Re: Why is privateKeyUsagePeriod deprecated?

[pgut001@xxxxxxxxxxxxxxxxx (Peter Gutmann)]

=?ISO-8859-1?Q?Michael_Str=F6der?= <michael@xxxxxxxxxxxx> writes:

>Personally I see no use of PKUP extension. How long signatures created with a
>private key associated with a PKC can be validated should not be specified in
>a public-key certificate. The more natural solution to me is to specify this
>in the policy and cryptographic protocol used for signing the message.

That would make it a CMS issue, which doesn't seem right.  It's the cert
that's expired, not the CMS signature.  In other words it doesn't matter what
sort of signing attributes you stick in the signature, the problem is that as
far as the cert-checking code is concerned, the cert has expired and is
therefore no longer allowed to be used.

Peter.