Subject: Re: draft-ietf-pkix-time-stamp-09 comments

From: Peter Sylvester <[email-masked]>
Date: Fri, 8 Sep 2000 18:55:12 +0200 (MET DST)

I had thought that my following three comments wouldn't be
worth to be mentioned in order not to disturb the process but
since lots of other stuff is coming to the surface, here they
are: 

- The draft references a non-existing or not-yet-existing feature
  in 'son of 2459'. Is this allowed in a proposed standard? 
  I have asked that question a week ago to the iesg (no answer so far).

- The direct socket protocol is not adjusted with the one in cmp, 
  this is unfortunate, shouldn't the protocol reference cmp. 
  
- Should the security section mention the case of an active
  attacker intercepts a response and provokes a network error
  to the client, thus the attacker may later have 
  'earlier evidence' (whatever that would mean). Or, there
  is no discussion at all about whether it is necessary to
  authenticate the TSA, or about confidentiality. 

Peter Sylvester

---

From: Russ Housley <[email-masked]>
Date: Fri, 08 Sep 2000 14:46:21 -0400

>   I have asked that question a week ago to the iesg (no answer so far).

My understanding is that the time stamp document could not be published as 
an RFC until the son-of-RFC 2459 was also published.  They would come out 
together.

>   authenticate the TSA, or about confidentiality.

This is a reasonable thing to include.

Russ