Subject: Q: TSA policy

From: Bernd Matthes <[email-masked]>
Date: Wed, 03 Apr 2002 10:21:44 +0200

Hi!

I need some clarification about TSA policy ID.
RFC3161 says:
   "The policy field MUST indicate the TSA's policy under which the
   response was produced.  If a similar field was present in the
   TimeStampReq, then it MUST have the same value, otherwise an error
   (unacceptedPolicy) MUST be returned."

The first question is whether a TSA can be have a "list" of policy ID's
to check
the requested policy against this list and generate a timestamp if one
is 
matching or use the "first" entry if no policy is requested.
I think that's not allowed, but for each policy MUST run a separate TSA
server,
i'm right?

RFC3161 says (chapter 2.1.):
"   5.    to include within each time-stamp token an identifier to
         uniquely indicate the security policy under which the token was
         created."

The policy belongs to the TSA, i.e. it says about secure environment,
time source availability/precision, hardware/software key, private key
storage and so on, i'm right?
So a client cannot say in in the requested policy what the source of the
messageImprint is. For example a request for a word document comes with
"1.2.3.4" and a request for a excel table comes with "1.2.3.5"?
Or is the extension the better place to specify what was the origin 
for the messageImprint?

The third question is about the possibility to "forward" a time-stamp
request
to another TSA if the requested policy did not match? So proxy likely?

Thanks in advance.

with kind regards
-- 
Bernd Matthes                   Gemplus mids GmbH --
Senior Software Engineer    	   formerly Celo Communications GmbH
Dipl.-Ing.(FH)                  R&D Center Germany
--------------------------------------------------------------------
"Complexity breeds bugs. Bugs prevent adoption, lack of" \
"adoption results in death. Death not good." "Life sucks."