There's no need to safeguard the validation data for ATS1 at the time ATS2 is applied. The validation data can be preserved independently of the data and retrieved using SCVP/ERS. Amongst other benefits, this allows for a grace period to be applied between the time ATS2 was generated and the time of interest for validating the TSA1 credentials.
> -----Original Message-----
> From: owner-ietf-ltans@xxxxxxxxxxxx
> [mailto:owner-ietf-ltans@xxxxxxxxxxxx] On Behalf Of Vittek Robert
> Sent: Tuesday, September 04, 2007 1:23 PM
> To: ietf-ltans@xxxxxxx
> Subject: security issue in archive timestamp chain?
>
>
> We are currently implementing a long term electronic
> signature based on XAdES, so I went through TS 101 903, TS
> 101 733 and other RFCs that led me finaly to LTANS group
> because XAdES does not address the problem of validation of
> TSA certificates ("Rules for acceptance of the validity of
> the signature within the time-stamp, involving trust
> decisions, are out of the scope of the present document.").
>
> I am interested in solving the following problem.
>
> http://tools.ietf.org/html/rfc4998#section-5.3 states that:
> Each Archive Timestamp MUST be valid relative to the time of
> the following Archive Timestamp.
>
> Let's assume that we have Archive Time-Stamp 1 (ATS1) and we
> need to renew it and safeguard the validation data for ATS1
> at the same time. But the next Archive Time-Stamp 2 (ATS2)
> can prove existence only of the CRLs issued before time T2
> (from ATS2). ATS2 does NOT give any evidence that there was
> not another CRL2 (issued by CA that issued TSA1 certificate)
> which contained information on revocation of TSA1 certificate.
>
> I think that arbitration on validity of ATS1 might take place
> long after the archive of relevant CRLs is available and long
> after the used cryptography is strong enough, so the attacker
> might produce such CRL2 himself just to cast doubt upon the
> archived data.
>
> In other words: while T2 - safeguardedCRLforTSA1.thisUpdate >
> 0, arbitrator can not be sure that there was not another CRL2
> that listed TSA1 certificate.
>
> Am I missing something or is it a security issue?
>
>
> Mgr. Robert Vittek
>
> DITEC, a.s.
> Bratislava Business Center V
> Plynárenská 7/C
> 821 09 Bratislava
>
> voice: +421 2 58 222 487
> fax: +421 2 58 222 777
> cell: +421 908 797 827
> mailto:vittek@xxxxxxxx
>