Subject: CRLs and expired certificates

From: Tim Fowle <[email-masked]>
Date: Wed, 13 Sep 2000 17:39:29 +0100

i may be missing the point a little here but am i right in thinking most 
companies only supply CRL's for certificates that are currently within 
their validity period.
If so is there any way to check if a certificate was valid when it was used 
to sign something a long time ago and that certificate has now expired, and 
does this make any sense or would this not prove anything?

thanks for the help

ttfn
Tim Fowle

---

From: Eric Norman <[email-masked]>
Date: Wed, 13 Sep 2000 14:18:07 -0500 (CDT)

> does this make any sense or would this not prove anything?

Makes sense to me.  Suppose that I go to my life insurance company's
web page and change the beneficiary of my policy.  My digital
signature is required.  20 or 30 years later I die.  How will someone
verify that my private key wasn't compromised 20 or 30 years ago?

Eric Norman

	"Congress shall make no law restricting the size of integers
	that may be multiplied together, or the number of times that
	an integer may be multiplied by itself, or the modulus by
	which an integer may be reduced".

---

From: Mark Scherling <[email-masked]>
Date: Wed, 13 Sep 2000 12:47:08 -0700

That revolves around your archive process and how you manage your documents.  The
verification of the private key (public signing key) would be a function of CRL
archive and being able to extract that information.

The fact that the policy may have changed and that type of transaction was
allowed at that time but not now may need to be preserved.  If we use common law
as an example in some states you are now allowed to go through a stop sign being
the second or third car and turning right.  This is needed to speed up the
traffic flow and prevent traffic jams.  Years before you would have received a
ticket.

If you perform a transaction today and the law/process changes you need to have
all the pieces of the transaction to enact that transaction including policy,
process, business and legal aspects.   There are sections in most policies that
deal with archive but a lot do not extend past 10 years.  One of the other
problems is the preservation of the technology and applications that the
transaction was completed on (remember AES, TRS80, PDP, etc). Electronic
information preservation is still not stable and even the use of CDROM or WORM is
still evolving (DVD).

I hope that I've added fuel for thought and given people something more to
consider.

---

From: Denis Pinkas <[email-masked]>
Date: Thu, 14 Sep 2000 09:23:17 +0200

Eric,

> verify that my private key wasn't compromised 20 or 30 years ago?

Take a look at : 

Electronic Signature Formats for long term electronic signature:
http://www.imc.org/draft-ietf-smime-esformats

and 

Electronic Signature Policies:
http://www.imc.org/draft-ietf-smime-espolicies

Denis