Re: Requesting information on Time stamp authority certificate expiry.

While one can interpret a timestamp as extending the life of a signed object, that is not the technical definition of a timestamp.

 

A timestamp says “I successfully validated the signature on this object at time X”.  One can chain timestamps together so that a second timestamp could be made on the first one which allows one to do a chain of inference.  

 

Code signing generates a problem because there is no opportunity to apply a new timestamp and re-distribute the result which is what should happen.  Therefore, a hard coded public key is used which is “known” to be good past the certificate expiration date.  God help us if the key is ever compromised.  Additionally, problems are going to occur over time with the hash algorithm being declared as not longer usable for the counter signature.

 

The correct rule ought to be, when the TSA certificate expires the signature expires and it no longer tells you anything more.  If there is a chain one may be able to infer things, but changes in algorithms can kill you.   You can look at the work of the LTANS WG for some back ground (RFC 4998 and RFC 5698 are good starters).

 

 

 

From: pkix [mailto:[email protected]] On Behalf Of Anoop Gulati
Sent: Thursday, January 4, 2018 10:22 AM
To: [email protected]
Subject: [pkix] Requesting information on Time stamp authority certificate expiry.

 

Hi Team,

Happy 2018!

 

I'm requesting some clarification on the status of a timestamped signature when the timestamp authority (TSA) certificate expires.

My understanding is timestamp is applied to a digital signature to ensure the digital signature continues to stay valid past the lifetime of the signing certificate.

RFC 3161, in section 4.3 briefly talks about TSA certificate lifetimes but it does not clarify the situation of a natural TSA certificate expiry.


We recently experienced an enterprise-wide outage when java started to error out on a signed & timestamped jar file when the TSA certificate expired.
Windows, on the other hand does not error out on signed & timestamped files on TSA certificate expiry.

 

So, it seems like, even implementation between platforms is not consistent.

Hence I'm writing to understand how expiry of a TSA certificate impacts existing signed and timestamped files.

Sincere apologies in advance if this is not the right platform to discuss this, I was not able to find a working group specifically for digital timestamp & TSAs.

 

Thanks,

 

Anoop

_______________________________________________
pkix mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/pkix