Subject: association between the time-stamp and the original document

From: Massimiliano Farris <[email-masked]>
Date: Mon, 20 May 2002 14:51:10 +0200

Hi all,
  I'm developing a client application that manages time-stamps.
  The application is responsible for creating the TimeStampReq,
  for sending it to the TSA, for receiving and processing TimeStampResp
  and for browsing and verifying the TimeStampToken.
  
  One of the concerns of people using the Client is:
  << How can I link the time-stamp to the original document? >>.
  The user must setup a mechanism based on some naming convention
  and/or directory location.

  The user can always sign his document, timestamp the signature and
  add the token to the SignedData, as APPENDIX A specs in RFC 3161
  says.
  However, the user may not like to be involved in a digital signature
process
  everytime he wants to timestamp a document.

  Don't you think it would be useful to define something like an Attribute
  through which the user can store his document inside the token itself ?

--
Massimiliano Farris
Fst s.r.l.
System Integration & Software Development
Tel:    (+39) 070 2466 3523
Fax:    (+39) 070 2466 3111
e-mail: [email-masked]

---

From: J Adrian Pickering <[email-masked]>
Date: Tue, 21 May 2002 21:02:25 +0100

>   through which the user can store his document inside the token itself ?

The TSA *must* be completely disinterested in what he/she/it is 
timestamping. To allow the document or any version of it to travel through 
the ether would be a security risk and compromise the impartiality of the TSA.

So, the anwer is 'no', I think. Some other service might like to offer such 
a service, but not this one.

Adrian Pickering/
Southampton UK