Subject: RE: OCSP support for historical reference to certificate suspension

From: Peter Sylvester <[email-masked]>
Date: Wed, 6 Sep 2000 19:13:42 +0200 (MET DST)

> 
> i meant the case where i as the signer (or verifier) want to proove later on
> that i signed a document at some time (or in an interval). i think it is
> important for the requirement of non-repudiation to have a chance to proove
> that the certificate was valid at the signature creation time. but this can
> be achieved, if it is not allowed to make any retroactive status changes. if
> there is no suspended status allowed that means that the certificate is not
> valid, OCSP as it is now is enough. but there are different interpretations
> of the suspended status. in the "ILLINOIS ELECTRONIC COMMERCE SECURITY ACT"
> (http://www.mbc.com/ecommerce/legis/ill-esca.html) one can read:
> > If a certificate is suspended rather than revoked, the operational period
> is considered to be terminated
> > for the duration of the period of suspension, and digital signatures
> created during the period of
> > suspension will not qualify as secure electronic signatures under Section
> 15-105.

I do not see in text that something is required to do something like
time stamping so that a verifier has some date to use to determine
the validity of a cert. 

In the comments, you have a remark that an electronic signature can
become invalid in the future. 

It seems to me that the idea is to set up some security procedure
where a creating and relying part agree at some point
within the operational period of a cert, that the electronic signature
is a good one, and then do something appropriate to keep that agreement.
  
Or, if a signer/verifier have the desire to prove later that an
electronic was valid at least at some time in this context, 
they make a cert validation and keep the result, this can include
time stamping etc.  

PS

---

From: "Karl Scheibelhofer" <[email-masked]>
Date: Thu, 7 Sep 2000 08:09:36 +0200

> time stamping so that a verifier has some date to use to determine

the second timestamp is absolutely required to achieve non-repudiation.
otherwise i could easily revoke my certificate at any time and claim that
someone other signed it afterwards. no one could prove the contrary without
a timestamp.
the first timestamp could prevent similar things. i could claim that i had
the key-pair before i received a certificate or before it got valid. i admit
this case is not as important as the previous one, because it is rarely
necessary to prove that i signed something after some date. nevertheless, i
would not ignore it.

  Karl