Subject: RE: association between the time-stamp and the original document

From: Massimiliano Farris <[email-masked]>
Date: Wed, 22 May 2002 12:51:09 +0200

Dear Denis,

thanks for your patience.  You got my point.
I am using time stamps in a service of certified
mail, where we time stamp e-mail messages, which
might not be signed.  At the moment we are sending
the original message and the time stamp as two
MIME attachments.  We do not like this and would 
prefer to "attach the data (even not signed) 
to the timestamp". To do this we would like to 
insert the whole document in the time stamp, 
in order to make time stamp verification more 
robust.

Another desideratum is to let the user store
messages (which are not SignedData) and associated 
time stamp.  At the moment I am using file extensions 
to do this.
But what if the user wants to request some new time
stamp on the message?  We do not like to solve
this at the application level (for example with a 
private store of time stamps indexed by document hashes)
or worse with some funny file extension syntax.

A sequence of URIs inserted in the time stamp is
much more attractive to us,  but is there
a CMS attribute that would suggest our intent in some 
generally understandable way?
For example, could ContentHints from ESS be a
valid choice, or is there any better alternative?

> -----Original Message-----
> From: Denis Pinkas [mailto:[email-masked]]
> Sent: mercoledi 22 maggio 2002 11.30
> To: Massimiliano Farris
> Cc: [email-masked]'
> Subject: Re: association between the time-stamp and the original
> document
> 
> 
> Massimiliano,
> 
> > > In the context of the use of CMS, RFC 3126 has defined 
> two time-stamp
> > > related attributes:
> > >
> > > 1) A signed attribute, attached to the SignedData.
> > >    It is the Content Time-Stamp attribute (p.34).
> > >
> > >    The content time-stamp attribute is an attribute which 
> is the time-
> > >    stamp of the signed data content before it is signed.
> > >
> > >       id-aa-ets-contentTimestamp OBJECT IDENTIFIER ::= { iso(1)
> > >       member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
> > >       smime(16) id-aa(2) 20}
> > >
> > > 2) An unsigned attribute, attached to the digital signature.
> > >    It is the Signature Time-Stamp Attribute (p.36):
> > >
> > >    The Signature Timestamp attribute is a timestamp of 
> the signature
> > >    value.
> > >
> > >       id-aa-signatureTimeStampToken OBJECT IDENTIFIER ::= { iso(1)
> > >       member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
> > >       smime(16) id-aa(2) 14}
> > >
> > > As indicated, these attributes are only usable in the 
> context of a CMS
> > > message.
> > >
> > > Denis
> 
> >   I know it, I completely agree.
> 
> >   However, my question is about something else.
> 
> >   I talked of id-aa-signatureTimeStampToken only as an example.
> >   I'm talking about the definition of an Unsigned Attribute 
> to be used
> >   in the context of a time-stamp (which is a CMS).
> 
> This does make sense.
> 
> >   This lets a user to enrich the time-stamp received by a 
> TSA with the
> >   'object' of the time-stamp itself.
> >   In the first e-mail I said:
> > 
> >   > However, the user may not like to be involved in a
> >   > digital signature process everytime he wants to
> >   > timestamp a document.
> > 
> >   In this case, the user has the great problem to 'link', 
> to associate in
> >   some manner the time-stamp with the document. Without 
> this association,
> >   the time-stamp is useless.
> 
> There are two ways to perform the link:
> 
>   1) the time-stamp is attached to the data, this is what RFC 
> 3126 does.
>   2) the data is attached to the time-stamp, this is what you suggest.
> 
> >   Do you think this problem has to be solved by the client 
> responsible of
> >   managing the interaction with the TSA, without any 
> standardized way ?
> >   Do you think that only time-stamps of a signature have a sense ?
> 
> The link could be done locally by adding an unsigned attribute to the
> structure of the time-stamp token which is CMS based.
> 
> I would guess that you would like a sequence of URIs to be 
> included in that
> unsigned attribute. What else ?
> 
> Denis
>

---

From: Denis Pinkas <[email-masked]>
Date: Thu, 23 May 2002 12:04:13 +0200

Massimiliano,

> in order to make time stamp verification more

I would not like to place the whole document within the time-stamp. 

I would rather prefer to indicate the link with a document that may 
be stored elsewhere in one or several places.

> generally understandable way?

Not at this time.

> valid choice, or is there any better alternative?

ContentHints provides the document type, but not its location.

A new CMS attribute would be needed.

Denis