Subject: Re: New time stamping standard by ISO

From: Alicia da Conceicao <[email-masked]>
Date: Tue, 26 Sep 2006 01:52:42 -0400 (EDT)

> I too am not comfortable with a TSA signing a document, vs. signing a 
> hash of a document, as a way to time stamp the data contained in the 
> document.

As someone who has set up a few TSA's, I agree whole-heartedly.
The TSA is not authorizing the document, only providing validity
that it existed at a specific time.

Changes to ISO-18014-2 would require changes to the time stamp
request and responses, and well as changes to the network services
and even transport.  Having a TSA receive any type of sensitive
data for signing would require network security layers (like IPsec,
SSL/TLS, SSH, etc.), that is not required in RFC-3166 since the
TSA only dealt with non-sensitive document hashes.

Why is it that the ISO committee wants to deviate from the decent
and established RFC-3166 time stamping standard in ISO-18014-2?
I have yet to see any real benefit/advantages in doing so.

Alicia.

---

From: "Denis Pinkas" <[email-masked]>
Date: Fri, 29 Sep 2006 13:46:20 +0200

José,
 
>> Stefan or any other involved in this thread,
>> 
>> Would you be able to provide the document number of the SC27 document 
>> so that people on the PKIX list may dig it more easily from their ISO NB ?
>> 
>> Additional question : when is the dead line for sending NB comments to SC 27 ?
>> 
>> Denis
>
>The current WD is
>	SC27N5134_3rdWD_18014-2_Jul2006.pdf

SC27N5134 is: Information technology -- Security techniques -- 
Digital signatures giving message recovery -- 
Part 2 : Integer factorization based mechanisms -- Amendment 1

It is not apparently the right document. Would you please provide the right number ?

Denis

>The deadline for comments is
>	30.9.2006 (tomorrow)
>
>anyhow, besides formal comments,
>i'd try to listen to informal comments too,
>and try to push for the best
>
>jam
>	
>
>

Regards,

Denis Pinkas