Subject: Re: CRLs and expired certificates

From: [email-masked]
Date: Wed, 13 Sep 2000 15:38:37 -0400

If the RP wishes to be sure that some evidence of this sort is
preserved, he (or an agent he has agreed on) can preserve it himself.  In
draft-ietf-pkix-technr-01.txt, some rules are given for which revocation or
non-revocation indications need to be preserved.  See sections 3.7, 4.6,
and 5.5 of that draft.

          Tom Gindin

Eric Norman <[email-masked]> on 09/13/2000 03:18:07 PM

To:   [email-masked]
cc:
Subject:  Re: CRLs and expired certificates

On Wed, 13 Sep 2000, Tim Fowle wrote:

> If so is there any way to check if a certificate was valid when it was
used
> to sign something a long time ago and that certificate has now expired,
and
> does this make any sense or would this not prove anything?

Makes sense to me.  Suppose that I go to my life insurance company's
web page and change the beneficiary of my policy.  My digital
signature is required.  20 or 30 years later I die.  How will someone
verify that my private key wasn't compromised 20 or 30 years ago?

Eric Norman

     "Congress shall make no law restricting the size of integers
     that may be multiplied together, or the number of times that
     an integer may be multiplied by itself, or the modulus by
     which an integer may be reduced".