RE: [dss] Timestamping

["Nick Pope" <pope@secstan.com>]

Gregor,

I realised that I over simplified the situation.  There are three
situations:

a] A time-mark is included within the signed data as an
indication/affirmation from the signatory of the signing time

b] A time-stamp is included within the signed data, applied against one or
all the signed objects, as an affirmation from an independent party of the
time at which the signed data existed, which is on or before the signing
time.

c] A time-stamp is applied over the signature as an affirmation from an
independent party that the signature was created on or after the signing
time.  If the signing time is also included in the signed data (as in [a])
this can be used to independently support this signing time and protects
against later repudiation of the signature.

I think that I have it now matching the options in XAdES.

Nick



> -----Original Message-----
> From: Gregor Karlinger [mailto:gregor.karlinger@cio.gv.at]
> Sent: 25 March 2003 15:49
> To: 'Trevor Perrin'
> Cc: dss@lists.oasis-open.org
> Subject: RE: [dss] Timestamping
>
>
> > -----Original Message-----
> > From: Trevor Perrin [mailto:trevp@trevp.net]
> > Sent: Tuesday, March 18, 2003 10:38 PM
> > To: dss@lists.oasis-open.org
> > Subject: [dss] Timestamping
>
> [...]
>
> > A time-marked signature is just a signature on some content
> > with a signed
> > attribute (created by the signer) containing the signing time.
> >
> > A time-stamped signature contains, as an unsigned attribute,
> > a timestamp
> > "token", which somehow binds the time and a hash of the time-stamped
> > signature's signatureValue, and is created and signed by a
> > 3rd party TSA
> > (Time Stamp Authority).
>
> My understanding of those two terms is the following:
>
> * A signature is time-marked if the signer claims the signing
>   time and signes this claim together with the actual data.
>
> * A signature is time-stamped if the time is claimed by a
>   trusted third party, and this claim is incorporated into
>   the signature as time stamp token.
>
> Am I right here? Other opinions?
>
> /Gregor Karlinger
>
> [...]
>