Subject: RE: association between the time-stamp and the original document

From: Massimiliano Farris <[email-masked]>
Date: Wed, 22 May 2002 10:57:35 +0200

> In the context of the use of CMS, RFC 3126 has defined two time-stamp
> related attributes:
> 
> 1) A signed attribute, attached to the SignedData. 
>    It is the Content Time-Stamp attribute (p.34).
> 
>    The content time-stamp attribute is an attribute which is the time-
>    stamp of the signed data content before it is signed.
> 
>       id-aa-ets-contentTimestamp OBJECT IDENTIFIER ::= { iso(1)
>       member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
>       smime(16) id-aa(2) 20}
> 
> 2) An unsigned attribute, attached to the digital signature. 
>    It is the Signature Time-Stamp Attribute (p.36):
> 
>    The Signature Timestamp attribute is a timestamp of the signature
>    value.
> 
>       id-aa-signatureTimeStampToken OBJECT IDENTIFIER ::= { iso(1)
>       member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9) 
> smime(16)
>       id-aa(2) 14}
> 
> As indicated, these attributes are only usable in the context of a CMS
> message.
> 
> Denis
> 
  I know it, I completely agree.
  However, my question is about something else.
  I talked of id-aa-signatureTimeStampToken only as an example.
  I'm talking about the definition of an Unsigned Attribute to be used
  in the context of a time-stamp (which is a CMS).
  This lets a user to enrich the time-stamp received by a TSA with the
  'object' of the time-stamp itself.
  In the first e-mail I said:

  > However, the user may not like to be involved in a 
  > digital signature process everytime he wants to 
  > timestamp a document.

  In this case, the user has the great problem to 'link', to associate in
  some manner the time-stamp with the document. Without this association,
  the time-stamp is useless.
  Do you think this problem has to be solved by the client responsible of
  managing the interaction with the TSA, without any standardized way ?
  Do you think that only time-stamps of a signature have a sense ?

---

From: Denis Pinkas <[email-masked]>
Date: Wed, 22 May 2002 11:30:04 +0200

Massimiliano,

> >       smime(16) id-aa(2) 14}

>   in the context of a time-stamp (which is a CMS).

This does make sense.

>   the time-stamp is useless.

There are two ways to perform the link:

  1) the time-stamp is attached to the data, this is what RFC 3126 does.
  2) the data is attached to the time-stamp, this is what you suggest.

>   Do you think that only time-stamps of a signature have a sense ?

The link could be done locally by adding an unsigned attribute to the
structure of the time-stamp token which is CMS based.

I would guess that you would like a sequence of URIs to be included in that
unsigned attribute. What else ?

Denis