Subject: RE: association between the time-stamp and the original document

From: Massimiliano Farris <[email-masked]>
Date: Wed, 22 May 2002 09:34:47 +0200

> The TSA *must* be completely disinterested in what he/she/it is 
> timestamping. To allow the document or any version of it to 
> travel through 
> the ether would be a security risk and compromise the 
> impartiality of the TSA.
> 
> So, the anwer is 'no', I think. Some other service might like 
> to offer such 
> a service, but not this one.
> 
> Adrian Pickering/
> Southampton UK
> 
  I'm not talking about what the TSA can manage.
  TSA never sees the original document, only its
  digest.
  I'm talking about the definition of an attribute,
  such like the 'id-aa-timeStampToken' one, which 
  allows the user to easily store a SignedData with
  its time-stamp(s).
  All I'm asking is to allow the user to store in a
  sure and easy way both the time-stamp and the 
  original document.
  Otherwise, many users will set up many different
  non-standardized ways to do this work. It's a great
  problem, because if the user loses the document, or change
  even one byte of it, its time-stamp becomes useless.

---

From: Denis Pinkas <[email-masked]>
Date: Wed, 22 May 2002 10:03:09 +0200

Massimiliano,

>   allows the user to easily store a SignedData with

In the context of the use of CMS, RFC 3126 has defined two time-stamp
related attributes:

1) A signed attribute, attached to the SignedData. 
   It is the Content Time-Stamp attribute (p.34).

   The content time-stamp attribute is an attribute which is the time-
   stamp of the signed data content before it is signed.

      id-aa-ets-contentTimestamp OBJECT IDENTIFIER ::= { iso(1)
      member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
      smime(16) id-aa(2) 20}

2) An unsigned attribute, attached to the digital signature. 
   It is the Signature Time-Stamp Attribute (p.36):

   The Signature Timestamp attribute is a timestamp of the signature
   value.

      id-aa-signatureTimeStampToken OBJECT IDENTIFIER ::= { iso(1)
      member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16)
      id-aa(2) 14}

As indicated, these attributes are only usable in the context of a CMS
message.

Denis