Subject: Re: TAP out of PKIX

From: Peter Sylvester <[email-masked]>
Date: Thu, 3 Apr 2003 20:02:42 +0200 (MET DST)

Denis, 

> 
> The technical quality of this draft document is very questionable.

Do you understand the meaning of the word 'draft'? 
Could it be that you suffer from psychological projection? 

For some it maybe surprising that you start with a comment about
the content of the document. Knowing a little bit of the
'French way of talking', one can still interprete this as "Well,
let's talk". Good. 

> 
> Like another draft document (i.e. SCVP) there is an abuse of OIDs
> in particular for archiveControls and even for the inclusion of
> a nonce using id-tap-nonce !!!
Peanuts.  

> 
> I wonder when the next draft posted to this WG will simply contain:
> 
>         queryControlType   OBJECT IDENTIFIER
>         queryControlValue  ANY DEFINED BY queryControlType OPTIONAL
> 
> with the corresponding response:
> 
>         responseControlType   OBJECT IDENTIFIER
>         responseControlValue  ANY DEFINED BY responseControlType OPTIONAL
> 
> Note the OPTIONAL at the end of the line !

You 'wonder when the next draft will'.  Do you mean
'whether' or something else?  Or, did you just read the 
next half page of 'ASN1 pour les nuls'? 

> The aspect of periodic refresh are mentioned in section 1.4 but the
> rational for it is missing many aspects. Section 7.2 only mentions:
> 
>      In order to protect against algorithm (i.e., hashing and digital
>      signature) compromise and/or computing technology advances,
>      timestamps are periodically refreshed.
> 
> This is only a small part of the whole story.

Thanks for pointing this out, you are invited to make constructive
comments to other parts of the whole story. 

> 
> Santosh said that TAP provide long-term non-repudiation of information.
> I disagree with this. TAP has nothing to do with non-repudiation.

I assume that in the last sentence there is a missing 'IMO' at the beginning. 

Would you mind to provide your vision of non-repudiation?

Do you know the meaning of conversion and redundancy of security measures?  

> 
> TAP is an archive protocol and should be addressed in a group specialized
> in archiving. PKIX is not such a WG.

Please reread the roadmap of PKIX concerning the section of data
certification and time stamping. 
 
> Note that it is also wrong to say that the TAA MAY be a TSA.

A missing 'IMO' or 'IMHO'? Can you explain why you think that 
a TAA cannot be a TSA?

> My position:
> 
> TAP should not been addressed in the PKIX WG, but some PKIX members could 
> certainly provide guidance to the security section dedicated to time-stamping.

Time stamping falls into the same roadmap item. If I' follow your advise
then time stamping has nothing to do in PKIX. 
 
> As an alternative, we could produce a *draft* dedicated to the use of
> time-stamp tokens associated with archives and the way to apply and
> verify them. That draft would *not* reach the RFC status and would
> be integrated in an RFC produced elsewhere.

Divide in order to conquer and then try to recombine is not exactly 
a good recipe IMHO to get a result. It seems that you already 
agree that there is something to be said from this group, and you
already discuss aspects the content. 

Peter

---

From: "Santosh Chokhani" <[email-masked]>
Date: Thu, 3 Apr 2003 15:08:57 -0500

Peter:

Thanks.

All:

I whole-heartedly agree with Peter.

I am baffled by some of the Denny's sweeping statements.

Not being a lawyer, I do not intend to debate what non-repudiation means.
Little I know of cryptography, what we have done can form the basis for
providing evidence well in to future to support the existence of a signed
document well in the past. 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Peter Sylvester
Sent: Thursday, April 03, 2003 1:03 PM
To: [email-masked]; [email-masked]
Subject: Re: TAP out of PKIX

Denis, 

For some it maybe surprising that you start with a comment about the content
of the document. Knowing a little bit of the 'French way of talking', one
can still interprete this as "Well, let's talk". Good. 

> 
> Like another draft document (i.e. SCVP) there is an abuse of OIDs in 
> particular for archiveControls and even for the inclusion of a nonce 
> using id-tap-nonce !!!
Peanuts.  

> This is only a small part of the whole story.

Thanks for pointing this out, you are invited to make constructive comments
to other parts of the whole story. 

> 
> Santosh said that TAP provide long-term non-repudiation of 
> information. I disagree with this. TAP has nothing to do with 
> non-repudiation.

I assume that in the last sentence there is a missing 'IMO' at the
beginning. 

> 
> TAP is an archive protocol and should be addressed in a group 
> specialized in archiving. PKIX is not such a WG.

 
> verify them. That draft would *not* reach the RFC status and would be 
> integrated in an RFC produced elsewhere.

Divide in order to conquer and then try to recombine is not exactly 
a good recipe IMHO to get a result. It seems that you already 
agree that there is something to be said from this group, and you already
discuss aspects the content. 

Peter