Subject: Certificate Validity Problem

From: "Ersin Gulacti" <[email-masked]>
Date: Wed, 7 Dec 2005 18:23:34 +0200 (EET)

Hello,

We are operating a Certificate Authority (which uses our own CA software)
and we have a process to set certificate status to on-hold. Owners of
certificates can put their certificates on-hold and they can return them
to the valid status.

When somebody tries to verify the validity of signature he can only check
the most recent status of the certificate. He can use the most fresh CRL
or execute an OCSP query. Both of these techniques lack an important
functionality, you cannot query the status of a certificate at a certain
time in the past. Maybe at the time of signing the certificate used was
on-hold.

Is there a method or another technique to solve this problem?

Thanks.

---

From: Stephen Kent <[email-masked]>
Date: Thu, 8 Dec 2005 11:59:02 -0500

>Is there a method or another technique to solve this problem?

SCVP should be able to accommodate queries about the status of a cert 
at a previous point in time.

Steve

---

From: Russ Housley <[email-masked]>
Date: Fri, 09 Dec 2005 11:03:35 -0500

The protocol accommodates the query, but the server need to keep the 
historical data to respond property.  As I see it, this historical 
data retention is optional.

Russ

At 11:59 AM 12/8/2005, Stephen Kent wrote:

>SCVP should be able to accommodate queries about the status of a 
>cert at a previous point in time.
>
>Steve
>

---

From: Stephen Kent <[email-masked]>
Date: Fri, 9 Dec 2005 11:52:35 -0500

>data retention is optional.

Agreed.

Steve

---

From: "Santosh Chokhani" <[email-masked]>
Date: Fri, 9 Dec 2005 12:53:24 -0500

The work being done in the IETF LTANS will also help.

Also, there is an I-D that is relevant to this effort.  The following is the
I-D URL.

http://www.ietf.org/internet-drafts/draft-ietf-ltans-ers-scvp-00.txt

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Russ Housley
Sent: Friday, December 09, 2005 11:04 AM
To: Stephen Kent; Ersin Gulacti
Cc: [email-masked]
Subject: Re: Certificate Validity Problem

Russ

---

From: "Anders Rundgren" <[email-masked]>
Date: Sat, 10 Dec 2005 10:21:38 +0100

Ersin,

You may as some people proposed, rely on a service to provide this information.

A more general approach that works with existing services offered
by CAs is to actually validate (and optionally record results,
timestamp etc.) certificates during receival of a signed message.

By also using on-line signing[*], the difference between the actual
signing time and receival time becomes insignificant.

This scheme has AFAIK been adopted by most governments in the EU.

The major advantage of this approach is that it is independent of if the
CA is still alive the day the signature is to be relied upon.  This is
indeed a real-world issue both for commercial CAs or in-house CAs.

A further problem with "historic" validation services, is that unless you
actually use on-line signing and associated storage, it seems to be
rather hard to securely determine the signing time.

Note that none of the suggested methods though properly supports the
case when it is later found out that the private key was out of control during
the signing.  That is, it does not seem to help much if you ten years after
the signature was performed (when you suddenly need to rely on it),
find out that it was actually made by the wrong person.  For that
scenario you would rather need an alert from the CA in order to deal
with the situation immediately when it occurred.  Although I don't
propose any new protocol, this would probably need something like
a "Monitor this certificate" request.

Anders Rundgren
Principal Engineer
RSA Security

Disclaimer:
This message expresses the author's own opinions and not necessarily those
of RSA Security

*] Although on-line signatures are in a poor shape standards-wise, the
advantages of of combining signature validation,  input data validatation,
interactivity, and SSL encryption in one chunk, has anyway made this way
of signing more important in the EU than signed e-mail.

----- Original Message ----- 
From: "Ersin Gulacti" <[email-masked]>
To: <[email-masked]>
Sent: Wednesday, December 07, 2005 17:23
Subject: Certificate Validity Problem

Hello,

Thanks.