Does that address your question?

Steve